![]() |
|
Log-Analyse und Auswertung: Windows 7: Bildschirm flackert spontanWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
![]() | ![]() Windows 7: Bildschirm flackert spontan Hallo Allerseits, ich habe seit geraumer Zeit das Problem, das der Bildschirm anfängt kurz ein Schwarzbild zuzeigen und dann wieder ganz normal läuft. Der Bildschirm ist ok und die Grafikkarte ist neu. Daraufhin habe ich einen Malwarescan mit Malwarebytes Anti-Malware durchgeführt und er zeigte mir 9 Fehler in der Registry (hkey_local_machine). Diese habe ich dann beheben lassen. Leider tauchen solche Fehler immer wieder bei mir auf. Also kann dem entsprechend ja irgendwas nicht stimmen. Ich weiß nicht ob davon auch der Grafikfehler kommt, aber auf jedenfall stimmt etwas mit dem Rechner nicht. - Updates werden immer durchgeführt (Rechner auf dem neusten Stand) - Die alten Logdaten habe ich leider nicht mehr ! :-( Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-01-2014 02 Ran by Sebastian (administrator) on SEBASTIAN-PC on 28-01-2014 13:20:49 Running from C:\Users\Sebastian\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe () C:\Windows\SysWOW64\ASGT.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Service.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-Network.exe (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) B:\Programme\EvernoteClipper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Abelssoft) C:\Program Files (x86)\CheckDrive\CheckDriveBackgroundGuard.exe () C:\Program Files (x86)\ASRock Utility\AXTU\Bin\AsrXTU.exe () C:\Program Files\ASRock Utility\XFast RAM\asrRd.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor) HKLM\...\Run: [THXCfg64] - C:\Windows\system32\THXCfg64.dll [26624 2011-05-13] (Creative Technology Ltd.) HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation) HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2012-05-30] (Intel Corporation) HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation) HKLM-x32\...\Run: [THX TruStudio NB Settings] - C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe [909824 2011-05-19] (Creative Technology Ltd) HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.) HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.) HKLM-x32\...\Run: [GrooveMonitor] - B:\Microsoft Office 2007\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [BlueStacks Agent] - C:\Program Files (x86)\BlueStacks\HD-Agent.exe [606024 2013-09-19] (BlueStack Systems, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKCU\...\Run: [ASRockXTU] - [x] HKCU\...\Run: [zASRockInstantBoot] - [x] HKCU\...\Run: [AdobeBridge] - [x] MountPoints2: {14dce171-e1cf-11e2-ae6b-806e6f6e6963} - D:\ASRSetup.exe MountPoints2: {3d154eef-e1ab-11e2-a31c-bc5ff4691d2b} - E:\pushinst.exe MountPoints2: {920196ce-e1a4-11e2-a329-806e6f6e6963} - D:\cdstart.exe AppInit_DLLs: C:\Windows\system32\appinit_dll.dll,C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-19] (NVIDIA Corporation) Startup: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk ShortcutTarget: EvernoteClipper.lnk -> B:\Programme\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x07495907BB75CE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=ASRK SearchScopes: HKCU - {2431F91C-97E3-459e-943C-23D11AA678E2} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5480255188&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms} BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - B:\Microsoft Office 2007\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - B:\Programme\Java\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - B:\Programme\Java\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler-x32: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - B:\Microsoft Office 2007\Office12\GrooveSystemServices.