| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Bit Coin Miner "Befall"Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
27.12.2013, 18:17
| #1 |
| |  Windows 7: Bit Coin Miner "Befall" Guten Abend, heute morgen ist mir beim Starten eines Spiels aufgefallen,dass dieses ungewöhnlich ruckelte. Mein System: -Intel Core i5 4670 -Asus H87 Plus -Asus GTX 760 -8 Gb Ram Ich ging zurück auf den Desktop und bemerkte,dass auch u.a das Verschieben der Windows Fenster sehr ruckelig verlief.Nun war klar,dass es irgendetwas mit der Grafikkarte zu tun haben muss.Ich beobachtete die Auslastung: 70-99 % auf dem Desktop,ohne weitere geöffneten Anwendungen.Nach kurzem Googlen war klar,dass es sich um einen "BitCoin Miner" handeln muss,denn nach dem Trennen der I-Net Verbindung sank die Auslastung auf 0%.Allerdings erkannte ich keine aufälligen Prozesse im Task-Manager.Nun bin ich hier gelandet,in der Hoffnung den Mist vom Rechner zu schaffen,denn eindeutige DIY Tools/Anleitungen habe ich nicht gefunden. Mit freundlichen Grüßen Mike Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-27 17:59:51
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006a ATA_____ rev.A5CA 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\test\AppData\Local\Temp\kxldypow.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000070cb1a22 2 bytes [CB, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000070cb1ad0 2 bytes [CB, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000070cb1b08 2 bytes [CB, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000070cb1bba 2 bytes [CB, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000070cb1bda 2 bytes [CB, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
.text C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3440] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3440] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[4824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[4824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4792:3924] 000007fefb9a2a7c
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4792:252] 000007feef954830
---- EOF - GMER 2.1 ----
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-12-2013 Ran by test (administrator) on MIKE-PC on 27-12-2013 16:18:39 Running from C:\Users\test\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe () C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe () C:\Windows\SysWOW64\ASGT.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe () C:\Windows\SysWOW64\PnkBstrA.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe () C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe (Microsoft Corporation) C:\Windows\System32\cmd.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe () C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe (ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation) HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation) HKLM-x32\...\Run: [GamingKeyboard] - C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKCU\...\Run: [HP Officejet 6600 (NET)] - C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.) HKCU\...\Run: [OscarEditor] - C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe [3333632 2012-08-16] () HKCU\...\RunOnce: [Temp] - C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\system.vbs [2149 2013-12-27] () MountPoints2: {27be5a93-ee35-11e2-b16b-806e6f6e6963} - D:\Bin\ASSETUP.exe Startup: C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6600\Bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=hp&installDate=03/10/2013 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFE6EA923CC82CE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: WOT - {9E571C81-21E7-496B-9E6B-127E60263022} - C:\Users\test\AppData\LocalLow\WOT\IE\WOT.dll (WOT Services Oy) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default FF NewTab: about:blank FF Homepage: google.de FF Keyword.URL: hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&installDate={installDate}&q= FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @java.com/DTPlugin,version=1.6.0_45 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll No File FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: WOT - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\wotstats@mywot.com FF Extension: Adblock Plus - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-17] (Avira Operations GmbH & Co. KG) R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [927232 2012-10-29] () R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-01-23] (Intel Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation) R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-09-30] () R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.) S2 WOTUpdater; C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] () ==================== Drivers (Whitelisted) ==================== R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-29] (Disc Soft Ltd) S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] () S3 FanatecWheelFilterUsb; C:\Windows\System32\DRIVERS\FWFilterUsb.sys [64688 2013-02-15] (Windows (R) Codename Longhorn DDK provider) R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] () R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation) R4 IOMap; C:\Windows\system32\drivers\IOMap64.sys [24824 2013-02-19] (ASUSTeK Computer Inc.) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation) S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] () S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] () R3 PorscheWheelFilterUsb; C:\Windows\System32\DRIVERS\PWFilterUsb.sys [58448 2010-12-15] (Windows (R) Codename Longhorn DDK provider) S3 vhidmini; C:\Windows\System32\DRIVERS\vjoy.sys [15104 2012-10-15] (Headsoft) S3 WinRing0_1_2_0; \??\C:\Users\test\AppData\Local\Temp\tmp7712.tmp [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-12-27 16:17 - 2013-12-27 16:18 - 00030667 _____ C:\Users\test\Desktop\Addition.txt 2013-12-27 16:15 - 2013-12-27 16:18 - 00016265 _____ C:\Users\test\Desktop\FRST.txt 2013-12-27 16:15 - 2013-12-27 16:15 - 00000000 ____D C:\FRST 2013-12-27 16:14 - 2013-12-27 16:14 - 01930574 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe 2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log 2013-12-27 16:12 - 2013-12-27 16:12 - 00000168 _____ C:\Users\test\defogger_reenable 2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe 2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat 2013-12-27 16:07 - 2013-12-27 16:07 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup 2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\sh4ldr 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group 2013-12-27 16:07 - 2012-06-22 11:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys 2013-12-27 16:06 - 2013-12-27 16:07 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP 2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe 2013-12-27 15:39 - 2013-02-19 18:02 - 00024824 _____ (ASUSTeK Computer Inc.) C:\Windows\system32\Drivers\IOMap64.sys 2013-12-27 15:27 - 2013-12-27 15:27 - 00000000 ____D C:\Windows\LastGood 2013-12-27 15:26 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2013-12-27 15:26 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-12-27 15:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-12-27 15:07 - 2013-12-27 15:08 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe 2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe 2013-12-27 14:50 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine 2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe 2013-12-27 14:48 - 2013-12-27 14:50 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe 2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs 2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base 2013-12-27 11:15 - 2013-12-27 14:03 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z 2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4 2013-12-26 22:32 - 2013-12-26 22:48 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar 2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04 2013-12-25 22:51 - 2013-12-25 22:50 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip 2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff 2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff 2013-12-24 21:56 - 2013-12-24 21:56 - 01049728 _____ C:\Users\test\Downloads\pantsoff.exe 2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe 2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware 2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware 2013-12-23 22:40 - 2013-12-26 12:07 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows 2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip 2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs 2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs 2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30 2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle 2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel 2013-12-23 14:55 - 2013-12-23 14:59 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z 2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip 2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3 2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1 2013-12-21 21:05 - 2013-12-21 21:06 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar 2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs 2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar 2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK) 2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs 2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch 2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx 2013-12-21 14:33 - 2013-12-21 14:34 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip 2013-12-21 14:32 - 2013-12-21 14:33 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar 2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache 2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-12-21 13:59 - 2013-12-21 14:00 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe 2013-12-20 22:37 - 2013-12-20 22:38 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip 2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7 2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar 2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar 2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50 2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk 2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install 2013-12-15 11:01 - 2013-12-15 14:46 - 00000000 ____D C:\Users\test\Desktop\j 2013-12-12 16:40 - 2013-12-12 16:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-12-11 22:14 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2013-12-11 22:14 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2013-12-11 22:14 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL 2013-12-11 22:14 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll 2013-12-11 22:13 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-12-11 22:13 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-12-11 22:13 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-12-11 22:13 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-12-11 22:13 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-12-11 22:13 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-12-11 22:13 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-12-11 22:13 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-12-11 22:13 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-12-11 22:13 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-12-11 22:13 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-12-11 22:13 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-12-11 22:13 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-12-11 22:13 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-12-11 22:13 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-12-11 22:13 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-12-11 22:13 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-12-11 22:13 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-12-11 22:13 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-12-11 22:13 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-12-11 22:13 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-12-11 22:13 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-12-11 22:13 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-12-11 22:13 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-12-11 22:13 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-12-11 22:13 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-12-11 22:13 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-12-11 22:13 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-12-11 22:13 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-12-11 22:13 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-12-11 22:13 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-12-11 11:52 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2013-12-11 11:52 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2013-12-11 11:52 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll 2013-12-11 11:52 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll 2013-12-11 11:52 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-12-11 11:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2013-12-11 11:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2013-12-11 11:50 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-12-11 11:50 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2013-12-11 11:50 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx 2013-12-11 11:50 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll 2013-12-11 11:50 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx 2013-12-11 11:50 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll 2013-12-11 11:50 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe 2013-12-11 11:50 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe 2013-12-11 11:50 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe 2013-12-11 11:50 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe 2013-12-11 11:50 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys 2013-12-11 11:50 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys 2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent 2013-12-09 13:45 - 2013-12-19 19:48 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik 2013-11-30 23:52 - 2013-09-25 11:42 - 00033720 _____ C:\Users\test\Documents\turbo_int.ogg 2013-11-29 18:36 - 2013-12-15 00:05 - 00000000 ____D C:\Users\test\Documents\SimCity 4 2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat 2013-11-29 18:31 - 2013-11-29 18:32 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite 2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys 2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite 2013-11-29 18:30 - 2013-11-29 18:32 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite ==================== One Month Modified Files and Folders ======= 2013-12-27 16:18 - 2013-12-27 16:17 - 00030667 _____ C:\Users\test\Desktop\Addition.txt 2013-12-27 16:18 - 2013-12-27 16:15 - 00016265 _____ C:\Users\test\Desktop\FRST.txt 2013-12-27 16:18 - 2013-07-17 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-12-27 16:15 - 2013-12-27 16:15 - 00000000 ____D C:\FRST 2013-12-27 16:14 - 2013-12-27 16:14 - 01930574 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe 2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log 2013-12-27 16:12 - 2013-12-27 16:12 - 00000168 _____ C:\Users\test\defogger_reenable 2013-12-27 16:12 - 2013-07-16 17:37 - 00000000 ____D C:\Users\test 2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe 2013-12-27 16:10 - 2013-07-16 17:37 - 01933935 _____ C:\Windows\WindowsUpdate.log 2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat 2013-12-27 16:07 - 2013-12-27 16:07 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup 2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\sh4ldr 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group 2013-12-27 16:07 - 2013-12-27 16:06 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP 2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe 2013-12-27 15:43 - 2013-07-17 15:05 - 00000000 ____D C:\Games 2013-12-27 15:31 - 2013-07-17 15:05 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA 2013-12-27 15:30 - 2013-11-13 23:33 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA Corporation 2013-12-27 15:30 - 2013-07-17 14:53 - 00000000 ____D C:\ProgramData\NVIDIA 2013-12-27 15:30 - 2013-07-17 14:52 