| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: HiddenObject.Multi.Generic und PC verhält sich merkwürdigWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.12.2013, 18:43
| #1 |
 |  HiddenObject.Multi.Generic und PC verhält sich merkwürdig Guten Tag, ich habe einen alltäglichen Suchlauf mit Kaspersky gemacht und das Programm hat mir dann eine Bedrohung angezeigt und zwar diese: ads-in-clientCAQ213L4.js Nicht desinfizierte Objekte: HiddenObject.Multi.Generic 25.12.2013 17:22:46 c:\Documents and Settings\alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\50L7JD41\ Zurückgestellt Untersuchung des Computers ads-in-clientCAQ213L4.js Gefunden: HiddenObject.Multi.Generic 25.12.2013 17:22:46 c:\Documents and Settings\alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\50L7JD41\ Protokolliert Untersuchung des Computers Ich habe auch Boot probleme mit Windows gehabt, das beim Hochfahren die Meldung kommt, "windows lädt dateien" und der Ladebalken. PC konnte nicht gestartet werden ohne die Reperatur (welche nichts repariert hat). Heute den PC angemacht und windows explorer ist nach der Kennwort eingabe abgestürtzt, etc. Bekomme zahlreiche Bluescreens und ich weis nicht mehr was ich machen kann. Ich lasse gerade noch einen Full-Scan mit MBAM machen und dort wird mir auch schon ein infiziertes Objekt angezeigt. Ich habe keine Ahnung wo die Sachen herkommen, ich habe mir vorgestern Oblivion gekauft und ein paar Mods dazu heruntergeladen, diese aber alle wieder deinstalliert + das Spiel auch weil es nicht so ging wie ich es wollte. Daten wurden von der Offizielen Mod-Seite heruntergeladen. Ich surfe abundzu auf reddit umher und das warsdann auch. Ich besuche keine pornografischen websites bzw. streaming websites etc. EDIT: der MBAM-Log Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.12.23.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16750 alex :: ALEX-PC [Administrator] 25.12.2013 18:06:15 MBAM-log-2013-12-25 (18-25-37).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 394378 Laufzeit: 19 Minute(n), 4 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2E55JHTF\PFPortChecker3Offers_8007[1].exe (PUP.Optional.InstallMonetizer.A) -> Keine Aktion durchgeführt. (Ende) FRST-Log: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-12-2013
Ran by alex (administrator) on ALEX-PC on 25-12-2013 18:40:36
Running from C:\Users\alex\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel(R) Corporation) C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12681320 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2273056 2013-11-29] (NVIDIA Corporation)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.140.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @t.garena.com/garenatalk - C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Flashblock - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
FF Extension: WOT - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: NoScript - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: CookieCuller - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{99B98C2C-7274-45a3-A640-D9DF1A1C8460}.xpi
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
Chrome:
=======
CHR DefaultSearchProvider: Delta Search
CHR Plugin: (Shockwave Flash) - C:\Users\alex\AppData\Local\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\alex\AppData\Local\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\alex\AppData\Local\Google\Chrome\Application\27.0.1453.94\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Google Update) - C:\Users\alex\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Raidcall plugin) - C:\Users\alex\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Docs) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Safe Money) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Gmail) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Anti-Banner) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\alex\AppData\LocalLow\proxtube\CHROME\proxtube.crx
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx
==================== Services (Whitelisted) =================
S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1370912 2013-11-29] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15128352 2013-11-29] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-11-09] ()
R2 XTU3SERVICE; C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe [15888 2013-02-11] (Intel(R) Corporation)
==================== Drivers (Whitelisted) ====================
R3 AcpiCtlDrv; C:\Windows\System32\DRIVERS\AcpiCtlDrv.sys [25880 2012-07-17] (Intel Corporation)
S3 bulkadi; C:\Windows\System32\DRIVERS\bulkrazer_x64.sys [25088 2011-02-09] (Windows (R) Codename Longhorn DDK provider)
S3 EfiVariable; C:\Windows\SysWOW64\Drivers\variable64.sys [18200 2010-10-28] (Windows (R) Server 2003 DDK provider)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO64A.SYS [29672 2013-01-19] (REALiX(tm))
R2 iocbios2; C:\Program Files (x86)\Intel\Extreme Tuning Utility\Drivers\IocDriver\64bit\iocbios2.sys [25448 2013-01-07] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-12-11] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [626272 2013-10-10] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-12-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-24] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-07-24] (Kaspersky Lab ZAO)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-10-30] (NVIDIA Corporation)
R3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13368 2013-01-23] ()
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [22016 2012-09-18] (Razer USA Ltd)
S3 ALSysIO; \??\C:\Users\alex\AppData\Local\Temp\ALSysIO64.sys [x]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Plus\Room\safedrv.sys [x]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-07-24] (Kaspersky Lab ZAO)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-25 18:39 - 2013-12-25 18:40 - 00019289 _____ C:\Users\alex\Downloads\FRST.txt
2013-12-25 18:39 - 2013-12-25 18:39 - 00000470 _____ C:\Users\alex\Downloads\defogger_disable.log
2013-12-25 18:38 - 2013-12-25 18:38 - 01928716 _____ (Farbar) C:\Users\alex\Downloads\FRST64.exe
2013-12-25 18:38 - 2013-12-25 18:38 - 00377856 _____ C:\Users\alex\Downloads\gmer_2.1.19163.exe
2013-12-25 18:38 - 2013-12-25 18:38 - 00050477 _____ C:\Users\alex\Downloads\Defogger.exe
2013-12-23 22:20 - 2013-12-23 22:20 - 00000088 _____ C:\Windows\TweakOblivion.ini
2013-12-23 00:36 - 2013-12-24 01:19 - 00000023 _____ C:\Windows\BlendSettings.ini
2013-12-23 00:35 - 2013-12-23 22:20 - 00000000 ____D C:\Users\alex\AppData\Local\Oblivion
2013-12-22 11:41 - 2013-12-22 11:41 - 00000000 ____D C:\Users\alex\Desktop\file_61324072787_3470_0
2013-12-20 12:27 - 2013-12-20 12:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 00:36 - 2013-12-19 00:36 - 01958098 _____ C:\Users\alex\Downloads\2560x1080 NSFW - Imgur.zip
2013-12-18 09:27 - 2013-12-18 09:33 - 19545912 _____ C:\Users\alex\Downloads\MSIAfterburnerSetup300Beta15.zip
2013-12-16 13:34 - 2013-12-16 13:34 - 09819638 _____ C:\Users\alex\Downloads\Daniella Lanio - Imgur.zip
2013-12-16 13:31 - 2013-12-16 13:31 - 04640400 _____ C:\Users\alex\Downloads\ParisRoxanne - Imgur.zip
2013-12-15 00:30 - 2013-12-15 00:30 - 00000000 ____D C:\Users\alex\AppData\Local\Blizzard
2013-12-15 00:19 - 2013-12-15 01:32 - 00000000 ____D C:\Users\alex\AppData\Local\Battle.net
2013-12-15 00:19 - 2013-12-15 00:37 - 00000000 ____D C:\Users\alex\AppData\Roaming\Battle.net
2013-12-15 00:19 - 2013-12-15 00:19 - 00001150 _____ C:\Users\Public\Desktop\Battle.net.lnk
2013-12-15 00:19 - 2013-12-15 00:19 - 00000000 ____D C:\Program Files (x86)\Battle.net
2013-12-12 15:01 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 15:01 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 15:01 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 15:01 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-12 15:00 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-12 15:00 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-12 15:00 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-12 15:00 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-12 15:00 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-12 15:00 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-12 15:00 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-12 15:00 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-12 15:00 - 2013-10-25 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-12 15:00 - 2013-10-25 04:41 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-12 15:00 - 2013-10-25 04:17 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-12 15:00 - 2013-10-25 03:49 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-12 01:35 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 01:35 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 01:35 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-12 01:35 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-12 01:35 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 01:35 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 01:35 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 01:35 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 01:35 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 01:35 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 01:35 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 01:35 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-12 01:35 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 01:35 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-12 01:35 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 01:35 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-12 01:35 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-12 01:35 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-12 01:35 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-10 04:59 - 2013-12-10 04:59 - 05055530 _____ C:\Users\alex\Downloads\Non-Nude Sexy Wallpapers - Imgur.zip