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\q7yju9nt.default FF Homepage: www.google.de FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll () FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - B:\Programme\Java\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - B:\Programme\Java\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - B:\Programme\VLC MediaPLayer\VLC\npvlc.dll (VideoLAN) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Adblock Plus - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\q7yju9nt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-21] ==================== Services (Whitelisted) ================= R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () R2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [393032 2013-09-19] (BlueStack Systems, Inc.) R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384840 2013-09-19] (BlueStack Systems, Inc.) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) S3 Microsoft Office Groove Audit Service; B:\Microsoft Office 2007\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation) R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.) ==================== Drivers (Whitelisted) ==================== R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [31016 2012-01-13] (ASRock Inc.) S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin) R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [70984 2013-09-19] (BlueStack Systems) S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH) S3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] () S3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] () S3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [44992 2012-02-09] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation) R3 AxtuDrv; \??\C:\Windows\SysWOW64\Drivers\AxtuDrv.sys [x] S1 eaqhwqqe; \??\C:\Windows\system32\drivers\eaqhwqqe.sys [x] S1 qbkgeytn; \??\C:\Windows\system32\drivers\qbkgeytn.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-01-28 13:20 - 2014-01-28 13:20 - 00015605 _____ C:\Users\Sebastian\Downloads\FRST.txt 2014-01-28 13:20 - 2014-01-28 13:20 - 00000000 ____D C:\FRST 2014-01-28 13:19 - 2014-01-28 13:20 - 02079232 _____ (Farbar) C:\Users\Sebastian\Downloads\FRST64.exe 2014-01-28 13:10 - 2014-01-28 13:10 - 00011033 _____ C:\Users\Sebastian\Downloads\hijackthis.log 2014-01-28 13:00 - 2014-01-28 13:00 - 00388608 _____ (Trend Micro Inc.) C:\Users\Sebastian\Downloads\HijackThis.exe 2014-01-28 12:57 - 2014-01-28 12:57 - 00602112 _____ (OldTimer Tools) C:\Users\Sebastian\Desktop\OTL.exe 2014-01-28 12:52 - 2014-01-28 12:52 - 03794432 _____ C:\Users\Sebastian\Downloads\RogueKiller(1).exe 2014-01-28 09:39 - 2014-01-28 09:39 - 00017627 _____ C:\Windows\DirectX.log 2014-01-27 23:20 - 2014-01-27 23:20 - 03792384 _____ C:\Users\Sebastian\Downloads\RogueKiller.exe 2014-01-27 23:19 - 2014-01-27 23:24 - 00000000 ____D C:\AdwCleaner 2014-01-27 23:19 - 2014-01-27 23:19 - 01236282 _____ C:\Users\Sebastian\Downloads\adwcleaner.exe 2014-01-27 23:18 - 2014-01-27 23:18 - 00987425 _____ C:\Users\Sebastian\Downloads\SecurityCheck.exe 2014-01-27 19:03 - 2014-01-27 19:03 - 00000212 _____ C:\Users\Sebastian\Desktop\Neverwinter.url 2014-01-27 11:37 - 2014-01-28 12:51 - 00003042 _____ C:\Windows\System32\Tasks\asrRd 2014-01-26 14:44 - 2014-01-28 12:41 - 00002800 _____ C:\Windows\setupact.log 2014-01-26 14:44 - 2014-01-26 14:44 - 00000000 _____ C:\Windows\setuperr.log 2014-01-23 17:59 - 2014-01-23 17:59 - 00000377 _____ C:\Windows\wininit.ini 2014-01-23 14:21 - 2014-01-28 12:44 - 00753951 _____ C:\Windows\WindowsUpdate.log 2014-01-23 12:12 - 2014-01-23 12:12 - 00001131 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-23 12:12 - 2014-01-23 12:12 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Malwarebytes 2014-01-23 12:12 - 2014-01-23 12:12 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-23 12:12 - 2014-01-23 12:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-01-23 12:12 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-01-23 12:11 - 2014-01-23 12:11 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Sebastian\Downloads\mbam-setup-1.75.0.1300.exe 2014-01-23 09:14 - 2014-01-28 09:21 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-01-23 09:14 - 2014-01-23 09:14 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-01-23 09:14 - 2014-01-23 09:14 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-23 09:14 - 2014-01-23 09:14 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-01-23 09:14 - 2014-01-23 09:14 - 00000000 ____D C:\Windows\system32\Macromed 2014-01-23 