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2013-12-27 15:28 - 2009-07-14 05:51 - 00092802 _____ C:\Windows\setupact.log 2013-12-27 15:27 - 2013-12-27 15:27 - 00000000 ____D C:\Windows\LastGood 2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-12-27 15:08 - 2013-12-27 15:07 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe 2013-12-27 15:08 - 2013-12-27 14:50 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine 2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe 2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe 2013-12-27 14:50 - 2013-12-27 14:48 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe 2013-12-27 14:46 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-12-27 14:46 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-12-27 14:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-12-27 14:33 - 2013-07-16 17:37 - 00000000 ___RD C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-12-27 14:33 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-12-27 14:32 - 2013-10-29 14:17 - 00000022 _____ C:\Windows\GPU-Z.INI 2013-12-27 14:03 - 2013-12-27 11:15 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z 2013-12-27 13:16 - 2013-10-04 11:23 - 00544909 _____ C:\NPClient.log 2013-12-27 13:16 - 2013-07-17 15:06 - 00000000 ____D C:\Users\test\Documents\Euro Truck Simulator 2 2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs 2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base 2013-12-27 13:05 - 2013-11-09 11:45 - 00000000 ____D C:\Users\test\AppData\Roaming\vlc 2013-12-27 12:57 - 2013-07-17 14:49 - 00000000 ____D C:\Program Files (x86)\Origin 2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4 2013-12-26 22:48 - 2013-12-26 22:32 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar 2013-12-26 12:12 - 2013-11-06 23:13 - 00000000 ____D C:\Users\test\.gimp-2.8 2013-12-26 12:07 - 2013-12-23 22:40 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows 2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04 2013-12-25 22:50 - 2013-12-25 22:51 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip 2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2013-12-24 22:58 - 2011-04-12 08:43 - 00697658 _____ C:\Windows\system32\perfh007.dat 2013-12-24 22:58 - 2011-04-12 08:43 - 00148452 _____ C:\Windows\system32\perfc007.dat 2013-12-24 22:58 - 2009-07-14 06:13 - 01615906 _____ C:\Windows\system32\PerfStringBackup.INI 2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff 2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff 2013-12-24 21:56 - 2013-12-24 21:56 - 01049728 _____ C:\Users\test\Downloads\pantsoff.exe 2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe 2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware 2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware 2013-12-24 00:30 - 2013-07-17 16:57 - 00000000 ____D C:\Users\test\AppData\Roaming\uTorrent 2013-12-23 23:41 - 2013-07-18 16:57 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr 2013-12-23 23:41 - 2013-07-18 14:39 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe 2013-12-23 23:41 - 2013-07-18 14:39 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0 2013-12-23 22:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF 2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip 2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs 2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs 2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30 2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle 2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel 2013-12-23 14:59 - 2013-12-23 14:55 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z 2013-12-23 11:21 - 2013-07-17 14:51 - 00000000 ____D C:\Users\test\AppData\Roaming\Origin 2013-12-23 11:21 - 2013-07-17 14:49 - 00000000 ____D C:\ProgramData\Origin 2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip 2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3 2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1 2013-12-21 21:06 - 2013-12-21 21:05 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar 2013-12-21 20:58 - 2013-11-10 10:54 - 00000000 ____D C:\Users\test\AppData\Local\CrashDumps 2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs 2013-12-21 20:19 - 2013-11-09 11:56 - 00000000 ____D C:\Users\test\AppData\Roaming\Audacity 2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar 2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK) 2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs 2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch 2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx 2013-12-21 14:34 - 2013-12-21 14:33 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip 2013-12-21 14:33 - 2013-12-21 14:32 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar 2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache 2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-12-21 14:00 - 2013-12-21 13:59 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe 2013-12-20 22:38 - 2013-12-20 22:37 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip 2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7 2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar 2013-12-19 20:01 - 2013-07-17 09:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar 2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50 2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk 2013-12-19 19:48 - 2013-12-09 13:45 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik 2013-12-17 14:33 - 2013-11-20 19:39 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-12-17 14:33 - 2013-11-20 19:39 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-12-17 14:33 - 2013-11-20 19:39 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install 2013-12-15 14:46 - 2013-12-15 11:01 - 00000000 ____D C:\Users\test\Desktop\j 2013-12-15 14:42 - 2013-10-06 16:13 - 00024064 ___SH C:\Users\test\Documents\Thumbs.db 2013-12-15 14:01 - 2013-11-06 23:25 - 00000000 ____D C:\Users\test\AppData\Local\gtk-2.0 2013-12-15 00:54 - 2013-08-19 21:23 - 00000000 ____D C:\Windows\system32\MRT 2013-12-15 00:53 - 2013-07-26 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-12-15 00:05 - 2013-11-29 18:36 - 00000000 ____D C:\Users\test\Documents\SimCity 4 2013-12-13 20:08 - 2013-07-21 16:02 - 00000000 ____D C:\Users\test\AppData\Roaming\TS3Client 2013-12-13 11:51 - 2013-08-19 09:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-12-12 19:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-12-12 16:41 - 2013-12-12 16:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-12-12 15:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD 2013-12-12 15:47 - 2009-07-14 05:45 - 00274712 _____ C:\Windows\system32\FNTCACHE.DAT 2013-12-11 16:18 - 2013-07-17 14:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-12-11 16:18 - 2013-07-17 14:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-12-11 16:18 - 2013-07-17 14:35 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-12-10 03:13 - 2013-10-29 11:49 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2013-12-10 03:13 - 2013-10-29 11:49 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent 2013-12-08 14:58 - 2013-11-09 19:16 - 00000000 ____D C:\Users\test\Documents\Assetto Corsa 2013-12-06 18:40 - 2013-07-22 22:03 - 00000000 ____D C:\Program Files (x86)\Steam 2013-12-05 09:42 - 2013-12-27 15:26 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2013-12-05 09:42 - 2013-12-27 15:26 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2013-12-05 09:42 - 2013-07-31 10:53 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2013-12-02 14:51 - 2013-07-17 23:27 - 00000000 ____D C:\Windows\Minidump 2013-12-02 14:50 - 2013-07-17 23:26 - 632873085 _____ C:\Windows\MEMORY.DMP 2013-11-30 13:15 - 2010-11-21 04:47 - 00114556 _____ C:\Windows\PFRO.log 2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat 2013-11-29 18:32 - 2013-11-29 18:31 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite 2013-11-29 18:32 - 2013-11-29 18:30 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite 2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys 2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite 2013-11-28 15:23 - 2013-07-18 16:56 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins Files to move or delete: ==================== C:\Users\test\Game.dll Some content of TEMP: ==================== C:\Users\test\AppData\Local\Temp\AutoRun.exe C:\Users\test\AppData\Local\Temp\AutoRunGUI.dll C:\Users\test\AppData\Local\Temp\avgnt.exe C:\Users\test\AppData\Local\Temp\bdfilters.dll C:\Users\test\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih.exe C:\Users\test\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\test\AppData\Local\Temp\nv3DVStreaming.dll C:\Users\test\AppData\Local\Temp\nvSCPAPI.dll C:\Users\test\AppData\Local\Temp\nvSCPAPI64.dll C:\Users\test\AppData\Local\Temp\nvStereoApiI.dll C:\Users\test\AppData\Local\Temp\nvStInst.exe C:\Users\test\AppData\Local\Temp\setup.exe C:\Users\test\AppData\Local\Temp\SHSetup.exe C:\Users\test\AppData\Local\Temp\sonarinst.exe C:\Users\test\AppData\Local\Temp\SRLDetectionLibrary5003431084714088478.dll C:\Users\test\AppData\Local\Temp\_is7D5A.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-12-21 10:47 ==================== End Of Log ============================ --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-12-2013
Ran by test at 2013-12-27 16:19:00
Running from C:\Users\test\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
«Max Payne 3» 1.0.0.57 (x32 Version: 1.0.0.57)
µTorrent (HKCU Version: 3.3.2.30303)
Adobe Acrobat 5.0 (x32 Version: 5.0)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
ARMA 3 (x32 Version: 1)
Assetto Corsa - Technology Preview Version 0.9.6 (x32 Version: 0.9.6)
Asterisk Key 10.0 (x32)
ASUS GPU Tweak (x32 Version: 2.4.2.4)
ASUS Product Register Program (x32 Version: 1.0.022)
Audacity 2.0.5 (x32 Version: 2.0.5)
Avira Free Antivirus (x32 Version: 14.0.2.286)
Bandicam (x32 Version: 1.9.1.419)
Bandisoft MPEG-1 Decoder (x32)
Battlefield 1942™ (x32 Version: 1.6.20.0)
Battlefield 3™ (x32 Version: 1.6.0.0)
Battlefield 4™ Beta (x32 Version: 1.0.0.0)
Battlelog Web Plugins (x32 Version: 2.3.2)
Camtasia Studio 8 (x32 Version: 8.1.2.1327)
Cheat Engine 6.3 (x32)
City Car Driving 1.2.2 (x32)
CL-Eye Driver (x32 Version: 5.3.0.0341)
CPUID HWMonitor 1.23
CTDP Formula One 2006 V1.1 (x32 Version: 0.95)
DAEMON Tools Lite (x32 Version: 4.48.1.0347)
DiRT 3 (x32 Version: 1.0.0000.130)
DiRT2 (x32 Version: 1.0.0002.133)
DiRT2 (x32 Version: 1.00.0000)
DTM Experience Demo (x32)
Enable Viacam 1.7.0 (x32 Version: 1.7.0)
Endurance Series by EnduRacers - rF1 FULL (HKCU)
Endurance Series by EnduRacers - Service Pack 2.1 (HKCU)
ESN Sonar (x32 Version: 0.70.4)
Euro Truck Simulator 2 (x32 Version: 1.0.2)
Euro Truck Simulator 2 (x32)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
F1 1976 LE v1.1 (HKCU)
F1 2010 (x32 Version: 1.0.0000.132)
F1 2013 Update 2 (x32 Version: 1)
FaceTrackingAPI_NC 3.2 (x32 Version: 3.2.0)
FaceTrackNoIR version 1.7 (x32 Version: 1.7)
Fiat Abarth 500 esseesse - Street & Cup 1.01 (x32)
Formula Truck 2013 version 1.10 (x32 Version: 1.10)
Fraps (x32)
GeForce Experience NvStream Client Components (Version: 1.6.28)
GIMP 2.8.8 (Version: 2.8.8)
Grand Theft Auto IV (x32 Version: 1.00.0000)
HP Officejet 6600 - Grundlegende Software für das Gerät (Version: 25.0.619.0)
ImgBurn (x32 Version: 2.5.8.0)
Intel(R) IPP Run-Time Installer 5.3 Update 4 for Windows* on IA-32 (x32 Version: 5.3.4.087)
Intel(R) Management Engine Components (x32 Version: 9.0.0.1310)
Intel(R) Rapid Storage Technology (Version: 12.0.0.1083)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 2.0.0.100)
Intel® Trusted Connect Service Client (Version: 1.27.757.1)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 34 (64-bit) (Version: 6.0.340)
Java(TM) 6 Update 34 (x32 Version: 6.0.340)
Java(TM) 6 Update 45 (64-bit) (Version: 6.0.450)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Flight Simulator X (x32 Version: 10.0.60905)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.67.0)
Microsoft Office Word Viewer 2003 (x32 Version: 11.0.8173.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.50727.42 False (x32 Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.51011 False (x32 Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.56336 False (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.58299 False (x32 Version: 8.0.58299)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.59193 False (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.61001 (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 False (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.0 False (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 False (x32 Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 False (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 False (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 False (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 False (x32 Version: 9.0.30729.4048)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 False (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.5570 False (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.30319 False (x32 Version: 10.0.30319)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 False (x32 Version: 11.0.50727.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 False (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 False (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 False (x32 Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 False (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 False (x32 Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610)
MMG F1 2007 V3.0.1 (x32)
Mouse Editor (x32 Version: 12.08.0006)
MOUSE Editor (x32 Version: 12.08.0006)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0)
Mozilla Maintenance Service (x32 Version: 26.0)
MSI Afterburner 2.3.1 (x32 Version: 2.3.1)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser und SDK (x32 Version: 4.20.9818.0)
NASCAR The Game 2013 (x32 Version: 1.0.0.1)
NASCAR® Racing 2003 Season (x32)
Need For Speed The Run (x32)
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82)
NVIDIA 3D Vision Treiber 331.82 (Version: 331.82)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1)
NVIDIA Grafiktreiber 331.82 (Version: 331.82)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4)
NVIDIA Install Application (Version: 2.1002.142.992)
NVIDIA LED Visualizer 1.0 (Version: 1.0)
NVIDIA Network Service (Version: 1.0)
NVIDIA PhysX (x32 Version: 9.13.0725)
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182)
NVIDIA Systemsteuerung 331.82 (Version: 331.82)
NVIDIA Update 10.11.15 (Version: 10.11.15)
NVIDIA Update Core (Version: 10.11.15)
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19)
OMSI - Der Omnibussimulator (x32 Version: 1.06)
OMSI - Hamburg (x32 Version: 1.00)
OMSI Addon Manager Version 1.2.4 (x32 Version: 1.2.4)
OpenAL (x32)
Origin (x32 Version: 9.2.1.4399)
PantsOff 2.0 (x32 Version: 2.0)
Porsche Wheel (Version: 8.10.6)
PunkBuster Services (x32 Version: 0.993)
Race On (x32)
Rapture3D 2.4.8 Game (x32)
Realtek Ethernet Controller Driver (x32 Version: 7.67.1226.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6782)
rFactor2 (x32)
Rockstar Games Social Club (x32 Version: 1.0.9.7)
Rockstar Games Social Club (x32 Version: 1.00.0000)
SHARKOON Skiller (x32 Version: 1.00.0000)
SHIELD Streaming (Version: 1.6.85)
SimCity 4 Deluxe (x32)
Skype™ 6.6 (x32 Version: 6.6.106)
Spa Francorchamps 2009 (x32 Version: 1.0)
SpinTires Tech Demo (June 060613) (x32 Version: 1.3)
Splinter Cell - Blacklist (x32)
SpyHunter (Version: 4.16.5.4290)
Steam (x32 Version: 1.0.0.0)
System Requirements Lab CYRI (x32 Version: 6.0.3.0)
TeamSpeak 3 Client (HKCU Version: 3.0.13.1)
Thrustmaster Calibration Tool (x32 Version: 1.03.0000)
Thrustmaster FFB Wheel driver (x32 Version: 2.FFJ.2007)
Tombraider (x32)
TV-Total Emulator v1.4.1.1 (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
VLC media player 2.1.0 (Version: 2.1.0)
VLN 2005 for rFactor v1.0 (x32)
War Thunder Launcher 1.0.1.269 (x32)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)
World of Warplanes (x32)
==================== Restore Points =========================
21-12-2013 13:03:09 Microsoft Office Word Viewer 2003 wird installiert
22-12-2013 23:01:20 Windows Update
27-12-2013 14:30:05 DirectX wurde installiert
27-12-2013 15:06:41 Installed SpyHunter
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {39A65BF6-9DA3-4F81-B929-A1AD11A329C3} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe [2013-10-18] (Enigma Software Group USA, LLC.)