2013-12-09 02:11 - 2013-12-09 02:12 - 36773854 _____ C:\Users\alex\Downloads\Randoms - Imgur.zip
2013-12-08 12:08 - 2013-12-08 12:08 - 02017033 _____ C:\Users\alex\Downloads\Emma Glover - Imgur.zip
2013-12-07 20:41 - 2013-12-07 20:41 - 08868299 _____ C:\Users\alex\Desktop\CBS.7z
2013-12-07 20:41 - 2013-12-07 20:41 - 00000000 ____D C:\Users\alex\Desktop\CBS
2013-12-07 02:13 - 2013-12-07 02:13 - 00000000 ____D C:\Users\alex\Downloads\The Ass Gallery - Imgur
2013-12-06 21:59 - 2013-12-06 21:59 - 00128916 _____ C:\Users\alex\Desktop\Fehler1&2.7z
2013-12-06 08:03 - 2013-12-23 23:53 - 00000000 ____D C:\Users\alex\AppData\Roaming\Dropbox
2013-12-04 23:33 - 2013-12-04 23:33 - 00000000 ____D C:\Windows\CheckSur
2013-12-04 11:58 - 2013-12-04 11:58 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-12-04 11:47 - 2013-12-04 11:47 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ALEX-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2013-12-04 11:47 - 2013-12-04 11:47 - 00000000 ____D C:\RegBackup
2013-12-04 11:29 - 2013-12-04 14:23 - 00000134 _____ C:\Users\alex\Desktop\Internet Explorer-Problembehebung.url
2013-12-03 23:35 - 2013-12-03 23:35 - 00000825 _____ C:\Users\alex\Desktop\JRT.txt
2013-12-03 22:44 - 2013-12-03 22:56 - 00000000 ____D C:\Users\alex\Desktop\mbar
2013-12-03 22:44 - 2013-12-03 22:44 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-03 15:54 - 2013-12-04 19:06 - 00000000 ____D C:\Users\alex\Desktop\FRST
2013-12-03 06:40 - 2013-10-30 18:03 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-03 06:40 - 2013-10-30 18:02 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-03 01:28 - 2013-12-03 01:28 - 12999313 _____ C:\Users\alex\Downloads\Casey Connelly - Imgur.zip
2013-12-02 07:19 - 2013-12-02 07:19 - 16422740 _____ C:\Users\alex\Downloads\realbarbielifts - Imgur(1).zip
2013-12-02 06:29 - 2013-12-02 06:29 - 02520182 _____ C:\Users\alex\Downloads\Album 4HhzQ - Imgur.zip
2013-12-02 03:42 - 2013-12-02 03:42 - 01371376 _____ C:\Users\alex\Downloads\faucheer - Imgur.zip
2013-12-01 21:38 - 2013-12-01 21:38 - 00000000 ____D C:\Users\alex\AppData\Local\Ascaron Entertainment
2013-11-29 00:55 - 2013-11-29 00:55 - 01327845 _____ C:\Users\alex\Downloads\body so tight - Imgur.zip
2013-11-28 17:03 - 2013-11-28 17:04 - 242396304 _____ C:\Users\alex\Desktop\Jon Bellion - Jim Morrison.avi
2013-11-26 02:52 - 2013-12-25 01:04 - 00405186 _____ C:\Windows\IE11_main.log
==================== One Month Modified Files and Folders =======
2013-12-25 18:40 - 2013-12-25 18:39 - 00019289 _____ C:\Users\alex\Downloads\FRST.txt
2013-12-25 18:39 - 2013-12-25 18:39 - 00000470 _____ C:\Users\alex\Downloads\defogger_disable.log
2013-12-25 18:38 - 2013-12-25 18:38 - 01928716 _____ (Farbar) C:\Users\alex\Downloads\FRST64.exe
2013-12-25 18:38 - 2013-12-25 18:38 - 00377856 _____ C:\Users\alex\Downloads\gmer_2.1.19163.exe
2013-12-25 18:38 - 2013-12-25 18:38 - 00050477 _____ C:\Users\alex\Downloads\Defogger.exe
2013-12-25 18:38 - 2012-08-29 14:13 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-12-25 18:31 - 2012-11-25 18:01 - 00000000 ____D C:\Program Files (x86)\HP
2013-12-25 18:31 - 2012-10-22 13:58 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-25 18:30 - 2013-07-24 06:51 - 00000000 ____D C:\Program Files (x86)\Diablo II
2013-12-25 18:22 - 2012-06-02 02:35 - 00000000 ____D C:\Users\alex\AppData\Roaming\Skype
2013-12-25 18:00 - 2012-05-18 20:22 - 01310036 _____ C:\Windows\WindowsUpdate.log
2013-12-25 17:04 - 2012-05-18 20:36 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-25 16:26 - 2009-07-14 05:45 - 00021856 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-25 16:26 - 2009-07-14 05:45 - 00021856 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-25 16:25 - 2011-04-12 08:43 - 00685600 _____ C:\Windows\system32\perfh007.dat
2013-12-25 16:25 - 2011-04-12 08:43 - 00145432 _____ C:\Windows\system32\perfc007.dat
2013-12-25 16:25 - 2009-07-14 06:13 - 01620812 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-25 16:21 - 2013-10-17 23:25 - 00003018 _____ C:\Windows\System32\Tasks\MSIAfterburner
2013-12-25 16:21 - 2013-09-09 05:17 - 00030358 _____ C:\Windows\setupact.log
2013-12-25 16:21 - 2013-04-16 08:32 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-25 16:21 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-25 16:18 - 2013-04-21 10:38 - 00369664 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-25 01:04 - 2013-11-26 02:52 - 00405186 _____ C:\Windows\IE11_main.log
2013-12-24 19:40 - 2013-09-10 18:34 - 00187774 _____ C:\Windows\PFRO.log
2013-12-24 01:19 - 2013-12-23 00:36 - 00000023 _____ C:\Windows\BlendSettings.ini
2013-12-24 01:19 - 2012-05-23 15:32 - 00000000 ____D C:\Users\alex\Documents\my games
2013-12-24 01:02 - 2012-09-15 11:13 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-24 00:53 - 2012-12-30 08:15 - 00000000 ____D C:\Program Files (x86)\MSI Afterburner
2013-12-23 23:53 - 2013-12-06 08:03 - 00000000 ____D C:\Users\alex\AppData\Roaming\Dropbox
2013-12-23 22:20 - 2013-12-23 22:20 - 00000088 _____ C:\Windows\TweakOblivion.ini
2013-12-23 22:20 - 2013-12-23 00:35 - 00000000 ____D C:\Users\alex\AppData\Local\Oblivion
2013-12-23 22:20 - 2012-05-18 20:22 - 00000000 ____D C:\Users\alex
2013-12-23 02:06 - 2012-05-23 15:47 - 00000000 ____D C:\Users\alex\Documents\Nexus Mod Manager
2013-12-23 00:35 - 2013-09-09 12:15 - 00252330 _____ C:\Windows\DirectX.log
2013-12-23 00:35 - 2012-07-09 19:14 - 00000000 ____D C:\Users\alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-12-22 20:51 - 2013-09-24 22:55 - 00000000 ____D C:\Users\alex\Desktop\Unending wisdom of 氷の竜
2013-12-22 11:41 - 2013-12-22 11:41 - 00000000 ____D C:\Users\alex\Desktop\file_61324072787_3470_0
2013-12-21 14:57 - 2013-09-11 14:53 - 00000000 ____D C:\Program Files (x86)\Warcraft III
2013-12-21 04:51 - 2012-05-20 01:01 - 00000000 ____D C:\Users\alex\AppData\Roaming\TS3Client
2013-12-20 22:24 - 2012-05-20 01:01 - 00000000 ____D C:\Users\alex\AppData\Local\TeamSpeak 3 Client
2013-12-20 12:27 - 2013-12-20 12:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 00:36 - 2013-12-19 00:36 - 01958098 _____ C:\Users\alex\Downloads\2560x1080 NSFW - Imgur.zip
2013-12-18 09:33 - 2013-12-18 09:27 - 19545912 _____ C:\Users\alex\Downloads\MSIAfterburnerSetup300Beta15.zip
2013-12-17 22:37 - 2013-10-22 22:26 - 00001268 _____ C:\Users\alex\Desktop\rift shit.txt
2013-12-16 13:34 - 2013-12-16 13:34 - 09819638 _____ C:\Users\alex\Downloads\Daniella Lanio - Imgur.zip
2013-12-16 13:31 - 2013-12-16 13:31 - 04640400 _____ C:\Users\alex\Downloads\ParisRoxanne - Imgur.zip
2013-12-15 19:35 - 2012-06-23 20:35 - 00000000 ____D C:\Users\alex\AppData\Roaming\Mumble
2013-12-15 01:32 - 2013-12-15 00:19 - 00000000 ____D C:\Users\alex\AppData\Local\Battle.net
2013-12-15 00:37 - 2013-12-15 00:19 - 00000000 ____D C:\Users\alex\AppData\Roaming\Battle.net
2013-12-15 00:30 - 2013-12-15 00:30 - 00000000 ____D C:\Users\alex\AppData\Local\Blizzard
2013-12-15 00:19 - 2013-12-15 00:19 - 00001150 _____ C:\Users\Public\Desktop\Battle.net.lnk
2013-12-15 00:19 - 2013-12-15 00:19 - 00000000 ____D C:\Program Files (x86)\Battle.net
2013-12-13 18:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-13 05:06 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-11 12:31 - 2012-10-22 13:58 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-11 12:31 - 2012-05-18 23:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 12:31 - 2012-05-18 23:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 08:18 - 2012-08-02 14:09 - 00029792 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klim6.sys
2013-12-11 08:18 - 2012-06-19 16:28 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2013-12-10 04:59 - 2013-12-10 04:59 - 05055530 _____ C:\Users\alex\Downloads\Non-Nude Sexy Wallpapers - Imgur.zip
2013-12-09 02:12 - 2013-12-09 02:11 - 36773854 _____ C:\Users\alex\Downloads\Randoms - Imgur.zip
2013-12-09 01:25 - 2013-08-08 16:40 - 00001961 _____ C:\Users\alex\Desktop\tatoos.txt
2013-12-08 12:08 - 2013-12-08 12:08 - 02017033 _____ C:\Users\alex\Downloads\Emma Glover - Imgur.zip
2013-12-07 20:41 - 2013-12-07 20:41 - 08868299 _____ C:\Users\alex\Desktop\CBS.7z
2013-12-07 20:41 - 2013-12-07 20:41 - 00000000 ____D C:\Users\alex\Desktop\CBS
2013-12-07 15:50 - 2013-08-18 00:18 - 00000000 ____D C:\Windows\pss
2013-12-07 15:50 - 2012-05-18 20:23 - 00000000 ___RD C:\Users\alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-07 15:46 - 2012-06-02 02:35 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-07 15:46 - 2012-06-02 02:35 - 00000000 ____D C:\ProgramData\Skype
2013-12-07 02:13 - 2013-12-07 02:13 - 00000000 ____D C:\Users\alex\Downloads\The Ass Gallery - Imgur
2013-12-06 21:59 - 2013-12-06 21:59 - 00128916 _____ C:\Users\alex\Desktop\Fehler1&2.7z
2013-12-04 23:33 - 2013-12-04 23:33 - 00000000 ____D C:\Windows\CheckSur
2013-12-04 19:06 - 2013-12-03 15:54 - 00000000 ____D C:\Users\alex\Desktop\FRST
2013-12-04 14:23 - 2013-12-04 11:29 - 00000134 _____ C:\Users\alex\Desktop\Internet Explorer-Problembehebung.url
2013-12-04 12:01 - 2013-04-20 11:20 - 00087488 _____ C:\Users\alex\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-04 12:00 - 2013-06-26 10:52 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-12-04 11:58 - 2013-12-04 11:58 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-12-04 11:57 - 2009-07-14 03:34 - 00000439 _____ C:\Windows\win.ini
2013-12-04 11:47 - 2013-12-04 11:47 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ALEX-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2013-12-04 11:47 - 2013-12-04 11:47 - 00000000 ____D C:\RegBackup