09:14 - 2014-01-23 09:14 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Macromedia 2014-01-21 23:39 - 2014-01-21 23:39 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Mozilla 2014-01-21 23:39 - 2014-01-21 23:39 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Mozilla 2014-01-21 23:37 - 2014-01-21 23:37 - 00001157 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-01-21 23:37 - 2014-01-21 23:37 - 00000000 ____D C:\ProgramData\Mozilla 2014-01-21 23:37 - 2014-01-21 23:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2014-01-21 23:37 - 2014-01-21 23:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2014-01-21 23:34 - 2014-01-21 23:36 - 23867560 _____ (Mozilla) C:\Users\Sebastian\Downloads\Firefox_Setup_26.0.exe 2014-01-19 12:52 - 2014-01-19 12:52 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\NVIDIA 2014-01-19 12:47 - 2014-01-23 12:40 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\VOPackage 2014-01-19 12:47 - 2014-01-19 12:47 - 00000000 ____D C:\Users\Sebastian\AppData\Local\cache 2014-01-19 12:47 - 2014-01-19 12:47 - 00000000 ____D C:\Users\Sebastian\.android 2014-01-19 12:47 - 2014-01-19 12:47 - 00000000 _____ C:\Users\Sebastian\daemonprocess.txt 2014-01-19 12:36 - 2014-01-19 12:36 - 00001381 _____ C:\Users\Public\Desktop\GeForce Experience.lnk 2014-01-19 12:36 - 2014-01-19 12:36 - 00000000 ____D C:\Users\Sebastian\AppData\Local\NVIDIA Corporation 2014-01-19 12:36 - 2013-12-10 03:15 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2014-01-19 12:36 - 2013-12-10 03:14 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2014-01-19 12:35 - 2014-01-19 12:36 - 00000000 ____D C:\Users\Sebastian\AppData\Local\NVIDIA 2014-01-19 12:35 - 2014-01-19 12:35 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies 2014-01-19 12:34 - 2014-01-19 12:36 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2014-01-19 12:33 - 2014-01-19 12:36 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2014-01-19 12:33 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2014-01-19 12:33 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 02698272 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 01436528 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 01242400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00479520 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00405280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00357152 _____ C:\Windows\system32\NvIFROpenGL.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00317472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00314656 _____ C:\Windows\SysWOW64\NvIFROpenGL.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00266984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2014-01-19 12:33 - 2013-12-19 21:33 - 00141336 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2014-01-19 12:33 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2014-01-19 12:33 - 2013-12-05 09:42 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2014-01-19 12:33 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2014-01-19 12:33 - 2013-11-28 14:38 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2014-01-19 12:33 - 2013-11-28 14:38 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2014-01-19 12:31 - 2014-01-19 12:36 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2014-01-19 12:31 - 2014-01-19 12:31 - 00000000 ____D C:\NVIDIA 2014-01-19 12:26 - 2014-01-28 12:40 - 00000000 ____D C:\ProgramData\NVIDIA 2014-01-19 12:17 - 2013-12-19 19:53 - 06671648 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll 2014-01-19 12:17 - 2013-12-19 19:53 - 03490080 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll 2014-01-19 12:17 - 2013-12-19 19:53 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2014-01-19 12:17 - 2013-12-19 19:53 - 00922912 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe 2014-01-19 12:17 - 2013-12-19 19:53 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll 2014-01-19 12:17 - 2013-12-19 19:53 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2014-01-19 12:17 - 2013-12-19 06:01 - 03539040 _____ C:\Windows\system32\nvcoproc.bin 2014-01-19 10:22 - 2014-01-19 10:27 - 262041840 _____ (NVIDIA