Task: {6F5EAFA4-F909-48A1-A7D7-171F15B73B33} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {7611F656-F4A5-480F-8075-FC0FF5F69F3C} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2013-06-21] (ASUSTek Computer Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-07-17 14:52 - 2013-11-11 16:02 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-11-20 19:39 - 2013-10-31 19:25 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-07-17 09:13 - 2013-12-27 14:38 - 00025088 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.01\PEbiosinterface32.dll
2013-07-17 09:13 - 2012-05-08 08:04 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.01\ATKEX.dll
2010-12-02 10:56 - 2010-12-02 10:56 - 00815104 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\OSD_Text\OSD_Text.dll
2011-01-09 13:45 - 2011-01-09 13:45 - 00088064 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_MouseDeviceManager.dll
2012-06-14 08:59 - 2012-06-14 08:59 - 02414080 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\ScreenCapture\ScreenCapture.dll
2012-05-17 04:17 - 2012-05-17 04:17 - 01000448 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\TrayIconWebAdvertisement\TrayIconWebAdvertisement.dll
2010-09-20 07:18 - 2010-09-20 07:18 - 00085504 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ZoomControl.dll
2010-09-20 07:18 - 2010-09-20 07:18 - 00054272 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ScrollbarControl.dll
2011-04-12 08:14 - 2011-04-12 08:14 - 00063488 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInRight.dll
2010-11-01 13:16 - 2010-11-01 13:16 - 00062976 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInOne.dll
2012-04-27 04:40 - 2012-04-27 04:40 - 00118272 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_Wheel4D.dll
2013-12-12 16:40 - 2013-12-12 16:41 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-07-17 09:47 - 2013-01-23 08:57 - 01199576 ____R () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2013-12-27 12:56 - 2012-09-25 23:46 - 00445800 _____ () C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\cudart32_50_35.dll
2013-12-27 12:56 - 2012-05-27 01:36 - 00054272 _____ () C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\pthreadVC2.dll
2013-06-20 11:01 - 2013-06-20 11:01 - 00258048 _____ () C:\Program Files (x86)\ASUS\GPU Tweak\Vender.dll
2013-05-14 15:11 - 2013-05-14 15:11 - 00049152 _____ () C:\Program Files (x86)\ASUS\GPU Tweak\Exeio.dll
2013-11-20 19:39 - 2013-10-31 19:25 - 00394808 _____ () c:\program files (x86)\avira\antivir desktop\sqlite3.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:D73C9AB3
AlternateDataStreams: C:\ProgramData\TEMP:F1A5FE8B
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/27/2013 02:40:31 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/27/2013 02:15:18 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/27/2013 01:37:03 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/27/2013 01:37:02 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/27/2013 11:03:04 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 08:08:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/26/2013 08:08:55 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/26/2013 06:21:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 05:01:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 03:44:38 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (12/27/2013 03:06:47 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Diagnosesystemhost" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sitzungs-Manager für Desktopfenster-Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Überwachung verteilter Verknüpfungen (Client)" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Superfetch" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Programmkompatibilitäts-Assistent-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerkverbindungen" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PnP-X-IP-Busenumerator" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office Sessions:
=========================
Error: (12/27/2013 02:40:31 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/27/2013 02:15:18 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/27/2013 01:37:03 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Support\Tools\MAS2.exe
Error: (12/27/2013 01:37:02 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Core\ModMgr.exe
Error: (12/27/2013 11:03:04 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 08:08:56 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Support\Tools\MAS2.exe
Error: (12/26/2013 08:08:55 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Core\ModMgr.exe
Error: (12/26/2013 06:21:46 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 05:01:45 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 03:44:38 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2013-07-21 16:53:02.592
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-21 16:53:02.576
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-21 16:53:02.184
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-21 16:53:02.169
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-17 23:00:22.126
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-17 23:00:22.116
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-17 23:00:21.732
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-17 23:00:21.722
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 43%
Total physical RAM: 8131.85 MB
Available physical RAM: 4604.38 MB
Total Pagefile: 16261.88 MB
Available Pagefile: 11714.9 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.66 GB) (Free:47.14 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 0FB3C24D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.12.27.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 test :: MIKE-PC [limitiert] 27.12.2013 15:20:52 MBAM-log-2013-12-27 (17-39-15).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 657601 Laufzeit: 2 Stunde(n), 5 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 1 HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0R0DtO0U1C1S1U1StR0J1Q2P1J1K1I2R -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 5 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=hp&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Bar (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|SearchAssistant (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 6 C:\Users\test\AppData\Local\Temp\58hzMFNi.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt. C:\Users\test\AppData\Local\Temp\AgBF3Zr1.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt. C:\Users\test\AppData\Local\Temp\DHIPdIaj.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt. C:\Users\test\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih.exe (Trojan.Repacked) -> Keine Aktion durchgeführt. C:\Users\test\AppData\Local\Temp\qWurm_Tk.exe.part (PUP.Optional.InstalleRex) -> Keine Aktion durchgeführt. C:\Users\test\Downloads\pantsoff.exe (PUP.PSWTool.Finder) -> Keine Aktion durchgeführt. (Ende) |
|
28.12.2013, 01:29
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Bit Coin Miner "Befall" Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
28.12.2013, 11:28
| #3 |
| | Windows 7: Bit Coin Miner "Befall" Hallo schrauber,
__________________ich verstehe nicht ganz worum es geht.Ich habe doch die 4 Logs als Code eingefügt?Kanns ja nochmal machen,aber wie gesagt,ich seh bei mir im Post die eingebetteten Abschnitte... FRST FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-12-2013 Ran by test (administrator) on MIKE-PC on 27-12-2013 16:18:39 Running from C:\Users\test\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe () C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe () C:\Windows\SysWOW64\ASGT.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe () C:\Windows\SysWOW64\PnkBstrA.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe () C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe (Microsoft Corporation) C:\Windows\System32\cmd.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe () C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe (ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation) HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation) HKLM-x32\...\Run: [GamingKeyboard] - C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKCU\...\Run: [HP Officejet 6600 (NET)] - C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.) HKCU\...\Run: [OscarEditor] - C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe [3333632 2012-08-16] () HKCU\...\RunOnce: [Temp] - C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\system.vbs [2149 2013-12-27] () MountPoints2: {27be5a93-ee35-11e2-b16b-806e6f6e6963} - D:\Bin\ASSETUP.exe Startup: C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6600\Bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=hp&installDate=03/10/2013 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFE6EA923CC82CE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013 BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: WOT - {9E571C81-21E7-496B-9E6B-127E60263022} - C:\Users\test\AppData\LocalLow\WOT\IE\WOT.dll (WOT Services Oy) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default FF NewTab: about:blank FF Homepage: google.de FF Keyword.URL: hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&installDate={installDate}&q= FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @java.com/DTPlugin,version=1.6.0_45 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll No File FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: WOT - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\wotstats@mywot.com FF Extension: Adblock Plus - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-17] (Avira Operations GmbH & Co. KG) R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [927232 2012-10-29] () R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-01-23] (Intel Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation) R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-09-30] () R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.) S2 WOTUpdater; C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] () ==================== Drivers (Whitelisted) ==================== R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-29] (Disc Soft Ltd) S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] () S3 FanatecWheelFilterUsb; C:\Windows\System32\DRIVERS\FWFilterUsb.sys [64688 2013-02-15] (Windows (R) Codename Longhorn DDK provider) R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] () R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation) R4 IOMap; C:\Windows\system32\drivers\IOMap64.sys [24824 2013-02-19] (ASUSTeK Computer Inc.) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation) S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] () S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] () R3 PorscheWheelFilterUsb; C:\Windows\System32\DRIVERS\PWFilterUsb.sys [58448 2010-12-15] (Windows (R) Codename Longhorn DDK provider) S3 vhidmini; C:\Windows\System32\DRIVERS\vjoy.sys [15104 2012-10-15] (Headsoft) S3 WinRing0_1_2_0; \??\C:\Users\test\AppData\Local\Temp\tmp7712.tmp [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-12-27 16:17 - 2013-12-27 16:18 - 00030667 _____ C:\Users\test\Desktop\Addition.txt 2013-12-27 16:15 - 2013-12-27 16:18 - 00016265 _____ C:\Users\test\Desktop\FRST.txt 2013-12-27 16:15 - 2013-12-27 16:15 - 00000000 ____D C:\FRST 2013-12-27 16:14 - 2013-12-27 16:14 - 01930574 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe 2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log 2013-12-27 16:12 - 2013-12-27 16:12 - 00000168 _____ C:\Users\test\defogger_reenable 2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe 2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat 2013-12-27 16:07 - 2013-12-27 16:07 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup 2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\sh4ldr 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group 2013-12-27 16:07 - 2012-06-22 11:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys 2013-12-27 16:06 - 2013-12-27 16:07 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP 2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe 2013-12-27 15:39 - 2013-02-19 18:02 - 00024824 _____ (ASUSTeK Computer Inc.) C:\Windows\system32\Drivers\IOMap64.sys 2013-12-27 15:27 - 2013-12-27 15:27 - 00000000 ____D C:\Windows\LastGood 2013-12-27 15:26 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2013-12-27 15:26 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-12-27 15:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-12-27 15:07 - 2013-12-27 15:08 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe 2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe 2013-12-27 14:50 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine 2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe 2013-12-27 14:48 - 2013-12-27 14:50 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe 2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs 2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base 2013-12-27 11:15 - 2013-12-27 14:03 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z 2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4 2013-12-26 22:32 - 2013-12-26 22:48 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar 2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04 2013-12-25 22:51 - 2013-12-25 22:50 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip 2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff 2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff 2013-12-24 21:56 - 2013-12-24 21:56 - 01049728 _____ C:\Users\test\Downloads\pantsoff.exe 2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe 2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware 2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware 2013-12-23 22:40 - 2013-12-26 12:07 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows 2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip 2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs 2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs 2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30 2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle 2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel 2013-12-23 14:55 - 2013-12-23 14:59 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z 2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip 2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3 2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1 2013-12-21 21:05 - 2013-12-21 21:06 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar 2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs 2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar 2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK) 2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs 2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch 2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx 2013-12-21 14:33 - 2013-12-21 14:34 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip 2013-12-21 14:32 - 2013-12-21 14:33 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar 2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache 2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-12-21 13:59 - 2013-12-21 14:00 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe 2013-12-20 22:37 - 2013-12-20 22:38 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip 2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7 2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar 2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar 2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50 2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk 2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install 2013-12-15 11:01 - 2013-12-15 14:46 - 00000000 ____D C:\Users\test\Desktop\j 2013-12-12 16:40 - 2013-12-12 16:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-12-11 22:14 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2013-12-11 22:14 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2013-12-11 22:14 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL 2013-12-11 22:14 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll 2013-12-11 22:13 