2013-12-04 11:34 - 2012-09-02 20:40 - 01594156 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-12-03 23:35 - 2013-12-03 23:35 - 00000825 _____ C:\Users\alex\Desktop\JRT.txt
2013-12-03 23:28 - 2013-09-09 05:14 - 00000000 ____D C:\AdwCleaner
2013-12-03 22:56 - 2013-12-03 22:44 - 00000000 ____D C:\Users\alex\Desktop\mbar
2013-12-03 22:56 - 2013-06-19 15:45 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-03 22:44 - 2013-12-03 22:44 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-03 06:41 - 2013-05-20 14:12 - 00000000 ____D C:\Users\alex\AppData\Local\NVIDIA
2013-12-03 06:41 - 2012-06-03 00:18 - 00000000 ____D C:\Users\alex\AppData\Local\NVIDIA Corporation
2013-12-03 06:40 - 2013-04-16 08:28 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-03 06:40 - 2013-04-15 20:37 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-03 06:40 - 2012-05-18 20:48 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-03 01:28 - 2013-12-03 01:28 - 12999313 _____ C:\Users\alex\Downloads\Casey Connelly - Imgur.zip
2013-12-02 07:19 - 2013-12-02 07:19 - 16422740 _____ C:\Users\alex\Downloads\realbarbielifts - Imgur(1).zip
2013-12-02 06:29 - 2013-12-02 06:29 - 02520182 _____ C:\Users\alex\Downloads\Album 4HhzQ - Imgur.zip
2013-12-02 03:42 - 2013-12-02 03:42 - 01371376 _____ C:\Users\alex\Downloads\faucheer - Imgur.zip
2013-12-01 21:38 - 2013-12-01 21:38 - 00000000 ____D C:\Users\alex\AppData\Local\Ascaron Entertainment
2013-11-29 17:56 - 2013-11-05 23:43 - 01096480 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2013-11-29 17:56 - 2013-11-05 23:43 - 00979744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2013-11-29 00:55 - 2013-11-29 00:55 - 01327845 _____ C:\Users\alex\Downloads\body so tight - Imgur.zip
2013-11-28 17:05 - 2012-06-11 04:19 - 00000000 ____D C:\Users\alex\AppData\Roaming\DVDVideoSoft
2013-11-28 17:04 - 2013-11-28 17:03 - 242396304 _____ C:\Users\alex\Desktop\Jon Bellion - Jim Morrison.avi
2013-11-25 13:00 - 2012-05-19 00:35 - 00000000 ____D C:\Users\alex\Documents\Diablo III
Some content of TEMP:
====================
C:\Users\alex\AppData\Local\Temp\Plugins Vista.exe
C:\Users\alex\AppData\Local\Temp\Plugins XP.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-21 11:27
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-12-2013
Ran by alex at 2013-12-25 18:41:02
Running from C:\Users\alex\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe AIR (x32 Version: 3.8.0.1430)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
AutoHotkey 1.1.13.01 (Version: 1.1.13.01)
Battle.net (x32)
Battlelog Web Plugins (x32 Version: 2.3.1)
CCleaner (Version: 4.02)
Core Temp 1.0 RC4 (Version: 1.0)
Counter-Strike: Global Offensive (x32)
CPUID CPU-Z 1.62
CrystalDiskInfo 5.6.2 (x32 Version: 5.6.2)
Debugging Tools for Windows (x86) (x32 Version: 6.10.3.233)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Diablo II (x32)
Dota 2 (x32)
ESN Sonar (x32 Version: 0.70.4)
GCFScape 1.8.4
GeForce Experience NvStream Client Components (Version: 1.6.28)
Hero Editor V0.96 (x32)
Intel Extreme Tuning Utility (x32 Version: 4.0.6.102)
Intel(R) Desktop Utilities (x32 Version: 1.0.0)
Intel(R) Extreme Tuning Utility (x32 Version: 1.0.0)
Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0)
Intel(R) Integrator Assistant (x32 Version: 1.0.0)
Intel(R) Management Engine Components (x32 Version: 9.0.0.1287)
Intel(R) Network Connections 16.5.2.0 (Version: 16.5.2.0)
Intel® Watchdog Timer Driver (Intel® WDT) (x32)
Internet Explorer (Enable DEP)
Java 7 Update 45 (64-bit) (Version: 7.0.450)
Kaspersky Internet Security 2013 (x32 Version: 13.0.1.4190)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938)
Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (x32 Version: 3.5.30730.0)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.88.0)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server Compact 3.5 SP2 ENU (x32 Version: 3.5.8080.0)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (Version: 3.5.8080.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSI Afterburner 2.3.1 (x32 Version: 2.3.1)
MSI Kombustor 2.4.2 (x32)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (x32 Version: 4.20.9818.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
Mumble 1.2.4 (x32 Version: 1.2.4)
Nexus Mod Manager (Version: 0.45.7)
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82)
NVIDIA 3D Vision Treiber 331.82 (Version: 331.82)
NVIDIA GeForce Experience 1.8 (Version: 1.8)
NVIDIA Grafiktreiber 331.82 (Version: 331.82)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4)
NVIDIA Install Application (Version: 2.1002.142.992)
NVIDIA LED Visualizer 1.0 (Version: 1.0)
NVIDIA Network Service (Version: 1.0)
NVIDIA PhysX (x32 Version: 9.13.0725)
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725)
NVIDIA ShadowPlay 10.10.5 (Version: 10.10.5)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182)
NVIDIA Systemsteuerung 331.82 (Version: 331.82)
NVIDIA Update 10.10.5 (Version: 10.10.5)
NVIDIA Update Core (Version: 10.10.5)
NVIDIA Virtual Audio 1.2.12 (Version: 1.2.12)
Origin (x32 Version: 9.0.13.2142)
Pando Media Booster (x32 Version: 2.6.0.8)
Path of Exile (x32)
PunkBuster Services (x32 Version: 0.993)
Rainmeter (x32 Version: 2.4 r1678)
Razer Mamba (x32 Version: 2.01.05)
Razer Megalodon Firmware Updater (x32 Version: 2.12.02)
Razer Synapse 2.0 (x32 Version: 1.5.18)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6449)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.27.0)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32)
SHIELD Streaming (Version: 1.6.75)
Skype Click to Call (x32 Version: 5.10.9560)
Skype™ 6.11 (x32 Version: 6.11.102)
Steam (x32 Version: 1.0.0.0)
TeamSpeak 3 Client (HKCU Version: 3.0.13.1)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32)
Warcraft III (x32)
==================== Restore Points =========================
24-12-2013 03:22:25 Windows Update
25-12-2013 00:04:24 Windows Update
25-12-2013 17:30:43 Removed I.R.I.S. OCR
25-12-2013 17:30:53 Removed HP Officejet 6600 Hilfe
25-12-2013 17:31:05 Removed HP Officejet 6600 - Grundlegende Software für das Gerät
25-12-2013 17:31:41 Removed Studie zur Verbesserung von HP Officejet 6600 Produkten
25-12-2013 17:31:52 Removed HP Update.
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-12-04 11:57 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0FBDAA31-E66F-4320-B674-1ACAC1C4E177} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-05-11] (Adobe Systems Incorporated)
Task: {5083AA73-3729-411E-B68E-F1380F658960} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
Task: {5D1FF4F8-1C34-4DA9-9E32-4A842C2C4F4A} - System32\Tasks\MSIAfterburner => C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe [2013-01-23] ()
Task: {8C9467D8-2271-466B-8874-51B4DDA76F29} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {A1E29D82-9CB9-4A34-A4F1-DC80B70FAFB8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {B4D70004-CEA2-4D20-BF2E-C595D989E33E} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Task: {B859BC22-EDAF-42AC-9D6C-D21C89B622CD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {C74E41DC-8BB7-4D28-A603-23FD324EDB60} - System32\Tasks\{8988545C-562D-413A-BC86-6818C950A893} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/en/abandoninstall?page=tsBing
Task: {DE144AFD-ABFC-4428-8ED3-E5261FA200A4} - System32\Tasks\Google Updater and Installer => C:\Users\alex\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2012-11-04 15:25 - 2012-11-04 15:25 - 00736968 _____ () C:\Program Files\Rainmeter\Rainmeter.dll
2012-11-04 15:24 - 2012-11-04 15:24 - 00499712 _____ () C:\Program Files\Rainmeter\Plugins\NowPlaying.dll
2012-11-04 15:23 - 2012-11-04 15:23 - 00011776 _____ () C:\Program Files\Rainmeter\Plugins\RecycleManager.dll
2012-11-04 15:23 - 2012-11-04 15:23 - 00011776 _____ () C:\Program Files\Rainmeter\Plugins\PowerPlugin.dll
2012-11-04 15:23 - 2012-11-04 15:23 - 00056832 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.dll
2013-01-16 17:01 - 2013-01-16 17:01 - 00069632 _____ () C:\Program Files (x86)\MSI Afterburner\RTMUI.dll
2013-01-16 17:00 - 2013-01-16 17:00 - 00061440 _____ () C:\Program Files (x86)\MSI Afterburner\RTFC.dll
2013-01-16 17:01 - 2013-01-16 17:01 - 00229376 _____ () C:\Program Files (x86)\MSI Afterburner\RTCore.dll
2013-01-16 17:00 - 2013-01-16 17:00 - 00143360 _____ () C:\Program Files (x86)\MSI Afterburner\RTUI.dll
2013-01-16 17:01 - 2013-01-16 17:01 - 00348160 _____ () C:\Program Files (x86)\MSI Afterburner\RTHAL.dll
2011-04-30 20:04 - 2011-04-30 20:04 - 00013312 _____ () C:\Program Files (x86)\MSI Afterburner\RTTSH.dll
2013-12-20 12:27 - 2013-12-20 12:27 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-12-11 12:31 - 2013-12-11 12:31 - 16242056 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
2013-03-12 17:10 - 2013-11-06 22:48 - 00691200 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2013-01-01 20:33 - 2013-12-11 20:40 - 01135016 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-01-01 20:33 - 2013-11-06 22:48 - 20625832 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2013-01-01 20:33 - 2013-06-15 00:49 - 01100800 _____ () C:\Program Files (x86)\Steam\bin\avcodec-53.dll
2013-01-01 20:33 - 2013-06-15 00:49 - 00124416 _____ () C:\Program Files (x86)\Steam\bin\avutil-51.dll
2013-01-01 20:33 - 2013-06-15 00:49 - 00192000 _____ () C:\Program Files (x86)\Steam\bin\avformat-53.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/25/2013 04:20:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskmgr.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79737
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x12f8
Startzeit der fehlerhaften Anwendung: 0xtaskmgr.exe0
Pfad der fehlerhaften Anwendung: taskmgr.exe1
Pfad des fehlerhaften Moduls: taskmgr.exe2
Berichtskennung: taskmgr.exe3
Error: (12/25/2013 04:20:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.3182, Zeitstempel: 0x5280e916