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-12-11 22:13 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-12-11 22:13 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-12-11 22:13 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-12-11 22:13 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-12-11 22:13 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-12-11 22:13 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-12-11 22:13 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-12-11 22:13 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-12-11 22:13 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-12-11 22:13 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-12-11 22:13 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-12-11 22:13 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-12-11 22:13 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-12-11 22:13 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-12-11 22:13 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-12-11 22:13 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-12-11 22:13 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-12-11 22:13 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-12-11 22:13 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-12-11 22:13 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-12-11 22:13 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-12-11 22:13 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-12-11 22:13 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-12-11 22:13 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-12-11 22:13 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-12-11 22:13 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-12-11 22:13 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-12-11 22:13 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-12-11 22:13 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-12-11 22:13 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-12-11 11:52 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2013-12-11 11:52 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2013-12-11 11:52 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll 2013-12-11 11:52 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll 2013-12-11 11:52 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-12-11 11:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2013-12-11 11:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2013-12-11 11:50 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-12-11 11:50 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2013-12-11 11:50 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx 2013-12-11 11:50 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll 2013-12-11 11:50 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx 2013-12-11 11:50 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll 2013-12-11 11:50 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe 2013-12-11 11:50 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe 2013-12-11 11:50 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe 2013-12-11 11:50 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe 2013-12-11 11:50 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys 2013-12-11 11:50 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys 2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent 2013-12-09 13:45 - 2013-12-19 19:48 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik 2013-11-30 23:52 - 2013-09-25 11:42 - 00033720 _____ C:\Users\test\Documents\turbo_int.ogg 2013-11-29 18:36 - 2013-12-15 00:05 - 00000000 ____D C:\Users\test\Documents\SimCity 4 2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat 2013-11-29 18:31 - 2013-11-29 18:32 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite 2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys 2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite 2013-11-29 18:30 - 2013-11-29 18:32 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite ==================== One Month Modified Files and Folders ======= 2013-12-27 16:18 - 2013-12-27 16:17 - 00030667 _____ C:\Users\test\Desktop\Addition.txt 2013-12-27 16:18 - 2013-12-27 16:15 - 00016265 _____ C:\Users\test\Desktop\FRST.txt 2013-12-27 16:18 - 2013-07-17 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-12-27 16:15 - 2013-12-27 16:15 - 00000000 ____D C:\FRST 2013-12-27 16:14 - 2013-12-27 16:14 - 01930574 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe 2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log 2013-12-27 16:12 - 2013-12-27 16:12 - 00000168 _____ C:\Users\test\defogger_reenable 2013-12-27 16:12 - 2013-07-16 17:37 - 00000000 ____D C:\Users\test 2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe 2013-12-27 16:10 - 2013-07-16 17:37 - 01933935 _____ C:\Windows\WindowsUpdate.log 2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat 2013-12-27 16:07 - 2013-12-27 16:07 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup 2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\sh4ldr 2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group 2013-12-27 16:07 - 2013-12-27 16:06 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP 2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe 2013-12-27 15:43 - 2013-07-17 15:05 - 00000000 ____D C:\Games 2013-12-27 15:31 - 2013-07-17 15:05 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA 2013-12-27 15:30 - 2013-11-13 23:33 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA Corporation 2013-12-27 15:30 - 2013-07-17 14:53 - 00000000 ____D C:\ProgramData\NVIDIA 2013-12-27 15:30 - 2013-07-17 14:52 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2013-12-27 15:28 - 2009-07-14 05:51 - 00092802 _____ C:\Windows\setupact.log 2013-12-27 15:27 - 2013-12-27 15:27 - 00000000 ____D C:\Windows\LastGood 2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-12-27 15:08 - 2013-12-27 15:07 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe 2013-12-27 15:08 - 2013-12-27 14:50 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine 2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe 2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe 2013-12-27 14:50 - 2013-12-27 14:48 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe 2013-12-27 14:46 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-12-27 14:46 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-12-27 14:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-12-27 14:33 - 2013-07-16 17:37 - 00000000 ___RD C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-12-27 14:33 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-12-27 14:32 - 2013-10-29 14:17 - 00000022 _____ C:\Windows\GPU-Z.INI 2013-12-27 14:03 - 2013-12-27 11:15 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z 2013-12-27 13:16 - 2013-10-04 11:23 - 00544909 _____ C:\NPClient.log 2013-12-27 13:16 - 2013-07-17 15:06 - 00000000 ____D C:\Users\test\Documents\Euro Truck Simulator 2 2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs 2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base 2013-12-27 13:05 - 2013-11-09 11:45 - 00000000 ____D C:\Users\test\AppData\Roaming\vlc 2013-12-27 12:57 - 2013-07-17 14:49 - 00000000 ____D C:\Program Files (x86)\Origin 2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4 2013-12-26 22:48 - 2013-12-26 22:32 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar 2013-12-26 12:12 - 2013-11-06 23:13 - 00000000 ____D C:\Users\test\.gimp-2.8 2013-12-26 12:07 - 2013-12-23 22:40 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows 2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04 2013-12-25 22:50 - 2013-12-25 22:51 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip 2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2013-12-24 22:58 - 2011-04-12 08:43 - 00697658 _____ C:\Windows\system32\perfh007.dat 2013-12-24 22:58 - 2011-04-12 08:43 - 00148452 _____ C:\Windows\system32\perfc007.dat 2013-12-24 22:58 - 2009-07-14 06:13 - 01615906 _____ C:\Windows\system32\PerfStringBackup.INI 2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff 2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff 2013-12-24 21:56 - 2013-12-24 21:56 - 01049728 _____ C:\Users\test\Downloads\pantsoff.exe 2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe 2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware 2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware 2013-12-24 00:30 - 2013-07-17 16:57 - 00000000 ____D C:\Users\test\AppData\Roaming\uTorrent 2013-12-23 23:41 - 2013-07-18 16:57 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr 2013-12-23 23:41 - 2013-07-18 14:39 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe 2013-12-23 23:41 - 2013-07-18 14:39 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0 2013-12-23 22:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF 2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip 2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs 2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs 2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30 2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle 2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel 2013-12-23 14:59 - 2013-12-23 14:55 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z 2013-12-23 11:21 - 2013-07-17 14:51 - 00000000 ____D C:\Users\test\AppData\Roaming\Origin 2013-12-23 11:21 - 2013-07-17 14:49 - 00000000 ____D C:\ProgramData\Origin 2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip 2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3 2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1 2013-12-21 21:06 - 2013-12-21 21:05 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar 2013-12-21 20:58 - 2013-11-10 10:54 - 00000000 ____D C:\Users\test\AppData\Local\CrashDumps 2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs 2013-12-21 20:19 - 2013-11-09 11:56 - 00000000 ____D C:\Users\test\AppData\Roaming\Audacity 2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar 2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK) 2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs 2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch 2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx 2013-12-21 14:34 - 2013-12-21 14:33 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip 2013-12-21 14:33 - 2013-12-21 14:32 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar 2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache 2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-12-21 14:00 - 2013-12-21 13:59 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe 2013-12-20 22:38 - 2013-12-20 22:37 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip 2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7 2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar 2013-12-19 20:01 - 2013-07-17 09:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar 2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50 2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk 2013-12-19 19:48 - 2013-12-09 13:45 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik 2013-12-17 14:33 - 2013-11-20 19:39 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-12-17 14:33 - 2013-11-20 19:39 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-12-17 14:33 - 2013-11-20 19:39 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install 2013-12-15 14:46 - 2013-12-15 11:01 - 00000000 ____D C:\Users\test\Desktop\j 2013-12-15 14:42 - 2013-10-06 16:13 - 00024064 ___SH C:\Users\test\Documents\Thumbs.db 2013-12-15 14:01 - 2013-11-06 23:25 - 00000000 ____D C:\Users\test\AppData\Local\gtk-2.0 2013-12-15 00:54 - 2013-08-19 21:23 - 00000000 ____D C:\Windows\system32\MRT 2013-12-15 00:53 - 2013-07-26 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-12-15 00:05 - 2013-11-29 18:36 - 00000000 ____D C:\Users\test\Documents\SimCity 4 2013-12-13 20:08 - 2013-07-21 16:02 - 00000000 ____D C:\Users\test\AppData\Roaming\TS3Client 2013-12-13 11:51 - 2013-08-19 09:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-12-12 19:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-12-12 16:41 - 2013-12-12 16:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-12-12 15:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD 2013-12-12 15:47 - 2009-07-14 05:45 - 00274712 _____ C:\Windows\system32\FNTCACHE.DAT 2013-12-11 16:18 - 2013-07-17 14:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-12-11 16:18 - 2013-07-17 14:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-12-11 16:18 - 2013-07-17 14:35 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-12-10 03:13 - 2013-10-29 11:49 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2013-12-10 03:13 - 2013-10-29 11:49 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent 2013-12-08 14:58 - 2013-11-09 19:16 - 00000000 ____D C:\Users\test\Documents\Assetto Corsa 2013-12-06 18:40 - 2013-07-22 22:03 - 00000000 ____D C:\Program Files (x86)\Steam 2013-12-05 09:42 - 2013-12-27 15:26 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2013-12-05 09:42 - 2013-12-27 15:26 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2013-12-05 09:42 - 2013-07-31 10:53 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2013-12-02 14:51 - 2013-07-17 23:27 - 00000000 ____D C:\Windows\Minidump 2013-12-02 14:50 - 2013-07-17 23:26 - 632873085 _____ C:\Windows\MEMORY.DMP 2013-11-30 13:15 - 2010-11-21 04:47 - 00114556 _____ C:\Windows\PFRO.log 2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat 2013-11-29 18:32 - 2013-11-29 18:31 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite 2013-11-29 18:32 - 2013-11-29 18:30 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite 2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys 2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite 2013-11-28 15:23 - 2013-07-18 16:56 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins Files to move or delete: ==================== C:\Users\test\Game.dll Some content of TEMP: ==================== C:\Users\test\AppData\Local\Temp\AutoRun.exe C:\Users\test\AppData\Local\Temp\AutoRunGUI.dll C:\Users\test\AppData\Local\Temp\avgnt.exe C:\Users\test\AppData\Local\Temp\bdfilters.dll C:\Users\test\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih.exe C:\Users\test\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\test\AppData\Local\Temp\nv3DVStreaming.dll C:\Users\test\AppData\Local\Temp\nvSCPAPI.dll C:\Users\test\AppData\Local\Temp\nvSCPAPI64.dll C:\Users\test\AppData\Local\Temp\nvStereoApiI.dll C:\Users\test\AppData\Local\Temp\nvStInst.exe C:\Users\test\AppData\Local\Temp\setup.exe C:\Users\test\AppData\Local\Temp\SHSetup.exe C:\Users\test\AppData\Local\Temp\sonarinst.exe C:\Users\test\AppData\Local\Temp\SRLDetectionLibrary5003431084714088478.dll C:\Users\test\AppData\Local\Temp\_is7D5A.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-12-21 10:47 ==================== End Of Log ============================ Gmer Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-27 17:59:51
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006a ATA_____ rev.A5CA 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\test\AppData\Local\Temp\kxldypow.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000070cb1a22 2 bytes [CB, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000070cb1ad0 2 bytes [CB, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000070cb1b08 2 bytes [CB, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000070cb1bba 2 bytes [CB, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000070cb1bda 2 bytes [CB, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
.text C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3440] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3440] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[4824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076231465 2 bytes [23, 76]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[4824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762314bb 2 bytes [23, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4792:3924] 000007fefb9a2a7c
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4792:252] 000007feef954830
---- EOF - GMER 2.1 ----
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-12-2013
Ran by test at 2013-12-27 16:19:00