Name des fehlerhaften Moduls: NvBackendAPI64.DLL, Version: 10.10.5.1, Zeitstempel: 0x5298c667
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000007f5ef
ID des fehlerhaften Prozesses: 0x1080
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3
Error: (12/25/2013 04:20:52 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskmgr.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79737
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x11ec
Startzeit der fehlerhaften Anwendung: 0xtaskmgr.exe0
Pfad der fehlerhaften Anwendung: taskmgr.exe1
Pfad des fehlerhaften Moduls: taskmgr.exe2
Berichtskennung: taskmgr.exe3
Error: (12/25/2013 04:19:52 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x880
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (12/25/2013 04:18:36 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: rundll32.exe_Shell32.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc9e0
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0xbdc
Startzeit der fehlerhaften Anwendung: 0xrundll32.exe_Shell32.dll0
Pfad der fehlerhaften Anwendung: rundll32.exe_Shell32.dll1
Pfad des fehlerhaften Moduls: rundll32.exe_Shell32.dll2
Berichtskennung: rundll32.exe_Shell32.dll3
Error: (12/23/2013 09:06:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018dc7c
ID des fehlerhaften Prozesses: 0x1ff4
Startzeit der fehlerhaften Anwendung: 0xOblivion.exe0
Pfad der fehlerhaften Anwendung: Oblivion.exe1
Pfad des fehlerhaften Moduls: Oblivion.exe2
Berichtskennung: Oblivion.exe3
Error: (12/23/2013 09:05:24 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018dc7c
ID des fehlerhaften Prozesses: 0x1ae4
Startzeit der fehlerhaften Anwendung: 0xOblivion.exe0
Pfad der fehlerhaften Anwendung: Oblivion.exe1
Pfad des fehlerhaften Moduls: Oblivion.exe2
Berichtskennung: Oblivion.exe3
Error: (12/23/2013 09:03:59 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018dc7c
ID des fehlerhaften Prozesses: 0x1eec
Startzeit der fehlerhaften Anwendung: 0xOblivion.exe0
Pfad der fehlerhaften Anwendung: Oblivion.exe1
Pfad des fehlerhaften Moduls: Oblivion.exe2
Berichtskennung: Oblivion.exe3
Error: (12/23/2013 07:09:18 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018dc7c
ID des fehlerhaften Prozesses: 0x10bc
Startzeit der fehlerhaften Anwendung: 0xOblivion.exe0
Pfad der fehlerhaften Anwendung: Oblivion.exe1
Pfad des fehlerhaften Moduls: Oblivion.exe2
Berichtskennung: Oblivion.exe3
Error: (12/23/2013 06:34:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018dc7c
ID des fehlerhaften Prozesses: 0x1340
Startzeit der fehlerhaften Anwendung: 0xOblivion.exe0
Pfad der fehlerhaften Anwendung: Oblivion.exe1
Pfad des fehlerhaften Moduls: Oblivion.exe2
Berichtskennung: Oblivion.exe3
System errors:
=============
Error: (12/25/2013 04:21:39 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (12/25/2013 04:21:33 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (BA870010B5DF0E0080) zurückgegeben.
Error: (12/25/2013 04:21:33 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (BA870010B5DF0E0040) zurückgegeben.
Error: (12/25/2013 04:21:32 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (FFFFFFFFFFFFFFFF00) zurückgegeben.
Error: (12/25/2013 04:21:32 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (UBA870010B5DF0E0000) zurückgegeben.
Error: (12/25/2013 04:18:37 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a45\??\C:\System Volume Information\Syscache.hve
Error: (12/25/2013 04:18:26 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (BA870010B5DF0E0080) zurückgegeben.
Error: (12/25/2013 04:18:26 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (BA870010B5DF0E0040) zurückgegeben.
Error: (12/25/2013 04:18:25 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (FFFFFFFFFFFFFFFF00) zurückgegeben.
Error: (12/25/2013 04:18:25 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (UBA870010B5DF0E0000) zurückgegeben.
Microsoft Office Sessions:
=========================
Error: (12/25/2013 04:20:57 PM) (Source: Application Error)(User: )
Description: taskmgr.exe6.1.7601.175144ce79737unknown0.0.0.000000000c0000005000000000000000012f801cf0184e8e7615cC:\Windows\system32\taskmgr.exeunknown26ad021f-6d78-11e3-bad6-e0cb4e8b8e4b
Error: (12/25/2013 04:20:55 PM) (Source: Application Error)(User: )
Description: nvtray.exe7.17.13.31825280e916NvBackendAPI64.DLL10.10.5.15298c667c0000005000000000007f5ef108001cf0184d4f5c848C:\Program Files\NVIDIA Corporation\Display\nvtray.exeC:\Program Files\NVIDIA Corporation\Update Core\NvBackendAPI64.DLL25974c45-6d78-11e3-bad6-e0cb4e8b8e4b
Error: (12/25/2013 04:20:52 PM) (Source: Application Error)(User: )
Description: taskmgr.exe6.1.7601.175144ce79737unknown0.0.0.000000000c0000005000000000000000011ec01cf0184e5b274d1C:\Windows\system32\taskmgr.exeunknown2382c3f4-6d78-11e3-bad6-e0cb4e8b8e4b
Error: (12/25/2013 04:19:52 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4unknown0.0.0.000000000c0000005000000000000000088001cf0184c21d1186C:\Windows\Explorer.EXEunknownffeaefaa-6d77-11e3-bad6-e0cb4e8b8e4b
Error: (12/25/2013 04:18:36 PM) (Source: Application Error)(User: )
Description: rundll32.exe_Shell32.dll6.1.7600.163854a5bc9e0unknown0.0.0.000000000c00000050000000000000000bdc01cf018494989516C:\Windows\system32\rundll32.exeunknownd285e21c-6d77-11e3-bad6-e0cb4e8b8e4b
Error: (12/23/2013 09:06:57 PM) (Source: Application Error)(User: )
Description: Oblivion.exe1.2.0.416462392c7Oblivion.exe1.2.0.416462392c7c00000050018dc7c1ff401cf001a874490cbC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exeC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exec612cc31-6c0d-11e3-bcde-e0cb4e8b8e4b
Error: (12/23/2013 09:05:24 PM) (Source: Application Error)(User: )
Description: Oblivion.exe1.2.0.416462392c7Oblivion.exe1.2.0.416462392c7c00000050018dc7c1ae401cf001a4fba602bC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exeC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exe8e85dc67-6c0d-11e3-bcde-e0cb4e8b8e4b
Error: (12/23/2013 09:03:59 PM) (Source: Application Error)(User: )
Description: Oblivion.exe1.2.0.416462392c7Oblivion.exe1.2.0.416462392c7c00000050018dc7c1eec01cf001a1bf61f4fC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exeC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exe5bdad7da-6c0d-11e3-bcde-e0cb4e8b8e4b
Error: (12/23/2013 07:09:18 PM) (Source: Application Error)(User: )
Description: Oblivion.exe1.2.0.416462392c7Oblivion.exe1.2.0.416462392c7c00000050018dc7c10bc01cf000a175ac226C:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exeC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exe567570fc-6bfd-11e3-bcde-e0cb4e8b8e4b
Error: (12/23/2013 06:34:55 PM) (Source: Application Error)(User: )
Description: Oblivion.exe1.2.0.416462392c7Oblivion.exe1.2.0.416462392c7c00000050018dc7c134001cf00054a26406bC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exeC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exe88ec3e53-6bf8-11e3-bcde-e0cb4e8b8e4b
CodeIntegrity Errors:
===================================
Date: 2013-12-25 18:16:20.231
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:16:20.230
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:16:20.229
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:11:34.463
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:11:34.462
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:11:34.461
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 40%
Total physical RAM: 8116.18 MB
Available physical RAM: 4868.82 MB
Total Pagefile: 16230.55 MB
Available Pagefile: 12603.54 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.69 GB) (Free:25.74 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 983FA1FB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Und das GMER-logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-25 18:47:27
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP5T0L0-5 Corsair_Force_GT rev.1.3.3 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\alex\AppData\Local\Temp\kxldrpog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800037f8000 8 bytes [00, 00, 43, 00, 46, 4D, 69, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800037f8010 29 bytes [A0, A1, BE, 0A, 80, FA, FF, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072c81a22 2 bytes [C8, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072c81ad0 2 bytes [C8, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072c81b08 2 bytes [C8, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072c81bba 2 bytes [C8, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072c81bda 2 bytes [C8, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076381465 2 bytes [38, 76]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763814bb 2 bytes [38, 76]
.text ... * 2
.text C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe[3960] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076381465 2 bytes [38, 76]
.text C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe[3960] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763814bb 2 bytes [38, 76]
.text ... * 2
.text C:\Program Files (x86)\Skype\Phone\Skype.exe[2488] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076381465 2 bytes [38, 76]
.text C:\Program Files (x86)\Skype\Phone\Skype.exe[2488] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763814bb 2 bytes [38, 76]
.text ... * 2
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate 0000000074f6549c 5 bytes JMP 0000000100080800
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076381465 2 bytes [38, 76]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000763814bb 2 bytes [38, 76]
.text ... * 2
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!av_packet_split_side_data + 972 000000005bf32a9c 4 bytes [20, 8D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!av_packet_split_side_data + 987 000000005bf32aab 4 bytes [20, 8D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!init_vlc_sparse + 289 000000005bf33151 4 bytes [20, 8D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!init_vlc_sparse + 299 000000005bf3315b 4 bytes [20, 8D, B3, 70]