Running from C:\Users\test\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
«Max Payne 3» 1.0.0.57 (x32 Version: 1.0.0.57)
µTorrent (HKCU Version: 3.3.2.30303)
Adobe Acrobat 5.0 (x32 Version: 5.0)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
ARMA 3 (x32 Version: 1)
Assetto Corsa - Technology Preview Version 0.9.6 (x32 Version: 0.9.6)
Asterisk Key 10.0 (x32)
ASUS GPU Tweak (x32 Version: 2.4.2.4)
ASUS Product Register Program (x32 Version: 1.0.022)
Audacity 2.0.5 (x32 Version: 2.0.5)
Avira Free Antivirus (x32 Version: 14.0.2.286)
Bandicam (x32 Version: 1.9.1.419)
Bandisoft MPEG-1 Decoder (x32)
Battlefield 1942™ (x32 Version: 1.6.20.0)
Battlefield 3™ (x32 Version: 1.6.0.0)
Battlefield 4™ Beta (x32 Version: 1.0.0.0)
Battlelog Web Plugins (x32 Version: 2.3.2)
Camtasia Studio 8 (x32 Version: 8.1.2.1327)
Cheat Engine 6.3 (x32)
City Car Driving 1.2.2 (x32)
CL-Eye Driver (x32 Version: 5.3.0.0341)
CPUID HWMonitor 1.23
CTDP Formula One 2006 V1.1 (x32 Version: 0.95)
DAEMON Tools Lite (x32 Version: 4.48.1.0347)
DiRT 3 (x32 Version: 1.0.0000.130)
DiRT2 (x32 Version: 1.0.0002.133)
DiRT2 (x32 Version: 1.00.0000)
DTM Experience Demo (x32)
Enable Viacam 1.7.0 (x32 Version: 1.7.0)
Endurance Series by EnduRacers - rF1 FULL (HKCU)
Endurance Series by EnduRacers - Service Pack 2.1 (HKCU)
ESN Sonar (x32 Version: 0.70.4)
Euro Truck Simulator 2 (x32 Version: 1.0.2)
Euro Truck Simulator 2 (x32)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
F1 1976 LE v1.1 (HKCU)
F1 2010 (x32 Version: 1.0.0000.132)
F1 2013 Update 2 (x32 Version: 1)
FaceTrackingAPI_NC 3.2 (x32 Version: 3.2.0)
FaceTrackNoIR version 1.7 (x32 Version: 1.7)
Fiat Abarth 500 esseesse - Street & Cup 1.01 (x32)
Formula Truck 2013 version 1.10 (x32 Version: 1.10)
Fraps (x32)
GeForce Experience NvStream Client Components (Version: 1.6.28)
GIMP 2.8.8 (Version: 2.8.8)
Grand Theft Auto IV (x32 Version: 1.00.0000)
HP Officejet 6600 - Grundlegende Software für das Gerät (Version: 25.0.619.0)
ImgBurn (x32 Version: 2.5.8.0)
Intel(R) IPP Run-Time Installer 5.3 Update 4 for Windows* on IA-32 (x32 Version: 5.3.4.087)
Intel(R) Management Engine Components (x32 Version: 9.0.0.1310)
Intel(R) Rapid Storage Technology (Version: 12.0.0.1083)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 2.0.0.100)
Intel® Trusted Connect Service Client (Version: 1.27.757.1)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 34 (64-bit) (Version: 6.0.340)
Java(TM) 6 Update 34 (x32 Version: 6.0.340)
Java(TM) 6 Update 45 (64-bit) (Version: 6.0.450)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Flight Simulator X (x32 Version: 10.0.60905)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.67.0)
Microsoft Office Word Viewer 2003 (x32 Version: 11.0.8173.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.50727.42 False (x32 Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.51011 False (x32 Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.56336 False (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.58299 False (x32 Version: 8.0.58299)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.59193 False (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.61001 (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 False (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.0 False (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 False (x32 Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 False (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 False (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 False (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 False (x32 Version: 9.0.30729.4048)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 False (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.5570 False (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.30319 False (x32 Version: 10.0.30319)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 False (x32 Version: 11.0.50727.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 False (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 False (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 False (x32 Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 False (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 False (x32 Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610)
MMG F1 2007 V3.0.1 (x32)
Mouse Editor (x32 Version: 12.08.0006)
MOUSE Editor (x32 Version: 12.08.0006)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0)
Mozilla Maintenance Service (x32 Version: 26.0)
MSI Afterburner 2.3.1 (x32 Version: 2.3.1)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser und SDK (x32 Version: 4.20.9818.0)
NASCAR The Game 2013 (x32 Version: 1.0.0.1)
NASCAR® Racing 2003 Season (x32)
Need For Speed The Run (x32)
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82)
NVIDIA 3D Vision Treiber 331.82 (Version: 331.82)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1)
NVIDIA Grafiktreiber 331.82 (Version: 331.82)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4)
NVIDIA Install Application (Version: 2.1002.142.992)
NVIDIA LED Visualizer 1.0 (Version: 1.0)
NVIDIA Network Service (Version: 1.0)
NVIDIA PhysX (x32 Version: 9.13.0725)
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182)
NVIDIA Systemsteuerung 331.82 (Version: 331.82)
NVIDIA Update 10.11.15 (Version: 10.11.15)
NVIDIA Update Core (Version: 10.11.15)
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19)
OMSI - Der Omnibussimulator (x32 Version: 1.06)
OMSI - Hamburg (x32 Version: 1.00)
OMSI Addon Manager Version 1.2.4 (x32 Version: 1.2.4)
OpenAL (x32)
Origin (x32 Version: 9.2.1.4399)
PantsOff 2.0 (x32 Version: 2.0)
Porsche Wheel (Version: 8.10.6)
PunkBuster Services (x32 Version: 0.993)
Race On (x32)
Rapture3D 2.4.8 Game (x32)
Realtek Ethernet Controller Driver (x32 Version: 7.67.1226.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6782)
rFactor2 (x32)
Rockstar Games Social Club (x32 Version: 1.0.9.7)
Rockstar Games Social Club (x32 Version: 1.00.0000)
SHARKOON Skiller (x32 Version: 1.00.0000)
SHIELD Streaming (Version: 1.6.85)
SimCity 4 Deluxe (x32)
Skype™ 6.6 (x32 Version: 6.6.106)
Spa Francorchamps 2009 (x32 Version: 1.0)
SpinTires Tech Demo (June 060613) (x32 Version: 1.3)
Splinter Cell - Blacklist (x32)
SpyHunter (Version: 4.16.5.4290)
Steam (x32 Version: 1.0.0.0)
System Requirements Lab CYRI (x32 Version: 6.0.3.0)
TeamSpeak 3 Client (HKCU Version: 3.0.13.1)
Thrustmaster Calibration Tool (x32 Version: 1.03.0000)
Thrustmaster FFB Wheel driver (x32 Version: 2.FFJ.2007)
Tombraider (x32)
TV-Total Emulator v1.4.1.1 (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
VLC media player 2.1.0 (Version: 2.1.0)
VLN 2005 for rFactor v1.0 (x32)
War Thunder Launcher 1.0.1.269 (x32)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)
World of Warplanes (x32)
==================== Restore Points =========================
21-12-2013 13:03:09 Microsoft Office Word Viewer 2003 wird installiert
22-12-2013 23:01:20 Windows Update
27-12-2013 14:30:05 DirectX wurde installiert
27-12-2013 15:06:41 Installed SpyHunter
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {39A65BF6-9DA3-4F81-B929-A1AD11A329C3} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe [2013-10-18] (Enigma Software Group USA, LLC.)
Task: {6F5EAFA4-F909-48A1-A7D7-171F15B73B33} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {7611F656-F4A5-480F-8075-FC0FF5F69F3C} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2013-06-21] (ASUSTek Computer Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-07-17 14:52 - 2013-11-11 16:02 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-11-20 19:39 - 2013-10-31 19:25 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-07-17 09:13 - 2013-12-27 14:38 - 00025088 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.01\PEbiosinterface32.dll
2013-07-17 09:13 - 2012-05-08 08:04 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.01\ATKEX.dll
2010-12-02 10:56 - 2010-12-02 10:56 - 00815104 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\OSD_Text\OSD_Text.dll
2011-01-09 13:45 - 2011-01-09 13:45 - 00088064 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_MouseDeviceManager.dll
2012-06-14 08:59 - 2012-06-14 08:59 - 02414080 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\ScreenCapture\ScreenCapture.dll
2012-05-17 04:17 - 2012-05-17 04:17 - 01000448 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\TrayIconWebAdvertisement\TrayIconWebAdvertisement.dll
2010-09-20 07:18 - 2010-09-20 07:18 - 00085504 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ZoomControl.dll
2010-09-20 07:18 - 2010-09-20 07:18 - 00054272 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ScrollbarControl.dll
2011-04-12 08:14 - 2011-04-12 08:14 - 00063488 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInRight.dll
2010-11-01 13:16 - 2010-11-01 13:16 - 00062976 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInOne.dll
2012-04-27 04:40 - 2012-04-27 04:40 - 00118272 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_Wheel4D.dll
2013-12-12 16:40 - 2013-12-12 16:41 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-07-17 09:47 - 2013-01-23 08:57 - 01199576 ____R () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2013-12-27 12:56 - 2012-09-25 23:46 - 00445800 _____ () C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\cudart32_50_35.dll
2013-12-27 12:56 - 2012-05-27 01:36 - 00054272 _____ () C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\pthreadVC2.dll
2013-06-20 11:01 - 2013-06-20 11:01 - 00258048 _____ () C:\Program Files (x86)\ASUS\GPU Tweak\Vender.dll
2013-05-14 15:11 - 2013-05-14 15:11 - 00049152 _____ () C:\Program Files (x86)\ASUS\GPU Tweak\Exeio.dll
2013-11-20 19:39 - 2013-10-31 19:25 - 00394808 _____ () c:\program files (x86)\avira\antivir desktop\sqlite3.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:D73C9AB3
AlternateDataStreams: C:\ProgramData\TEMP:F1A5FE8B
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/27/2013 02:40:31 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/27/2013 02:15:18 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/27/2013 01:37:03 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/27/2013 01:37:02 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/27/2013 11:03:04 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 08:08:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/26/2013 08:08:55 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/26/2013 06:21:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 05:01:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 03:44:38 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (12/27/2013 03:06:47 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Diagnosesystemhost" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sitzungs-Manager für Desktopfenster-Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Überwachung verteilter Verknüpfungen (Client)" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Superfetch" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Programmkompatibilitäts-Assistent-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerkverbindungen" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PnP-X-IP-Busenumerator" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office Sessions:
=========================
Error: (12/27/2013 02:40:31 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/27/2013 02:15:18 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/27/2013 01:37:03 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Support\Tools\MAS2.exe
Error: (12/27/2013 01:37:02 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Core\ModMgr.exe
Error: (12/27/2013 11:03:04 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 08:08:56 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Support\Tools\MAS2.exe
Error: (12/26/2013 08:08:55 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Core\ModMgr.exe
Error: (12/26/2013 06:21:46 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 05:01:45 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/26/2013 03:44:38 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2013-07-21 16:53:02.592
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-21 16:53:02.576
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-21 16:53:02.184
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-21 16:53:02.169
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-17 23:00:22.126
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-17 23:00:22.116
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-17 23:00:21.732
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-17 23:00:21.722
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 43%
Total physical RAM: 8131.85 MB
Available physical RAM: 4604.38 MB
Total Pagefile: 16261.88 MB
Available Pagefile: 11714.9 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.66 GB) (Free:47.14 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 0FB3C24D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.12.27.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 test :: MIKE-PC [limitiert] 27.12.2013 15:20:52 MBAM-log-2013-12-27 (17-39-15).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 657601 Laufzeit: 2 Stunde(n), 5 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 1 HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0R0DtO0U1C1S1U1StR0J1Q2P1J1K1I2R -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 5 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=hp&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Bar (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|SearchAssistant (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 6 C:\Users\test\AppData\Local\Temp\58hzMFNi.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt. C:\Users\test\AppData\Local\Temp\AgBF3Zr1.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt. C:\Users\test\AppData\Local\Temp\DHIPdIaj.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt. C:\Users\test\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih.exe (Trojan.Repacked) -> Keine Aktion durchgeführt. C:\Users\test\AppData\Local\Temp\qWurm_Tk.exe.part (PUP.Optional.InstalleRex) -> Keine Aktion durchgeführt. C:\Users\test\Downloads\pantsoff.exe (PUP.PSWTool.Finder) -> Keine Aktion durchgeführt. (Ende) Mit freundlichen Grüßen Mike |
|
29.12.2013, 11:25
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Bit Coin Miner "Befall" MBAM die Funde auch löschen lassen. Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.12.2013, 11:53
| #5 |
| | Windows 7: Bit Coin Miner "Befall" MBAM Quarantäne gesäubert. Code:
ATTFilter # AdwCleaner v3.016 - Bericht erstellt am 29/12/2013 um 11:38:03
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : test - MIKE-PC
# Gestartet von : C:\Users\test\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\test\AppData\Local\Temp\OCS
Datei Gelöscht : C:\Windows\System32\Tasks\SpyHunter4Startup
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{50F7F0BE-31BA-4145-BD8B-6B0DECFED804}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\Softonic
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\prefs.js ]
Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&installDate={installDate}&q=");
*************************
AdwCleaner[R0].txt - [2895 octets] - [29/12/2013 11:37:14]
AdwCleaner[S0].txt - [2222 octets] - [29/12/2013 11:38:03]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2282 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by test on 29.12.2013 at 11:42:10,88
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\test\AppData\Roaming\mozilla\firefox\profiles\bnbt9bpx.default\minidumps [128 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.12.2013 at 11:45:27,27
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-12-2013
Ran by test (administrator) on MIKE-PC on 29-12-2013 11:46:42
Running from C:\Users\test\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe
() C:\Windows\SysWOW64\ASGT.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
() C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe
(ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
() C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation)
HKLM-x32\...\Run: [GamingKeyboard] - C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [HP Officejet 6600 (NET)] - C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.)