.text ... * 7
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_get_chroma_sub_sample + 13 000000005bf7fced 4 bytes [40, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!ff_is_hwaccel_pix_fmt + 10 000000005bf7fd2a 4 bytes [47, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avpicture_layout + 85 000000005bf7fef5 4 bytes [44, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avpicture_layout + 115 000000005bf7ff13 4 bytes [48, 9D, B3, 70]
.text ... * 3
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_get_pix_fmt_loss + 108 000000005bf800ac 4 bytes [40, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_get_pix_fmt_loss + 114 000000005bf800b2 4 bytes [40, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_find_best_pix_fmt + 90 000000005bf8025a 4 bytes [44, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_find_best_pix_fmt + 107 000000005bf8026b 4 bytes [46, 9D, B3, 70]
.text ... * 2
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!av_picture_crop + 51 000000005bf80823 4 bytes [40, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!av_picture_pad + 750 000000005bf80bfe 4 bytes [40, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_pix_fmt_to_codec_tag + 497 000000005bf87121 4 bytes [47, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_align_dimensions + 30 000000005bf8aabe 4 bytes [45, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_default_get_buffer + 796 000000005bf8ce5c 4 bytes [48, 9D, B3, 70]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5768] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate 0000000074f6549c 5 bytes JMP 00000001001c0800
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5768] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076381465 2 bytes [38, 76]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5768] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000763814bb 2 bytes [38, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [2420:3512] 000007fef4b49688
---- EOF - GMER 2.1 ----
Geändert von Lyzzi (25.12.2013 um 18:51 Uhr) |
|
25.12.2013, 23:37
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | HiddenObject.Multi.Generic und PC verhält sich merkwürdig Hallo und
__________________ Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ |
|
26.12.2013, 00:53
| #3 |
| | HiddenObject.Multi.Generic und PC verhält sich merkwürdig Hier der MBAR-Log:
__________________Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1008
www.malwarebytes.org
Database version: v2013.12.25.05
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16750
alex :: ALEX-PC [administrator]
26.12.2013 00:43:31
mbar-log-2013-12-26 (00-43-31).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 234090
Time elapsed: 6 minute(s), 22 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
26.12.2013, 01:01
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | HiddenObject.Multi.Generic und PC verhält sich merkwürdig Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
26.12.2013, 02:11
| #5 |
| | HiddenObject.Multi.Generic und PC verhält sich merkwürdig Ok hier die logs. adwCleaner-Log: Code:
ATTFilter # AdwCleaner v3.016 - Bericht erstellt am 26/12/2013 um 01:55:23
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : alex - ALEX-PC
# Gestartet von : C:\Users\alex\Desktop\AntiV\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16750
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [2657 octets] - [09/09/2013 05:14:46]
AdwCleaner[R1].txt - [1234 octets] - [21/10/2013 22:53:13]
AdwCleaner[R2].txt - [1151 octets] - [03/12/2013 23:24:55]
AdwCleaner[R3].txt - [1271 octets] - [03/12/2013 23:28:23]
AdwCleaner[R4].txt - [1399 octets] - [26/12/2013 01:53:52]
AdwCleaner[S0].txt - [2718 octets] - [09/09/2013 05:16:11]
AdwCleaner[S1].txt - [1295 octets] - [21/10/2013 22:54:06]
AdwCleaner[S2].txt - [1213 octets] - [03/12/2013 23:25:35]
AdwCleaner[S3].txt - [1333 octets] - [03/12/2013 23:28:40]
AdwCleaner[S4].txt - [1320 octets] - [26/12/2013 01:55:23]
########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1380 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by alex on 26.12.2013 at 1:58:29,26
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\alex\AppData\Roaming\mozilla\firefox\profiles\l3fiemti.default\minidumps [1 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.12.2013 at 2:02:49,67
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST-Log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-12-2013
Ran by alex (administrator) on ALEX-PC on 26-12-2013 02:03:31
Running from C:\Users\alex\Desktop\AntiV
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Intel(R) Corporation) C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12681320 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2273056 2013-11-29] (NVIDIA Corporation)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.140.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @t.garena.com/garenatalk - C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Flashblock - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
FF Extension: WOT - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: NoScript - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: CookieCuller - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{99B98C2C-7274-45a3-A640-D9DF1A1C8460}.xpi
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
Chrome:
=======
CHR DefaultSearchProvider: Delta Search
CHR Plugin: (Shockwave Flash) - C:\Users\alex\AppData\Local\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\alex\AppData\Local\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\alex\AppData\Local\Google\Chrome\Application\27.0.1453.94\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Google Update) - C:\Users\alex\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Raidcall plugin) - C:\Users\alex\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Docs) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Safe Money) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Gmail) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Anti-Banner) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\alex\AppData\LocalLow\proxtube\CHROME\proxtube.crx
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1370912 2013-11-29] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15128352 2013-11-29] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-11-09] ()
R2 XTU3SERVICE; C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe [15888 2013-02-11] (Intel(R) Corporation)
==================== Drivers (Whitelisted) ====================
R3 AcpiCtlDrv; C:\Windows\System32\DRIVERS\AcpiCtlDrv.sys [25880 2012-07-17] (Intel Corporation)
S3 bulkadi; C:\Windows\System32\DRIVERS\bulkrazer_x64.sys [25088 2011-02-09] (Windows (R) Codename Longhorn DDK provider)
S3 EfiVariable; C:\Windows\SysWOW64\Drivers\variable64.sys [18200 2010-10-28] (Windows (R) Server 2003 DDK provider)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO64A.SYS [29672 2013-01-19] (REALiX(tm))
R2 iocbios2; C:\Program Files (x86)\Intel\Extreme Tuning Utility\Drivers\IocDriver\64bit\iocbios2.sys [25448 2013-01-07] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-12-11] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [626272 2013-10-10] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-12-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-24] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-07-24] (Kaspersky Lab ZAO)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-10-30] (NVIDIA Corporation)
R3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13368 2013-01-23] ()
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [22016 2012-09-18] (Razer USA Ltd)
S3 ALSysIO; \??\C:\Users\alex\AppData\Local\Temp\ALSysIO64.sys [x]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Plus\Room\safedrv.sys [x]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-07-24] (Kaspersky Lab ZAO)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-26 02:02 - 2013-12-26 02:02 - 00000754 _____ C:\Users\alex\Desktop\JRT.txt
2013-12-26 01:58 - 2013-12-26 01:58 - 01034531 _____ (Thisisu) C:\Users\alex\Downloads\JRT(1).exe
2013-12-26 01:57 - 2013-12-26 01:58 - 01034531 _____ (Thisisu) C:\Users\alex\Downloads\JRT.exe
2013-12-26 01:01 - 2013-12-26 01:01 - 00000000 ____D C:\Users\alex\Downloads\realbarbielifts - Imgur
2013-12-26 00:43 - 2013-12-26 00:43 - 00117464 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-26 00:39 - 2013-12-26 02:03 - 00000000 ____D C:\Users\alex\Desktop\AntiV
2013-12-25 19:01 - 2013-12-25 19:01 - 03707815 _____ C:\Users\alex\Downloads\mets fan - Imgur.zip
2013-12-25 18:47 - 2013-12-25 18:47 - 00008224 _____ C:\Users\alex\Desktop\GMERLog.log
2013-12-25 18:42 - 2013-12-25 18:42 - 00001009 _____ C:\Users\alex\Desktop\GMER.txt
2013-12-25 18:41 - 2013-12-25 18:41 - 00027517 _____ C:\Users\alex\Downloads\Addition.txt
2013-12-25 18:39 - 2013-12-25 18:41 - 00040503 _____ C:\Users\alex\Downloads\FRST.txt
2013-12-25 18:39 - 2013-12-25 18:39 - 00000470 _____ C:\Users\alex\Downloads\defogger_disable.log
2013-12-25 18:38 - 2013-12-25 18:38 - 00377856 _____ C:\Users\alex\Downloads\gmer_2.1.19163.exe
2013-12-25 18:38 - 2013-12-25 18:38 - 00050477 _____ C:\Users\alex\Downloads\Defogger.exe
2013-12-23 22:20 - 2013-12-23 22:20 - 00000088 _____ C:\Windows\TweakOblivion.ini
2013-12-23 00:36 - 2013-12-24 01:19 - 00000023 _____ C:\Windows\BlendSettings.ini
2013-12-23 00:35 - 2013-12-23 22:20 - 00000000 ____D C:\Users\alex\AppData\Local\Oblivion
2013-12-22 11:41 - 2013-12-22 11:41 - 00000000 ____D C:\Users\alex\Desktop\file_61324072787_3470_0