HKCU\...\Run: [OscarEditor] - C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe [3333632 2012-08-16] ()
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKCU\...\RunOnce: [Temp] - C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\system.vbs [2149 2013-12-27] ()
MountPoints2: {27be5a93-ee35-11e2-b16b-806e6f6e6963} - D:\Bin\ASSETUP.exe
Startup: C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFE6EA923CC82CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: WOT - {9E571C81-21E7-496B-9E6B-127E60263022} - C:\Users\test\AppData\LocalLow\WOT\IE\WOT.dll (WOT Services Oy)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default
FF NewTab: about:blank
FF Homepage: google.de
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*'))%20%7B%20return%20'PROXY%20nq-us10.personalitycores.com%3A8000%3B%20PROXY%20nq-us12.personalitycores.com%3A8000%3B%20PROXY%20nq-us08.personalitycores.com%3A8000%3B%20PROXY%20nq-us11.personalitycores.com%3A8000%3B%20PROXY%20nq-us09.personalitycores.com%3A8000%3B%20PROXY%20nq-us07.personalitycores.com%3A8000%3B%20PROXY%20nq-us04.personalitycores.com%3A8000%3B%20PROXY%20nq-us05.personalitycores.com%3A8000%3B%20PROXY%20nq-us06.personalitycores.com%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=1.6.0_45 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxMate - Proxy on steroids! - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi
FF Extension: Adblock Plus - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [927232 2012-10-29] ()
R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] ()
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-01-23] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-09-30] ()
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.)
S3 SystemExplorerHelpService; C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe [821720 2012-11-25] (Mister Group)
R2 WOTUpdater; C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] ()
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-29] (Disc Soft Ltd)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S3 FanatecWheelFilterUsb; C:\Windows\System32\DRIVERS\FWFilterUsb.sys [64688 2013-02-15] (Windows (R) Codename Longhorn DDK provider)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation)
R3 IOMap; C:\Windows\system32\drivers\IOMap64.sys [24824 2013-02-19] (ASUSTeK Computer Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
S3 PorscheWheelFilterUsb; C:\Windows\System32\DRIVERS\PWFilterUsb.sys [58448 2010-12-15] (Windows (R) Codename Longhorn DDK provider)
S3 vhidmini; C:\Windows\System32\DRIVERS\vjoy.sys [15104 2012-10-15] (Headsoft)
S3 WinRing0_1_2_0; \??\C:\Users\test\AppData\Local\Temp\tmp7712.tmp [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-29 11:46 - 2013-12-29 11:46 - 00017123 _____ C:\Users\test\Desktop\FRST.txt
2013-12-29 11:46 - 2013-12-29 11:46 - 00000000 ____D C:\Users\test\Desktop\FRST-OlderVersion
2013-12-29 11:45 - 2013-12-29 11:45 - 00000756 _____ C:\Users\test\Desktop\JRT.txt
2013-12-29 11:42 - 2013-12-29 11:42 - 00000000 ____D C:\Windows\ERUNT
2013-12-29 11:39 - 2013-02-19 18:02 - 00024824 _____ (ASUSTeK Computer Inc.) C:\Windows\system32\Drivers\IOMap64.sys
2013-12-29 11:38 - 2013-12-29 11:38 - 00002370 _____ C:\Users\test\Desktop\AdwCleaner[S0].txt
2013-12-29 11:37 - 2013-12-29 11:40 - 00000000 ____D C:\AdwCleaner
2013-12-29 11:34 - 2013-12-29 11:35 - 01034531 _____ (Thisisu) C:\Users\test\Desktop\JRT.exe
2013-12-29 11:33 - 2013-12-29 11:33 - 01233962 _____ C:\Users\test\Desktop\adwcleaner.exe
2013-12-29 11:26 - 2013-12-29 11:35 - 25267933 _____ C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man.rar
2013-12-27 20:28 - 2013-12-27 20:28 - 00000342 _____ C:\Users\test\Downloads\defogger_enable.log
2013-12-27 16:50 - 2013-12-27 16:54 - 00000000 ____D C:\ProgramData\SystemExplorer
2013-12-27 16:50 - 2013-12-27 16:50 - 00000000 ____D C:\Program Files (x86)\System Explorer
2013-12-27 16:49 - 2013-12-27 16:50 - 01978640 _____ (Mister Group ) C:\Users\test\Downloads\SystemExplorerSetup_450.exe
2013-12-27 16:20 - 2013-12-27 16:20 - 00377856 _____ C:\Users\test\Desktop\gmer_2.1.19163.exe
2013-12-27 16:15 - 2013-12-29 11:46 - 00000000 ____D C:\FRST
2013-12-27 16:14 - 2013-12-29 11:46 - 01931262 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2012-06-22 11:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-12-27 16:06 - 2013-12-27 16:07 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:26 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-27 15:26 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-27 15:07 - 2013-12-27 15:08 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:48 - 2013-12-27 14:50 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-27 11:15 - 2013-12-27 14:03 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:32 - 2013-12-26 22:48 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:51 - 2013-12-25 22:50 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-23 22:40 - 2013-12-26 12:07 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-23 14:55 - 2013-12-23 14:59 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:05 - 2013-12-21 21:06 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:33 - 2013-12-21 14:34 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:32 - 2013-12-21 14:33 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 13:59 - 2013-12-21 14:00 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:37 - 2013-12-20 22:38 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 11:01 - 2013-12-15 14:46 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-12 16:40 - 2013-12-12 16:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-11 22:14 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-11 22:14 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 22:13 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 22:13 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-11 22:13 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 22:13 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-11 22:13 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-11 22:13 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 22:13 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-11 22:13 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-11 22:13 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-11 22:13 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-11 22:13 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 22:13 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 22:13 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-11 22:13 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 11:52 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 11:52 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 11:52 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 11:52 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 11:52 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 11:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 11:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 11:50 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 11:50 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 11:50 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 11:50 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 11:50 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 11:50 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 11:50 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS
2013-12-09 13:45 - 2013-12-19 19:48 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-11-30 23:52 - 2013-09-25 11:42 - 00033720 _____ C:\Users\test\Documents\turbo_int.ogg
2013-11-29 18:36 - 2013-12-15 00:05 - 00000000 ____D C:\Users\test\Documents\SimCity 4
2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat
2013-11-29 18:31 - 2013-11-29 18:32 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite
2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-11-29 18:30 - 2013-11-29 18:32 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
==================== One Month Modified Files and Folders =======
2013-12-29 11:46 - 2013-12-29 11:46 - 00017123 _____ C:\Users\test\Desktop\FRST.txt
2013-12-29 11:46 - 2013-12-29 11:46 - 00000000 ____D C:\Users\test\Desktop\FRST-OlderVersion
2013-12-29 11:46 - 2013-12-27 16:15 - 00000000 ____D C:\FRST
2013-12-29 11:46 - 2013-12-27 16:14 - 01931262 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-29 11:45 - 2013-12-29 11:45 - 00000756 _____ C:\Users\test\Desktop\JRT.txt
2013-12-29 11:42 - 2013-12-29 11:42 - 00000000 ____D C:\Windows\ERUNT
2013-12-29 11:42 - 2013-07-16 17:37 - 02032431 _____ C:\Windows\WindowsUpdate.log
2013-12-29 11:40 - 2013-12-29 11:37 - 00000000 ____D C:\AdwCleaner
2013-12-29 11:39 - 2009-07-14 05:51 - 00094034 _____ C:\Windows\setupact.log
2013-12-29 11:38 - 2013-12-29 11:38 - 00002370 _____ C:\Users\test\Desktop\AdwCleaner[S0].txt
2013-12-29 11:38 - 2013-07-17 14:53 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-29 11:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-29 11:35 - 2013-12-29 11:34 - 01034531 _____ (Thisisu) C:\Users\test\Desktop\JRT.exe
2013-12-29 11:35 - 2013-12-29 11:26 - 25267933 _____ C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man.rar
2013-12-29 11:33 - 2013-12-29 11:33 - 01233962 _____ C:\Users\test\Desktop\adwcleaner.exe
2013-12-29 11:21 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-29 11:21 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-29 11:18 - 2013-07-17 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-29 00:42 - 2013-10-04 11:23 - 00549188 _____ C:\NPClient.log
2013-12-27 20:28 - 2013-12-27 20:28 - 00000342 _____ C:\Users\test\Downloads\defogger_enable.log
2013-12-27 20:28 - 2013-07-16 17:37 - 00000000 ____D C:\Users\test
2013-12-27 19:49 - 2013-10-19 10:55 - 00000000 ____D C:\Program Files (x86)\MSI Afterburner
2013-12-27 17:41 - 2010-11-21 04:47 - 00116168 _____ C:\Windows\PFRO.log
2013-12-27 16:54 - 2013-12-27 16:50 - 00000000 ____D C:\ProgramData\SystemExplorer
2013-12-27 16:50 - 2013-12-27 16:50 - 00000000 ____D C:\Program Files (x86)\System Explorer
2013-12-27 16:50 - 2013-12-27 16:49 - 01978640 _____ (Mister Group ) C:\Users\test\Downloads\SystemExplorerSetup_450.exe
2013-12-27 16:20 - 2013-12-27 16:20 - 00377856 _____ C:\Users\test\Desktop\gmer_2.1.19163.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2013-12-27 16:06 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:43 - 2013-07-17 15:05 - 00000000 ____D C:\Games
2013-12-27 15:31 - 2013-07-17 15:05 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA
2013-12-27 15:30 - 2013-11-13 23:33 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA Corporation
2013-12-27 15:30 - 2013-07-17 14:52 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-12-27 15:07 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:08 - 2013-12-27 14:50 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:50 - 2013-12-27 14:48 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 14:33 - 2013-07-16 17:37 - 00000000 ___RD C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 14:33 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-27 14:32 - 2013-10-29 14:17 - 00000022 _____ C:\Windows\GPU-Z.INI
2013-12-27 14:03 - 2013-12-27 11:15 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-27 13:16 - 2013-07-17 15:06 - 00000000 ____D C:\Users\test\Documents\Euro Truck Simulator 2
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-27 13:05 - 2013-11-09 11:45 - 00000000 ____D C:\Users\test\AppData\Roaming\vlc
2013-12-27 12:57 - 2013-07-17 14:49 - 00000000 ____D C:\Program Files (x86)\Origin
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:48 - 2013-12-26 22:32 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-26 12:12 - 2013-11-06 23:13 - 00000000 ____D C:\Users\test\.gimp-2.8
2013-12-26 12:07 - 2013-12-23 22:40 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:50 - 2013-12-25 22:51 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 22:58 - 2011-04-12 08:43 - 00697658 _____ C:\Windows\system32\perfh007.dat
2013-12-24 22:58 - 2011-04-12 08:43 - 00148452 _____ C:\Windows\system32\perfc007.dat
2013-12-24 22:58 - 2009-07-14 06:13 - 01615906 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-24 00:30 - 2013-07-17 16:57 - 00000000 ____D C:\Users\test\AppData\Roaming\uTorrent
2013-12-23 23:41 - 2013-07-18 16:57 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-12-23 23:41 - 2013-07-18 14:39 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-12-23 23:41 - 2013-07-18 14:39 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-12-23 22:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-23 14:59 - 2013-12-23 14:55 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-23 11:21 - 2013-07-17 14:51 - 00000000 ____D C:\Users\test\AppData\Roaming\Origin
2013-12-23 11:21 - 2013-07-17 14:49 - 00000000 ____D C:\ProgramData\Origin
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:06 - 2013-12-21 21:05 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:58 - 2013-11-10 10:54 - 00000000 ____D C:\Users\test\AppData\Local\CrashDumps
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:19 - 2013-11-09 11:56 - 00000000 ____D C:\Users\test\AppData\Roaming\Audacity