2013-12-20 12:27 - 2013-12-20 12:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 00:36 - 2013-12-19 00:36 - 01958098 _____ C:\Users\alex\Downloads\2560x1080 NSFW - Imgur.zip
2013-12-18 09:27 - 2013-12-18 09:33 - 19545912 _____ C:\Users\alex\Downloads\MSIAfterburnerSetup300Beta15.zip
2013-12-16 13:34 - 2013-12-16 13:34 - 09819638 _____ C:\Users\alex\Downloads\Daniella Lanio - Imgur.zip
2013-12-16 13:31 - 2013-12-16 13:31 - 04640400 _____ C:\Users\alex\Downloads\ParisRoxanne - Imgur.zip
2013-12-15 00:30 - 2013-12-15 00:30 - 00000000 ____D C:\Users\alex\AppData\Local\Blizzard
2013-12-15 00:19 - 2013-12-15 01:32 - 00000000 ____D C:\Users\alex\AppData\Local\Battle.net
2013-12-15 00:19 - 2013-12-15 00:37 - 00000000 ____D C:\Users\alex\AppData\Roaming\Battle.net
2013-12-15 00:19 - 2013-12-15 00:19 - 00001150 _____ C:\Users\Public\Desktop\Battle.net.lnk
2013-12-15 00:19 - 2013-12-15 00:19 - 00000000 ____D C:\Program Files (x86)\Battle.net
2013-12-12 15:01 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 15:01 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 15:01 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 15:01 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-12 15:00 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-12 15:00 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-12 15:00 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-12 15:00 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-12 15:00 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-12 15:00 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-12 15:00 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-12 15:00 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-12 15:00 - 2013-10-25 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-12 15:00 - 2013-10-25 04:41 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-12 15:00 - 2013-10-25 04:17 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-12 15:00 - 2013-10-25 03:49 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-12 01:35 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 01:35 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 01:35 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-12 01:35 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-12 01:35 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 01:35 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 01:35 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 01:35 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 01:35 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 01:35 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 01:35 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 01:35 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-12 01:35 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 01:35 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-12 01:35 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 01:35 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-12 01:35 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-12 01:35 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-12 01:35 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-10 04:59 - 2013-12-10 04:59 - 05055530 _____ C:\Users\alex\Downloads\Non-Nude Sexy Wallpapers - Imgur.zip
2013-12-09 02:11 - 2013-12-09 02:12 - 36773854 _____ C:\Users\alex\Downloads\Randoms - Imgur.zip
2013-12-08 12:08 - 2013-12-08 12:08 - 02017033 _____ C:\Users\alex\Downloads\Emma Glover - Imgur.zip
2013-12-07 20:41 - 2013-12-07 20:41 - 08868299 _____ C:\Users\alex\Desktop\CBS.7z
2013-12-07 20:41 - 2013-12-07 20:41 - 00000000 ____D C:\Users\alex\Desktop\CBS
2013-12-07 02:13 - 2013-12-07 02:13 - 00000000 ____D C:\Users\alex\Downloads\The Ass Gallery - Imgur
2013-12-06 21:59 - 2013-12-06 21:59 - 00128916 _____ C:\Users\alex\Desktop\Fehler1&2.7z
2013-12-06 08:03 - 2013-12-23 23:53 - 00000000 ____D C:\Users\alex\AppData\Roaming\Dropbox
2013-12-04 23:33 - 2013-12-04 23:33 - 00000000 ____D C:\Windows\CheckSur
2013-12-04 11:58 - 2013-12-04 11:58 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-12-04 11:47 - 2013-12-04 11:47 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ALEX-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2013-12-04 11:47 - 2013-12-04 11:47 - 00000000 ____D C:\RegBackup
2013-12-04 11:29 - 2013-12-04 14:23 - 00000134 _____ C:\Users\alex\Desktop\Internet Explorer-Problembehebung.url
2013-12-03 22:44 - 2013-12-26 00:39 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-03 22:44 - 2013-12-03 22:56 - 00000000 ____D C:\Users\alex\Desktop\mbar
2013-12-03 15:54 - 2013-12-04 19:06 - 00000000 ____D C:\Users\alex\Desktop\FRST
2013-12-03 06:40 - 2013-10-30 18:03 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-03 06:40 - 2013-10-30 18:02 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-03 01:28 - 2013-12-03 01:28 - 12999313 _____ C:\Users\alex\Downloads\Casey Connelly - Imgur.zip
2013-12-02 07:19 - 2013-12-02 07:19 - 16422740 _____ C:\Users\alex\Downloads\realbarbielifts - Imgur(1).zip
2013-12-02 06:29 - 2013-12-02 06:29 - 02520182 _____ C:\Users\alex\Downloads\Album 4HhzQ - Imgur.zip
2013-12-02 03:42 - 2013-12-02 03:42 - 01371376 _____ C:\Users\alex\Downloads\faucheer - Imgur.zip
2013-12-01 21:38 - 2013-12-01 21:38 - 00000000 ____D C:\Users\alex\AppData\Local\Ascaron Entertainment
2013-11-29 00:55 - 2013-11-29 00:55 - 01327845 _____ C:\Users\alex\Downloads\body so tight - Imgur.zip
2013-11-28 17:03 - 2013-11-28 17:04 - 242396304 _____ C:\Users\alex\Desktop\Jon Bellion - Jim Morrison.avi
2013-11-26 02:52 - 2013-12-25 19:22 - 00411520 _____ C:\Windows\IE11_main.log
==================== One Month Modified Files and Folders =======
2013-12-26 02:03 - 2013-12-26 00:39 - 00000000 ____D C:\Users\alex\Desktop\AntiV
2013-12-26 02:02 - 2013-12-26 02:02 - 00000754 _____ C:\Users\alex\Desktop\JRT.txt
2013-12-26 02:01 - 2009-07-14 05:45 - 00021856 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-26 02:01 - 2009-07-14 05:45 - 00021856 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-26 02:00 - 2011-04-12 08:43 - 00685600 _____ C:\Windows\system32\perfh007.dat
2013-12-26 02:00 - 2011-04-12 08:43 - 00145432 _____ C:\Windows\system32\perfc007.dat
2013-12-26 02:00 - 2009-07-14 06:13 - 01620812 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-26 01:59 - 2012-05-18 20:22 - 01342648 _____ C:\Windows\WindowsUpdate.log
2013-12-26 01:58 - 2013-12-26 01:58 - 01034531 _____ (Thisisu) C:\Users\alex\Downloads\JRT(1).exe
2013-12-26 01:58 - 2013-12-26 01:57 - 01034531 _____ (Thisisu) C:\Users\alex\Downloads\JRT.exe
2013-12-26 01:57 - 2012-08-29 14:13 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-12-26 01:56 - 2013-09-09 05:17 - 00030582 _____ C:\Windows\setupact.log
2013-12-26 01:56 - 2013-04-16 08:32 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-26 01:56 - 2012-06-02 02:35 - 00000000 ____D C:\Users\alex\AppData\Roaming\Skype
2013-12-26 01:56 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-26 01:55 - 2013-09-10 18:34 - 00188270 _____ C:\Windows\PFRO.log
2013-12-26 01:55 - 2013-09-09 05:14 - 00000000 ____D C:\AdwCleaner
2013-12-26 01:31 - 2012-10-22 13:58 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-26 01:01 - 2013-12-26 01:01 - 00000000 ____D C:\Users\alex\Downloads\realbarbielifts - Imgur
2013-12-26 00:50 - 2013-06-19 15:45 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-26 00:43 - 2013-12-26 00:43 - 00117464 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-26 00:39 - 2013-12-03 22:44 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-25 23:53 - 2012-05-18 20:36 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-25 19:22 - 2013-11-26 02:52 - 00411520 _____ C:\Windows\IE11_main.log
2013-12-25 19:01 - 2013-12-25 19:01 - 03707815 _____ C:\Users\alex\Downloads\mets fan - Imgur.zip
2013-12-25 18:47 - 2013-12-25 18:47 - 00008224 _____ C:\Users\alex\Desktop\GMERLog.log
2013-12-25 18:42 - 2013-12-25 18:42 - 00001009 _____ C:\Users\alex\Desktop\GMER.txt
2013-12-25 18:41 - 2013-12-25 18:41 - 00027517 _____ C:\Users\alex\Downloads\Addition.txt
2013-12-25 18:41 - 2013-12-25 18:39 - 00040503 _____ C:\Users\alex\Downloads\FRST.txt
2013-12-25 18:39 - 2013-12-25 18:39 - 00000470 _____ C:\Users\alex\Downloads\defogger_disable.log
2013-12-25 18:38 - 2013-12-25 18:38 - 00377856 _____ C:\Users\alex\Downloads\gmer_2.1.19163.exe
2013-12-25 18:38 - 2013-12-25 18:38 - 00050477 _____ C:\Users\alex\Downloads\Defogger.exe
2013-12-25 18:31 - 2012-11-25 18:01 - 00000000 ____D C:\Program Files (x86)\HP
2013-12-25 18:30 - 2013-07-24 06:51 - 00000000 ____D C:\Program Files (x86)\Diablo II
2013-12-25 16:21 - 2013-10-17 23:25 - 00003018 _____ C:\Windows\System32\Tasks\MSIAfterburner
2013-12-25 16:18 - 2013-04-21 10:38 - 00369664 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-24 01:19 - 2013-12-23 00:36 - 00000023 _____ C:\Windows\BlendSettings.ini
2013-12-24 01:19 - 2012-05-23 15:32 - 00000000 ____D C:\Users\alex\Documents\my games
2013-12-24 01:02 - 2012-09-15 11:13 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-24 00:53 - 2012-12-30 08:15 - 00000000 ____D C:\Program Files (x86)\MSI Afterburner
2013-12-23 23:53 - 2013-12-06 08:03 - 00000000 ____D C:\Users\alex\AppData\Roaming\Dropbox
2013-12-23 22:20 - 2013-12-23 22:20 - 00000088 _____ C:\Windows\TweakOblivion.ini
2013-12-23 22:20 - 2013-12-23 00:35 - 00000000 ____D C:\Users\alex\AppData\Local\Oblivion
2013-12-23 22:20 - 2012-05-18 20:22 - 00000000 ____D C:\Users\alex
2013-12-23 02:06 - 2012-05-23 15:47 - 00000000 ____D C:\Users\alex\Documents\Nexus Mod Manager
2013-12-23 00:35 - 2013-09-09 12:15 - 00252330 _____ C:\Windows\DirectX.log
2013-12-23 00:35 - 2012-07-09 19:14 - 00000000 ____D C:\Users\alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-12-22 20:51 - 2013-09-24 22:55 - 00000000 ____D C:\Users\alex\Desktop\Unending wisdom of 氷の竜
2013-12-22 11:41 - 2013-12-22 11:41 - 00000000 ____D C:\Users\alex\Desktop\file_61324072787_3470_0
2013-12-21 14:57 - 2013-09-11 14:53 - 00000000 ____D C:\Program Files (x86)\Warcraft III
2013-12-21 04:51 - 2012-05-20 01:01 - 00000000 ____D C:\Users\alex\AppData\Roaming\TS3Client
2013-12-20 22:24 - 2012-05-20 01:01 - 00000000 ____D C:\Users\alex\AppData\Local\TeamSpeak 3 Client
2013-12-20 12:27 - 2013-12-20 12:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 00:36 - 2013-12-19 00:36 - 01958098 _____ C:\Users\alex\Downloads\2560x1080 NSFW - Imgur.zip
2013-12-18 09:33 - 2013-12-18 09:27 - 19545912 _____ C:\Users\alex\Downloads\MSIAfterburnerSetup300Beta15.zip
2013-12-17 22:37 - 2013-10-22 22:26 - 00001268 _____ C:\Users\alex\Desktop\rift shit.txt
2013-12-16 13:34 - 2013-12-16 13:34 - 09819638 _____ C:\Users\alex\Downloads\Daniella Lanio - Imgur.zip
2013-12-16 13:31 - 2013-12-16 13:31 - 04640400 _____ C:\Users\alex\Downloads\ParisRoxanne - Imgur.zip
2013-12-15 19:35 - 2012-06-23 20:35 - 00000000 ____D C:\Users\alex\AppData\Roaming\Mumble
2013-12-15 01:32 - 2013-12-15 00:19 - 00000000 ____D C:\Users\alex\AppData\Local\Battle.net
2013-12-15 00:37 - 2013-12-15 00:19 - 00000000 ____D C:\Users\alex\AppData\Roaming\Battle.net
2013-12-15 00:30 - 2013-12-15 00:30 - 00000000 ____D C:\Users\alex\AppData\Local\Blizzard
2013-12-15 00:19 - 2013-12-15 00:19 - 00001150 _____ C:\Users\Public\Desktop\Battle.net.lnk
2013-12-15 00:19 - 2013-12-15 00:19 - 00000000 ____D C:\Program Files (x86)\Battle.net
2013-12-13 18:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-13 05:06 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-11 12:31 - 2012-10-22 13:58 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-11 12:31 - 2012-05-18 23:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 12:31 - 2012-05-18 23:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 08:18 - 2012-08-02 14:09 - 00029792 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klim6.sys
2013-12-11 08:18 - 2012-06-19 16:28 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2013-12-10 04:59 - 2013-12-10 04:59 - 05055530 _____ C:\Users\alex\Downloads\Non-Nude Sexy Wallpapers - Imgur.zip
2013-12-09 02:12 - 2013-12-09 02:11 - 36773854 _____ C:\Users\alex\Downloads\Randoms - Imgur.zip
2013-12-09 01:25 - 2013-08-08 16:40 - 00001961 _____ C:\Users\alex\Desktop\tatoos.txt
2013-12-08 12:08 - 2013-12-08 12:08 - 02017033 _____ C:\Users\alex\Downloads\Emma Glover - Imgur.zip
2013-12-07 20:41 - 2013-12-07 20:41 - 08868299 _____ C:\Users\alex\Desktop\CBS.7z
2013-12-07 20:41 - 2013-12-07 20:41 - 00000000 ____D C:\Users\alex\Desktop\CBS
2013-12-07 15:50 - 2013-08-18 00:18 - 00000000 ____D C:\Windows\pss
2013-12-07 15:50 - 2012-05-18 20:23 - 00000000 ___RD C:\Users\alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-07 15:46 - 2012-06-02 02:35 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-07 15:46 - 2012-06-02 02:35 - 00000000 ____D C:\ProgramData\Skype
2013-12-07 02:13 - 2013-12-07 02:13 - 00000000 ____D C:\Users\alex\Downloads\The Ass Gallery - Imgur
2013-12-06 21:59 - 2013-12-06 21:59 - 00128916 _____ C:\Users\alex\Desktop\Fehler1&2.7z
2013-12-04 23:33 - 2013-12-04 23:33 - 00000000 ____D C:\Windows\CheckSur
2013-12-04 19:06 - 2013-12-03 15:54 - 00000000 ____D C:\Users\alex\Desktop\FRST
2013-12-04 14:23 - 2013-12-04 11:29 - 00000134 _____ C:\Users\alex\Desktop\Internet Explorer-Problembehebung.url
2013-12-04 12:01 - 2013-04-20 11:20 - 00087488 _____ C:\Users\alex\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-04 12:00 - 2013-06-26 10:52 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-12-04 11:58 - 2013-12-04 11:58 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-12-04 11:57 - 2009-07-14 03:34 - 00000439 _____ C:\Windows\win.ini
2013-12-04 11:47 - 2013-12-04 11:47 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ALEX-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2013-12-04 11:47 - 2013-12-04 11:47 - 00000000 ____D C:\RegBackup
2013-12-04 11:34 - 2012-09-02 20:40 - 01594156 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-12-03 22:56 - 2013-12-03 22:44 - 00000000 ____D C:\Users\alex\Desktop\mbar
2013-12-03 06:41 - 2013-05-20 14:12 - 00000000 ____D C:\Users\alex\AppData\Local\NVIDIA
2013-12-03 06:41 - 2012-06-03 00:18 - 00000000 ____D C:\Users\alex\AppData\Local\NVIDIA Corporation
2013-12-03 06:40 - 2013-04-16 08:28 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-03 06:40 - 2013-04-15 20:37 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-03 06:40 - 2012-05-18 20:48 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-03 01:28 - 2013-12-03 01:28 - 12999313 _____ C:\Users\alex\Downloads\Casey Connelly - Imgur.zip
2013-12-02 07:19 - 2013-12-02 07:19 - 16422740 _____ C:\Users\alex\Downloads\realbarbielifts - Imgur(1).zip
2013-12-02 06:29 - 2013-12-02 06:29 - 02520182 _____ C:\Users\alex\Downloads\Album 4HhzQ - Imgur.zip
2013-12-02 03:42 - 2013-12-02 03:42 - 01371376 _____ C:\Users\alex\Downloads\faucheer - Imgur.zip
2013-12-01 21:38 - 2013-12-01 21:38 - 00000000 ____D C:\Users\alex\AppData\Local\Ascaron Entertainment
2013-11-29 17:56 - 2013-11-05 23:43 - 01096480 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2013-11-29 17:56 - 2013-11-05 23:43 - 00979744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2013-11-29 00:55 - 2013-11-29 00:55 - 01327845 _____ C:\Users\alex\Downloads\body so tight - Imgur.zip
2013-11-28 17:05 - 2012-06-11 04:19 - 00000000 ____D C:\Users\alex\AppData\Roaming\DVDVideoSoft
2013-11-28 17:04 - 2013-11-28 17:03 - 242396304 _____ C:\Users\alex\Desktop\Jon Bellion - Jim Morrison.avi
Some content of TEMP:
====================
C:\Users\alex\AppData\Local\Temp\Plugins Vista.exe
C:\Users\alex\AppData\Local\Temp\Plugins XP.exe
C:\Users\alex\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-21 11:27
==================== End Of Log ============================
Addition-Log: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-12-2013
Ran by alex at 2013-12-26 02:04:31
Running from C:\Users\alex\Desktop\AntiV
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe AIR (x32 Version: 3.8.0.1430)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
AutoHotkey 1.1.13.01 (Version: 1.1.13.01)
Battle.net (x32)
Battlelog Web Plugins (x32 Version: 2.3.1)
CCleaner (Version: 4.02)
Core Temp 1.0 RC4 (Version: 1.0)
Counter-Strike: Global Offensive (x32)
CPUID CPU-Z 1.62
CrystalDiskInfo 5.6.2 (x32 Version: 5.6.2)
Day of Defeat: Source (x32)
Debugging Tools for Windows (x86) (x32 Version: 6.10.3.233)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Diablo II (x32)
Dota 2 (x32)
ESN Sonar (x32 Version: 0.70.4)
GCFScape 1.8.4
GeForce Experience NvStream Client Components (Version: 1.6.28)
Hero Editor V0.96 (x32)
Intel Extreme Tuning Utility (x32 Version: 4.0.6.102)
Intel(R) Desktop Utilities (x32 Version: 1.0.0)
Intel(R) Extreme Tuning Utility (x32 Version: 1.0.0)
Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0)
Intel(R) Integrator Assistant (x32 Version: 1.0.0)
Intel(R) Management Engine Components (x32 Version: 9.0.0.1287)
Intel(R) Network Connections 16.5.2.0 (Version: 16.5.2.0)
Intel® Watchdog Timer Driver (Intel® WDT) (x32)
Internet Explorer (Enable DEP)
Java 7 Update 45 (64-bit) (Version: 7.0.450)
Kaspersky Internet Security 2013 (x32 Version: 13.0.1.4190)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938)
Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (x32 Version: 3.5.30730.0)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.88.0)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server Compact 3.5 SP2 ENU (x32 Version: 3.5.8080.0)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (Version: 3.5.8080.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSI Afterburner 2.3.1 (x32 Version: 2.3.1)
MSI Kombustor 2.4.2 (x32)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (x32 Version: 4.20.9818.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
Mumble 1.2.4 (x32 Version: 1.2.4)
Nexus Mod Manager (Version: 0.45.7)
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82)
NVIDIA 3D Vision Treiber 331.82 (Version: 331.82)
NVIDIA GeForce Experience 1.8 (Version: 1.8)
NVIDIA Grafiktreiber 331.82 (Version: 331.82)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4)
NVIDIA Install Application (Version: 2.1002.142.992)
NVIDIA LED Visualizer 1.0 (Version: 1.0)
NVIDIA Network Service (Version: 1.0)
NVIDIA PhysX (x32 Version: 9.13.0725)
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725)
NVIDIA ShadowPlay 10.10.5 (Version: 10.10.5)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182)
NVIDIA Systemsteuerung 331.82 (Version: 331.82)
NVIDIA Update 10.10.5 (Version: 10.10.5)
NVIDIA Update Core (Version: 10.10.5)
NVIDIA Virtual Audio 1.2.12 (Version: 1.2.12)
Origin (x32 Version: 9.0.13.2142)
Pando Media Booster (x32 Version: 2.6.0.8)
Path of Exile (x32)
PunkBuster Services (x32 Version: 0.993)
Rainmeter (x32 Version: 2.4 r1678)
Razer Mamba (x32 Version: 2.01.05)
Razer Megalodon Firmware Updater (x32 Version: 2.12.02)
Razer Synapse 2.0 (x32 Version: 1.5.18)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6449)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.27.0)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32)
SHIELD Streaming (Version: 1.6.75)
Skype Click to Call (x32 Version: 5.10.9560)
Skype™ 6.11 (x32 Version: 6.11.102)
Steam (x32 Version: 1.0.0.0)
TeamSpeak 3 Client (HKCU Version: 3.0.13.1)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32)
Warcraft III (x32)
==================== Restore Points =========================
25-12-2013 00:04:24 Windows Update
25-12-2013 17:30:43 Removed I.R.I.S. OCR
25-12-2013 17:30:53 Removed HP Officejet 6600 Hilfe
25-12-2013 17:31:05 Removed HP Officejet 6600 - Grundlegende Software für das Gerät
25-12-2013 17:31:41 Removed Studie zur Verbesserung von HP Officejet 6600 Produkten
25-12-2013 17:31:52 Removed HP Update.