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:34 - 2013-12-21 14:33 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:33 - 2013-12-21 14:32 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 14:00 - 2013-12-21 13:59 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:38 - 2013-12-20 22:37 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 20:01 - 2013-07-17 09:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-19 19:48 - 2013-12-09 13:45 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-12-17 14:33 - 2013-11-20 19:39 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 14:46 - 2013-12-15 11:01 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-15 14:42 - 2013-10-06 16:13 - 00024064 ___SH C:\Users\test\Documents\Thumbs.db
2013-12-15 14:01 - 2013-11-06 23:25 - 00000000 ____D C:\Users\test\AppData\Local\gtk-2.0
2013-12-15 00:54 - 2013-08-19 21:23 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 00:53 - 2013-07-26 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 00:05 - 2013-11-29 18:36 - 00000000 ____D C:\Users\test\Documents\SimCity 4
2013-12-13 20:08 - 2013-07-21 16:02 - 00000000 ____D C:\Users\test\AppData\Roaming\TS3Client
2013-12-13 11:51 - 2013-08-19 09:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-12 19:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-12 16:41 - 2013-12-12 16:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-12 15:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-12 15:47 - 2009-07-14 05:45 - 00274712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-11 16:18 - 2013-07-17 14:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 16:18 - 2013-07-17 14:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 16:18 - 2013-07-17 14:35 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-10 03:13 - 2013-10-29 11:49 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2013-12-10 03:13 - 2013-10-29 11:49 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS
2013-12-08 14:58 - 2013-11-09 19:16 - 00000000 ____D C:\Users\test\Documents\Assetto Corsa
2013-12-06 18:40 - 2013-07-22 22:03 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-05 09:42 - 2013-12-27 15:26 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-05 09:42 - 2013-12-27 15:26 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-05 09:42 - 2013-07-31 10:53 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-12-02 14:51 - 2013-07-17 23:27 - 00000000 ____D C:\Windows\Minidump
2013-12-02 14:50 - 2013-07-17 23:26 - 632873085 _____ C:\Windows\MEMORY.DMP
2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat
2013-11-29 18:32 - 2013-11-29 18:31 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite
2013-11-29 18:32 - 2013-11-29 18:30 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
Files to move or delete:
====================
C:\Users\test\Game.dll
Some content of TEMP:
====================
C:\Users\test\AppData\Local\Temp\AutoRun.exe
C:\Users\test\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\test\AppData\Local\Temp\avgnt.exe
C:\Users\test\AppData\Local\Temp\bdfilters.dll
C:\Users\test\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\test\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\test\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\test\AppData\Local\Temp\nvStInst.exe
C:\Users\test\AppData\Local\Temp\Quarantine.exe
C:\Users\test\AppData\Local\Temp\setup.exe
C:\Users\test\AppData\Local\Temp\SHSetup.exe
C:\Users\test\AppData\Local\Temp\sonarinst.exe
C:\Users\test\AppData\Local\Temp\SRLDetectionLibrary5003431084714088478.dll
C:\Users\test\AppData\Local\Temp\_is7D5A.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-21 10:47
==================== End Of Log ============================
|
|
30.12.2013, 10:36
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Bit Coin Miner "Befall"ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows 7: Bit Coin Miner "Befall" |
|
30.12.2013, 15:54
| #7 |
| | Windows 7: Bit Coin Miner "Befall" Um ehrlich zu sein,habe ich mir gestern einige Posts zum selben Thema durchgelesen,und aufgrund einiger Lösungsvorschläge mal selbst Hand anzulegen.Bei mir wars in der Tat einer von zwei dllhost´s,die nicht im Windows32 Ordner lag,sondern im Temp.Den fälschlichen Dienst habe ich gestoppt,und den kompletten Inhalt aus dem Temp Ordner gelöscht.Und siehe da,selbst nach Neustarts bleibt die Auslastung der Graka so wie sie sein sollte.Hab ich nun den Virus komplett entfernt oder sind da noch Reste wie Registryeinträge o.ä.? Für alle Fälle: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=607d8f7097ce614e83aae8351f9ac2be
# engine=16442
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-30 11:36:57
# local_time=2013-12-30 12:36:57 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 10569 5163099 3355 0
# compatibility_mode=5893 16776574 100 94 3531378 140033267 0 0
# scanned=476177
# found=0
# cleaned=0
# scan_time=6094
Code:
ATTFilter Results of screen317's Security Check version 0.99.77 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java(TM) 6 Update 34 Java 7 Update 45 Adobe Flash Player 11.9.900.170 Adobe Reader XI Mozilla Firefox (26.0) ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-12-2013 01
Ran by test (administrator) on MIKE-PC on 30-12-2013 13:29:53
Running from C:\Users\test\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe
() C:\Windows\SysWOW64\ASGT.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps64.dat
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation)
HKLM-x32\...\Run: [GamingKeyboard] - C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [HP Officejet 6600 (NET)] - C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.)
HKCU\...\Run: [OscarEditor] - C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe [3333632 2012-08-16] ()
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
MountPoints2: {27be5a93-ee35-11e2-b16b-806e6f6e6963} - D:\Bin\ASSETUP.exe
Startup: C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFE6EA923CC82CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: WOT - {9E571C81-21E7-496B-9E6B-127E60263022} - C:\Users\test\AppData\LocalLow\WOT\IE\WOT.dll (WOT Services Oy)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default
FF NewTab: about:blank
FF Homepage: google.de
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*'))%20%7B%20return%20'PROXY%20nq-us07.personalitycores.com%3A8000%3B%20PROXY%20nq-us11.personalitycores.com%3A8000%3B%20PROXY%20nq-us04.personalitycores.com%3A8000%3B%20PROXY%20nq-us08.personalitycores.com%3A8000%3B%20PROXY%20nq-us09.personalitycores.com%3A8000%3B%20PROXY%20nq-us10.personalitycores.com%3A8000%3B%20PROXY%20nq-us05.personalitycores.com%3A8000%3B%20PROXY%20nq-us12.personalitycores.com%3A8000%3B%20PROXY%20nq-us06.personalitycores.com%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "ftp", "81.201.57.65"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "81.201.57.65"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "81.201.57.65"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "81.201.57.65"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=1.6.0_45 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxMate - Proxy on steroids! - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi
FF Extension: Stealthy - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\stealthyextension@gmail.com.xpi
FF Extension: Adblock Plus - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [927232 2012-10-29] ()
R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] ()
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-01-23] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-09-30] ()
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.)
S3 SystemExplorerHelpService; C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe [821720 2012-11-25] (Mister Group)
R2 WOTUpdater; C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] ()
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-29] (Disc Soft Ltd)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S3 FanatecWheelFilterUsb; C:\Windows\System32\DRIVERS\FWFilterUsb.sys [64688 2013-02-15] (Windows (R) Codename Longhorn DDK provider)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
R3 PorscheWheelFilterUsb; C:\Windows\System32\DRIVERS\PWFilterUsb.sys [58448 2010-12-15] (Windows (R) Codename Longhorn DDK provider)
S3 vhidmini; C:\Windows\System32\DRIVERS\vjoy.sys [15104 2012-10-15] (Headsoft)
R4 IOMap; \??\C:\Windows\system32\drivers\IOMap64.sys [x]
S3 WinRing0_1_2_0; \??\C:\Users\test\AppData\Local\Temp\tmp7712.tmp [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-30 13:29 - 2013-12-30 13:29 - 00017639 _____ C:\Users\test\Desktop\FRST.txt
2013-12-30 13:29 - 2013-12-30 13:29 - 00000000 ____D C:\Users\test\Desktop\FRST-OlderVersion
2013-12-30 12:50 - 2013-12-30 12:50 - 00000863 _____ C:\Users\test\Desktop\checkup.txt
2013-12-30 12:50 - 2013-12-30 12:45 - 00002588 _____ C:\Users\test\Desktop\config.cfg
2013-12-30 10:53 - 2013-12-30 10:53 - 00891200 _____ C:\Users\test\Desktop\SecurityCheck.exe
2013-12-30 10:50 - 2013-12-30 10:50 - 02347384 _____ (ESET) C:\Users\test\Downloads\esetsmartinstaller_enu.exe
2013-12-29 22:34 - 2013-12-29 22:34 - 00000000 ____D C:\Users\test\Downloads\HUNGARY_MAP_by_FRANK007_v0.9_2-ets2downloads.com
2013-12-29 22:31 - 2013-12-29 22:31 - 163243289 _____ C:\Users\test\Downloads\HUNGARY_MAP_by_FRANK007_v0.9_2-ets2downloads.com.rar
2013-12-29 19:20 - 2013-12-29 19:20 - 00000000 ____D C:\Users\test\Downloads\MAN_TGA
2013-12-29 18:50 - 2013-12-29 18:57 - 50659460 _____ C:\Users\test\Downloads\MAN_TGA.rar
2013-12-29 17:25 - 2013-12-29 17:25 - 00003992 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-29 17:17 - 2013-12-29 17:17 - 00000000 _____ C:\Users\test\Downloads\map.txt
2013-12-29 17:16 - 2013-12-29 17:16 - 00001657 _____ C:\Users\test\Downloads\001.pmd
2013-12-29 17:16 - 2013-12-29 17:16 - 00000843 _____ C:\Users\test\Downloads\001.txt
2013-12-29 17:16 - 2013-03-29 15:59 - 00004804 _____ C:\Users\test\Desktop\truck.pmc
2013-12-29 17:16 - 2013-03-29 15:59 - 00001657 _____ C:\Users\test\Desktop\truck.pmd
2013-12-29 17:15 - 2013-12-29 17:15 - 00807424 _____ C:\Users\test\Downloads\etsedit.exe
2013-12-29 17:15 - 2013-03-29 15:59 - 09671020 _____ C:\Users\test\Desktop\truck.pmg
2013-12-29 15:14 - 2013-12-29 15:14 - 00000673 _____ C:\Users\test\Mike - Verknüpfung.lnk
2013-12-29 11:55 - 2013-12-29 11:55 - 05216475 _____ C:\Users\test\Desktop\Man open pipe sound Kriechbaum.scs
2013-12-29 11:54 - 2013-12-29 12:30 - 00000000 ____D C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man
2013-12-29 11:42 - 2013-12-29 11:42 - 00000000 ____D C:\Windows\ERUNT
2013-12-29 11:37 - 2013-12-29 11:40 - 00000000 ____D C:\AdwCleaner
2013-12-29 11:34 - 2013-12-29 11:35 - 01034531 _____ (Thisisu) C:\Users\test\Desktop\JRT.exe
2013-12-29 11:33 - 2013-12-29 11:33 - 01233962 _____ C:\Users\test\Desktop\adwcleaner.exe
2013-12-29 11:26 - 2013-12-29 11:35 - 25267933 _____ C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man.rar
2013-12-27 20:28 - 2013-12-27 20:28 - 00000342 _____ C:\Users\test\Downloads\defogger_enable.log
2013-12-27 16:50 - 2013-12-27 16:54 - 00000000 ____D C:\ProgramData\SystemExplorer
2013-12-27 16:50 - 2013-12-27 16:50 - 00000000 ____D C:\Program Files (x86)\System Explorer
2013-12-27 16:49 - 2013-12-27 16:50 - 01978640 _____ (Mister Group ) C:\Users\test\Downloads\SystemExplorerSetup_450.exe
2013-12-27 16:20 - 2013-12-27 16:20 - 00377856 _____ C:\Users\test\Desktop\gmer_2.1.19163.exe
2013-12-27 16:15 - 2013-12-30 13:29 - 00000000 ____D C:\FRST
2013-12-27 16:14 - 2013-12-30 13:29 - 01931302 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2012-06-22 11:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-12-27 16:06 - 2013-12-27 16:07 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:26 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-27 15:26 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-27 15:07 - 2013-12-27 15:08 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:48 - 2013-12-27 14:50 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-27 11:15 - 2013-12-27 14:03 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:32 - 2013-12-26 22:48 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:51 - 2013-12-25 22:50 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-23 22:40 - 2013-12-26 12:07 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-29 17:26 - 00176297 _____ C:\Users\test\Desktop\MAN TGX Sunshield test.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:55 - 2013-12-23 14:59 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:05 - 2013-12-21 21:06 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:33 - 2013-12-21 14:34 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:32 - 2013-12-21 14:33 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 13:59 - 2013-12-21 14:00 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:37 - 2013-12-20 22:38 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 11:01 - 2013-12-15 14:46 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-12 16:40 - 2013-12-12 16:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-11 22:14 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-11 22:14 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 22:13 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 22:13 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-11 22:13 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 22:13 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-11 22:13 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-11 22:13 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 22:13 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-11 22:13 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-11 22:13 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-11 22:13 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-11 22:13 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 22:13 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 22:13 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-11 22:13 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 11:52 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 11:52 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 11:52 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 11:52 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 11:52 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 11:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 11:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 11:50 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 11:50 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 11:50 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 11:50 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 11:50 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 11:50 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 11:50 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent
2013-12-09 13:45 - 2013-12-19 19:48 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-11-30 23:52 - 2013-09-25 11:42 - 00033720 _____ C:\Users\test\Documents\turbo_int.ogg
==================== One Month Modified Files and Folders =======
2013-12-30 13:30 - 2013-12-30 13:29 - 00017639 _____ C:\Users\test\Desktop\FRST.txt
2013-12-30 13:29 - 2013-12-30 13:29 - 00000000 ____D C:\Users\test\Desktop\FRST-OlderVersion
2013-12-30 13:29 - 2013-12-27 16:15 - 00000000 ____D C:\FRST
2013-12-30 13:29 - 2013-12-27 16:14 - 01931302 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-30 13:18 - 2013-07-17 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-30 13:06 - 2013-10-04 11:23 - 00571011 _____ C:\NPClient.log
2013-12-30 13:06 - 2013-07-17 15:06 - 00000000 ____D C:\Users\test\Documents\Euro Truck Simulator 2
2013-12-30 12:50 - 2013-12-30 12:50 - 00000863 _____ C:\Users\test\Desktop\checkup.txt
2013-12-30 12:45 - 2013-12-30 12:50 - 00002588 _____ C:\Users\test\Desktop\config.cfg
2013-12-30 12:33 - 2013-07-16 17:37 - 02079079 _____ C:\Windows\WindowsUpdate.log
2013-12-30 11:35 - 2013-11-10 10:54 - 00000000 ____D C:\Users\test\AppData\Local\CrashDumps
2013-12-30 10:53 - 2013-12-30 10:53 - 00891200 _____ C:\Users\test\Desktop\SecurityCheck.exe
2013-12-30 10:50 - 2013-12-30 10:50 - 02347384 _____ (ESET) C:\Users\test\Downloads\esetsmartinstaller_enu.exe
2013-12-30 10:43 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-30 10:43 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-30 10:35 - 2013-07-17 14:53 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-30 10:35 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-30 10:35 - 2009-07-14 05:51 - 00094706 _____ C:\Windows\setupact.log
2013-12-29 22:34 - 2013-12-29 22:34 - 00000000 ____D C:\Users\test\Downloads\HUNGARY_MAP_by_FRANK007_v0.9_2-ets2downloads.com
2013-12-29 22:31 - 2013-12-29 22:31 - 163243289 _____ C:\Users\test\Downloads\HUNGARY_MAP_by_FRANK007_v0.9_2-ets2downloads.com.rar
2013-12-29 22:19 - 2013-07-17 16:57 - 00000000 ____D C:\Users\test\AppData\Roaming\uTorrent
2013-12-29 19:20 - 2013-12-29 19:20 - 00000000 ____D C:\Users\test\Downloads\MAN_TGA
2013-12-29 18:57 - 2013-12-29 18:50 - 50659460 _____ C:\Users\test\Downloads\MAN_TGA.rar
2013-12-29 18:48 - 2013-12-29 15:06 - 00000000 ____D C:\Users\test\Downloads\NASCAR.The.Game.2013.Update.2-SKIDROW
2013-12-29 17:26 - 2013-12-23 15:02 - 00176297 _____ C:\Users\test\Desktop\MAN TGX Sunshield test.scs
2013-12-29 17:25 - 2013-12-29 17:25 - 00003992 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-29 17:25 - 2013-11-06 23:13 - 00000000 ____D C:\Users\test\.gimp-2.8
2013-12-29 17:24 - 2013-11-06 23:25 - 00000000 ____D C:\Users\test\AppData\Local\gtk-2.0
2013-12-29 17:17 - 2013-12-29 17:17 - 00000000 _____ C:\Users\test\Downloads\map.txt
2013-12-29 17:16 - 2013-12-29 17:16 - 00001657 _____ C:\Users\test\Downloads\001.pmd
2013-12-29 17:16 - 2013-12-29 17:16 - 00000843 _____ C:\Users\test\Downloads\001.txt
2013-12-29 17:15 - 2013-12-29 17:15 - 00807424 _____ C:\Users\test\Downloads\etsedit.exe
2013-12-29 15:34 - 2013-07-18 16:57 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-12-29 15:34 - 2013-07-18 14:39 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-12-29 15:33 - 2013-07-18 14:39 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-12-29 15:30 - 2013-07-17 14:49 - 00000000 ____D C:\Program Files (x86)\Origin
2013-12-29 15:19 - 2013-07-19 18:55 - 00007610 _____ C:\Users\test\AppData\Local\Resmon.ResmonCfg
2013-12-29 15:14 - 2013-12-29 15:14 - 00000673 _____ C:\Users\test\Mike - Verknüpfung.lnk
2013-12-29 15:14 - 2013-07-16 17:37 - 00000000 ____D C:\Users\test
2013-12-29 12:30 - 2013-12-29 11:54 - 00000000 ____D C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man
2013-12-29 11:56 - 2013-11-09 11:45 - 00000000 ____D C:\Users\test\AppData\Roaming\vlc
2013-12-29 11:55 - 2013-12-29 11:55 - 05216475 _____ C:\Users\test\Desktop\Man open pipe sound Kriechbaum.scs
2013-12-29 11:42 - 2013-12-29 11:42 - 00000000 ____D C:\Windows\ERUNT
2013-12-29 11:40 - 2013-12-29 11:37 - 00000000 ____D C:\AdwCleaner
2013-12-29 11:35 - 2013-12-29 11:34 - 01034531 _____ (Thisisu) C:\Users\test\Desktop\JRT.exe
2013-12-29 11:35 - 2013-12-29 11:26 - 25267933 _____ C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man.rar
2013-12-29 11:33 - 2013-12-29 11:33 - 01233962 _____ C:\Users\test\Desktop\adwcleaner.exe
2013-12-27 20:28 - 2013-12-27 20:28 - 00000342 _____ C:\Users\test\Downloads\defogger_enable.log
2013-12-27 19:49 - 2013-10-19 10:55 - 00000000 ____D C:\Program Files (x86)\MSI Afterburner
2013-12-27 17:41 - 2010-11-21 04:47 - 00116168 _____ C:\Windows\PFRO.log
2013-12-27 16:54 - 2013-12-27 16:50 - 00000000 ____D C:\ProgramData\SystemExplorer
2013-12-27 16:50 - 2013-12-27 16:50 - 00000000 ____D C:\Program Files (x86)\System Explorer
2013-12-27 16:50 - 2013-12-27 16:49 - 01978640 _____ (Mister Group ) C:\Users\test\Downloads\SystemExplorerSetup_450.exe
2013-12-27 16:20 - 2013-12-27 16:20 - 00377856 _____ C:\Users\test\Desktop\gmer_2.1.19163.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2013-12-27 16:06 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:43 - 2013-07-17 15:05 - 00000000 ____D C:\Games
2013-12-27 15:31 - 2013-07-17 15:05 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA
2013-12-27 15:30 - 2013-11-13 23:33 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA Corporation
2013-12-27 15:30 - 2013-07-17 14:52 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-12-27 15:07 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:08 - 2013-12-27 14:50 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:50 - 2013-12-27 14:48 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 14:33 - 2013-07-16 17:37 - 00000000 ___RD C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 14:33 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-27 14:32 - 2013-10-29 14:17 - 00000022 _____ C:\Windows\GPU-Z.INI
2013-12-27 14:03 - 2013-12-27 11:15 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:48 - 2013-12-26 22:32 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-26 12:07 - 2013-12-23 22:40 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:50 - 2013-12-25 22:51 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 22:58 - 2011-04-12 08:43 - 00697658 _____ C:\Windows\system32\perfh007.dat
2013-12-24 22:58 - 2011-04-12 08:43 - 00148452 _____ C:\Windows\system32\perfc007.dat
2013-12-24 22:58 - 2009-07-14 06:13 - 01615906 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-23 22:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:59 - 2013-12-23 14:55 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-23 11:21 - 2013-07-17 14:51 - 00000000 ____D C:\Users\test\AppData\Roaming\Origin
2013-12-23 11:21 - 2013-07-17 14:49 - 00000000 ____D C:\ProgramData\Origin
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:06 - 2013-12-21 21:05 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:19 - 2013-11-09 11:56 - 00000000 ____D C:\Users\test\AppData\Roaming\Audacity
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:34 - 2013-12-21 14:33 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:33 - 2013-12-21 14:32 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 14:00 - 2013-12-21 13:59 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:38 - 2013-12-20 22:37 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 20:01 - 2013-07-17 09:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-19 19:48 - 2013-12-09 13:45 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-12-17 14:33 - 2013-11-20 19:39 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 14:46 - 2013-12-15 11:01 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-15 14:42 - 2013-10-06 16:13 - 00024064 ___SH C:\Users\test\Documents\Thumbs.db
2013-12-15 00:54 - 2013-08-19 21:23 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 00:53 - 2013-07-26 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 00:05 - 2013-11-29 18:36 - 00000000 ____D C:\Users\test\Documents\SimCity 4
2013-12-13 20:08 - 2013-07-21 16:02 - 00000000 ____D C:\Users\test\AppData\Roaming\TS3Client
2013-12-13 11:51 - 2013-08-19 09:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-12 19:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-12 16:41 - 2013-12-12 16:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-12 15:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-12 15:47 - 2009-07-14 05:45 - 00274712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-11 16:18 - 2013-07-17 14:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 16:18 - 2013-07-17 14:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 16:18 - 2013-07-17 14:35 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-10 03:13 - 2013-10-29 11:49 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2013-12-10 03:13 - 2013-10-29 11:49 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent
2013-12-08 14:58 - 2013-11-09 19:16 - 00000000 ____D C:\Users\test\Documents\Assetto Corsa
2013-12-06 18:40 - 2013-07-22 22:03 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-05 09:42 - 2013-12-27 15:26 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-05 09:42 - 2013-12-27 15:26 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-05 09:42 - 2013-07-31 10:53 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-12-02 14:51 - 2013-07-17 23:27 - 00000000 ____D C:\Windows\Minidump
2013-12-02 14:50 - 2013-07-17 23:26 - 632873085 _____ C:\Windows\MEMORY.DMP
Files to move or delete:
====================
C:\Users\test\Game.dll
Some content of TEMP:
====================
C:\Users\test\AppData\Local\Temp\AutoRun.exe
C:\Users\test\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\test\AppData\Local\Temp\avgnt.exe
C:\Users\test\AppData\Local\Temp\bdfilters.dll
C:\Users\test\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\test\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\test\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\test\AppData\Local\Temp\nvStInst.exe
C:\Users\test\AppData\Local\Temp\Quarantine.exe
C:\Users\test\AppData\Local\Temp\setup.exe
C:\Users\test\AppData\Local\Temp\SHSetup.exe
C:\Users\test\AppData\Local\Temp\sonarinst.exe
C:\Users\test\AppData\Local\Temp\SRLDetectionLibrary5003431084714088478.dll
C:\Users\test\AppData\Local\Temp\_is7D5A.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-30 13:24
==================== End Of Log ============================
--- --- --- Geändert von IMrIMike (30.12.2013 um 15:59 Uhr) |
|
31.12.2013, 14:48
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Bit Coin Miner "Befall" Das Problem mit der dllhost in temp kenne ich, wäre der letzte Schritt gewesen. Aber zuerst wurde mal die offensichtliche Malware weg geputzt Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
C:\Program Files\Enigma Software Group
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.12.2013, 15:22
| #9 |
| | Windows 7: Bit Coin Miner "Befall"Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-12-2013 01
Ran by test at 2013-12-31 15:17:06 Run:1
Running from C:\Users\test\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
C:\Program Files\Enigma Software Group
*****************
esgiguard => Service deleted successfully.
EsgScanner => Service deleted successfully.
C:\Program Files\Enigma Software Group => Moved successfully.
==== End of Fixlog ====
|
|
01.01.2014, 13:15
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Bit Coin Miner "Befall" Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: Bit Coin Miner "Befall" |
| adblock, auslastung, beim starten, bitcoin, desktop, dllhost.exe, esgscanner.sys, grafikkarte, irgendetwas, launch, morgen, newtab, officejet, plug-in, prozesse, pup.optional.installcore.a, pup.optional.installerex, pup.optional.installex, pup.optional.snapdo, pup.pswtool.finder, richtlinie, ruckel, system, trennen, trojan.repacked, verbindung, verschieben, windows, windows 7 |
Linear-Darstellung