25-12-2013 18:22:04 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-12-04 11:57 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0FBDAA31-E66F-4320-B674-1ACAC1C4E177} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-05-11] (Adobe Systems Incorporated)
Task: {5083AA73-3729-411E-B68E-F1380F658960} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
Task: {5D1FF4F8-1C34-4DA9-9E32-4A842C2C4F4A} - System32\Tasks\MSIAfterburner => C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe [2013-01-23] ()
Task: {8C9467D8-2271-466B-8874-51B4DDA76F29} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {A1E29D82-9CB9-4A34-A4F1-DC80B70FAFB8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {B4D70004-CEA2-4D20-BF2E-C595D989E33E} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Task: {B859BC22-EDAF-42AC-9D6C-D21C89B622CD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {C74E41DC-8BB7-4D28-A603-23FD324EDB60} - System32\Tasks\{8988545C-562D-413A-BC86-6818C950A893} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/en/abandoninstall?page=tsBing
Task: {DE144AFD-ABFC-4428-8ED3-E5261FA200A4} - System32\Tasks\Google Updater and Installer => C:\Users\alex\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2012-11-04 15:25 - 2012-11-04 15:25 - 00736968 _____ () C:\Program Files\Rainmeter\Rainmeter.dll
2012-11-04 15:24 - 2012-11-04 15:24 - 00499712 _____ () C:\Program Files\Rainmeter\Plugins\NowPlaying.dll
2012-11-04 15:23 - 2012-11-04 15:23 - 00011776 _____ () C:\Program Files\Rainmeter\Plugins\RecycleManager.dll
2012-11-04 15:23 - 2012-11-04 15:23 - 00011776 _____ () C:\Program Files\Rainmeter\Plugins\PowerPlugin.dll
2012-11-04 15:23 - 2012-11-04 15:23 - 00056832 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.dll
2013-01-16 17:01 - 2013-01-16 17:01 - 00069632 _____ () C:\Program Files (x86)\MSI Afterburner\RTMUI.dll
2013-01-16 17:00 - 2013-01-16 17:00 - 00061440 _____ () C:\Program Files (x86)\MSI Afterburner\RTFC.dll
2013-01-16 17:01 - 2013-01-16 17:01 - 00229376 _____ () C:\Program Files (x86)\MSI Afterburner\RTCore.dll
2013-01-16 17:00 - 2013-01-16 17:00 - 00143360 _____ () C:\Program Files (x86)\MSI Afterburner\RTUI.dll
2013-01-16 17:01 - 2013-01-16 17:01 - 00348160 _____ () C:\Program Files (x86)\MSI Afterburner\RTHAL.dll
2011-04-30 20:04 - 2011-04-30 20:04 - 00013312 _____ () C:\Program Files (x86)\MSI Afterburner\RTTSH.dll
2012-08-17 20:38 - 2012-08-17 20:38 - 00479160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
2012-08-17 20:39 - 2013-07-24 07:45 - 01310136 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\kpcengine.2.2.dll
2013-12-20 12:27 - 2013-12-20 12:27 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-12-25 18:16:20.231
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:16:20.230
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:16:20.229
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:11:34.463
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:11:34.462
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:11:34.461
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 30%
Total physical RAM: 8116.18 MB
Available physical RAM: 5646.63 MB
Total Pagefile: 16230.55 MB
Available Pagefile: 13384.76 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.69 GB) (Free:22.39 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 983FA1FB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
==================== End Of Log ============================
 Komisch ist aber, das ich Kaspersky jedesmal (nutze es seit 2Jahren), jedes Jahr, also nach Ablauf der Lizenz, neu im Mediamarkt erworben habe, bzw direkt bei Kaspersky im shop gekauft. Glaube kaum das die Leute mir dort eine "illegale" version verkauft haben? |
|
26.12.2013, 17:45
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | HiddenObject.Multi.Generic und PC verhält sich merkwürdig Die Fehlermeldung ist erstmal irrelevant. Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM) Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ --> HiddenObject.Multi.Generic und PC verhält sich merkwürdig |
|
26.12.2013, 19:25
| #7 |
| | HiddenObject.Multi.Generic und PC verhält sich merkwürdig MBAR-Log: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.12.23.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16750 alex :: ALEX-PC [Administrator] 26.12.2013 19:22:08 mbam-log-2013-12-26 (19-22-08).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 214664 Laufzeit: 1 Minute(n), 29 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) ESET-Log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e525d1194a54a044a5942d2b70b13bf2
# engine=14155
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-25 09:40:13
# local_time=2013-06-25 11:40:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1286 16777214 100 98 3080 26966335 0 0
# compatibility_mode=5893 16776573 100 94 31913 123826263 0 0
# scanned=221113
# found=0
# cleaned=0
# scan_time=1286
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e525d1194a54a044a5942d2b70b13bf2
# engine=16409
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-26 06:16:55
# local_time=2013-12-26 07:16:55 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1286 16777214 100 99 20059 42851737 0 0
# compatibility_mode=5893 16776573 100 94 89672 139711665 0 0
# scanned=245148
# found=0
# cleaned=0
# scan_time=4966
Wann wird die Meldung relevant ? |
|
26.12.2013, 20:48
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | HiddenObject.Multi.Generic und PC verhält sich merkwürdig TFC - Temp File Cleaner Lade dir  TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.12.2013, 22:30
| #9 |
| | HiddenObject.Multi.Generic und PC verhält sich merkwürdig Hier noch der Log von TFC: Code:
ATTFilter Getting user folders.
Stopping running processes.
Emptying Temp folders.
User: alex
->Temp folder emptied: 75727370 bytes
->Temporary Internet Files folder emptied: 81154664 bytes
->Java cache emptied: 45946 bytes
->FireFox cache emptied: 11058663 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 59621 bytes
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 57472 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 7455778 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 4809894 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 65056941 bytes
Emptying RecycleBin. Do not interrupt.
RecycleBin emptied: 668377717 bytes
Process complete!
Total Files Cleaned = 872,00 mb
Das host file schau ich mir gleich an, sobald ich fertig mit dem Kommentar bin  CookieCuller hab ich in FireFox installiert, Version 1.4. Habe keine neuere gefunden. EDIT: Ich habe mir die hosts.zip runtergeladen, brauch ich sonst noch was von der Seite? |
|
26.12.2013, 22:34
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | HiddenObject.Multi.Generic und PC verhält sich merkwürdig Dann wären wir durch! Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden. Helfen kann dir dabei delfix: Die Reihenfolge ist hier entscheidend.
Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden. Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern. Microsoftupdate Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Start, Systemsteuerung, Windows-Update PDF-Reader aktualisieren Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast) Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers: Prüfen => Adobe - Flash Player Downloadlinks findest du hier => Browsers and Plugins - FilePony.de Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind. Java-Update Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.12.2013, 22:43
| #11 |
| | HiddenObject.Multi.Generic und PC verhält sich merkwürdig Das DelFix log noch Code:
ATTFilter # DelFix v10.6 - Datei am 26/12/2013 um 22:41:56 erstellt
# Aktualisiert am 11/11/2013 von Xplode
# Benutzer : alex - ALEX-PC
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
~ Aktiviere die Benutzerkontensteuerung ... OK
~ Entferne die Bereinigungsprogramme ...
Gelöscht : C:\JRT
Gelöscht : C:\Combofix
Gelöscht : C:\FRST
Gelöscht : C:\AdwCleaner
Gelöscht : C:\Users\alex\Desktop\mbar
Gelöscht : C:\AdwCleaner[S1].txt
Gelöscht : C:\AdwCleaner[S2].txt
Gelöscht : C:\ComboFix.txt
Gelöscht : C:\TDSSKiller.2.8.16.0_19.06.2013_16.57.56_log.txt
Gelöscht : C:\Users\alex\Desktop\JRT.txt
Gelöscht : C:\Users\alex\Downloads\Addition.txt
Gelöscht : C:\Users\alex\Downloads\Defogger.exe
Gelöscht : C:\Users\alex\Downloads\defogger_disable.log
Gelöscht : C:\Users\alex\Downloads\defogger_enable.log
Gelöscht : C:\Users\alex\Downloads\esetsmartinstaller_enu.exe
Gelöscht : C:\Users\alex\Downloads\FRST.txt
Gelöscht : C:\Users\alex\Downloads\JRT(1).exe
Gelöscht : C:\Users\alex\Downloads\JRT.exe
Gelöscht : C:\Users\alex\Downloads\TFC.exe
Gelöscht : C:\Windows\grep.exe
Gelöscht : C:\Windows\PEV.exe
Gelöscht : C:\Windows\NIRCMD.exe
Gelöscht : C:\Windows\MBR.exe
Gelöscht : C:\Windows\SED.exe
Gelöscht : C:\Windows\SWREG.exe
Gelöscht : C:\Windows\SWSC.exe
Gelöscht : C:\Windows\SWXCACLS.exe
Gelöscht : C:\Windows\Zip.exe
Gelöscht : HKLM\SOFTWARE\OldTimer Tools
Gelöscht : HKLM\SOFTWARE\AdwCleaner
Gelöscht : HKLM\SOFTWARE\Swearware
Gelöscht : HKLM\SOFTWARE\TrendMicro\Hijackthis
Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe
Gelöscht : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR
~ Erstelle ein Backup der Registrierungsdatenbank ... OK
~ Lösche die Wiederherstellungspunkte ...
Gelöscht : RP #435 [Windows Update | 12/25/2013 00:04:24]
Gelöscht : RP #436 [Removed I.R.I.S. OCR | 12/25/2013 17:30:43]
Gelöscht : RP #437 [Removed HP Officejet 6600 Hilfe | 12/25/2013 17:30:53]
Gelöscht : RP #438 [Removed HP Officejet 6600 - Grundlegende Software für das Gerät | 12/25/2013 17:31:05]
Gelöscht : RP #439 [Removed Studie zur Verbesserung von HP Officejet 6600 Produkten | 12/25/2013 17:31:41]
Gelöscht : RP #440 [Removed HP Update. | 12/25/2013 17:31:52]
Gelöscht : RP #441 [Windows Update | 12/25/2013 18:22:04]
Gelöscht : RP #442 [Windows Update | 12/26/2013 05:12:02]
Gelöscht : RP #443 [Windows Update | 12/26/2013 14:00:12]
Ein neuer Wiederherstellungspunkt wurde erstellt !
~ Stelle die Systemeinstellungen wieder her ... OK
########## - EOF - ##########
Danke für die Hilfe soweit Ich hof das alles Sicher ist/bleibt jetzt |
|
| Themen zu HiddenObject.Multi.Generic und PC verhält sich merkwürdig |
| appdata, bluescreens, boot, cpu-z, dateien, daten, ebanking, explorer, files, gekauft, guten, hochfahren, internet, kaspersky, klelam.sys, launch, lädt, mbam, meldung, merkwürdig, microsoft, nexus, nicht mehr, nichts, officejet, plug-in, probleme, programm, spielen, temporary, websites, windows, windows explorer |
Linear-Darstellung