Corporation) C:\Users\Sebastian\Downloads\332.21-desktop-win8-win7-winvista-64bit-international-whql.exe 2014-01-19 10:22 - 2014-01-19 10:22 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Driver Cleaner Pro 2014-01-19 10:22 - 2014-01-19 10:22 - 00000000 ____D C:\Program Files (x86)\Driver Cleaner Pro 2014-01-19 10:21 - 2014-01-19 10:21 - 02817354 _____ C:\Users\Sebastian\Downloads\DCProSetup_15.zip 2014-01-19 01:03 - 2014-01-19 01:03 - 00347816 _____ (Microsoft Corporation) C:\Users\Sebastian\Downloads\MicrosoftFixit.Aero.Run.exe 2014-01-18 15:46 - 2014-01-18 15:46 - 00000000 ____D C:\ProgramData\CheckPoint 2014-01-18 15:45 - 2014-01-18 15:45 - 02465360 _____ (Check Point Software Technologies LTD) C:\Users\Sebastian\Downloads\zaSetupWeb_120_104_000.exe 2014-01-15 19:36 - 2014-01-15 19:36 - 00005292 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log 2014-01-15 08:27 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-15 08:27 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-15 08:27 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-15 08:27 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-15 08:27 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-15 08:27 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-15 08:27 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-15 08:27 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-15 08:27 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-12-30 15:49 - 2013-12-30 15:54 - 255488144 _____ (NVIDIA Corporation) C:\Users\Sebastian\Downloads\331.82-desktop-win8-win7-winvista-64bit-international-whql.exe 2013-12-29 12:50 - 2013-12-29 12:50 - 00000000 ____D C:\ProgramData\Package Cache ==================== One Month Modified Files and Folders ======= 2014-01-28 13:20 - 2014-01-28 13:20 - 00015605 _____ C:\Users\Sebastian\Downloads\FRST.txt 2014-01-28 13:20 - 2014-01-28 13:20 - 00000000 ____D C:\FRST 2014-01-28 13:20 - 2014-01-28 13:19 - 02079232 _____ (Farbar) C:\Users\Sebastian\Downloads\FRST64.exe 2014-01-28 13:10 - 2014-01-28 13:10 - 00011033 _____ C:\Users\Sebastian\Downloads\hijackthis.log 2014-01-28 13:08 - 2013-06-30 17:02 - 00000000 ____D C:\Users\Sebastian\AppData\Local\VirtualStore 2014-01-28 13:03 - 2013-06-30 17:13 - 00000830 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job 2014-01-28 13:00 - 2014-01-28 13:00 - 00388608 _____ (Trend Micro Inc.) C:\Users\Sebastian\Downloads\HijackThis.exe 2014-01-28 12:57 - 2014-01-28 12:57 - 00602112 _____ (OldTimer Tools) C:\Users\Sebastian\Desktop\OTL.exe 2014-01-28 12:52 - 2014-01-28 12:52 - 03794432 _____ C:\Users\Sebastian\Downloads\RogueKiller(1).exe 2014-01-28 12:51 - 2014-01-27 11:37 - 00003042 _____ C:\Windows\System32\Tasks\asrRd 2014-01-28 12:51 - 2013-09-20 20:14 - 00000296 _____ C:\Windows\Tasks\CheckDriveBackgroundGuard.job 2014-01-28 12:51 - 2013-07-02 18:29 - 00002976 _____ C:\Windows\System32\Tasks\AsrXTU 2014-01-28 12:51 - 2013-06-30 17:13 - 00000828 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job 2014-01-28 12:48 - 2009-07-14 05:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-01-28 12:48 - 2009-07-14 05:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-01-28 12:47 - 2011-04-12 08:43 - 00699416 _____ C:\Windows\system32\perfh007.dat 2014-01-28 12:47 - 2011-04-12 08:43 - 00149556 _____ C:\Windows\system32\perfc007.dat 2014-01-28 12:47 - 2009-07-14 06:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI 2014-01-28 12:44 - 2014-01-23 14:21 - 00753951 _____ C:\Windows\WindowsUpdate.log 2014-01-28 12:41 - 2014-01-26 14:44 - 00002800 _____ C:\Windows\setupact.log 2014-01-28 12:41 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2014-01-28 12:40 - 2014-01-19 12:26 - 00000000 ____D C:\ProgramData\NVIDIA 2014-01-28 09:39 - 2014-01-28 09:39 - 00017627 _____ C:\Windows\DirectX.log 2014-01-28 09:21 - 2014-01-23 09:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-01-27 23:24 - 2014-01-27 23:19 - 00000000 ____D C:\AdwCleaner 2014-01-27 23:24 - 2013-06-30 17:03 - 00001003 _____ C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-01-27 23:20 - 2014-01-27 23:20 - 03792384 _____ C:\Users\Sebastian\Downloads\RogueKiller.exe 2014-01-27 23:19 - 2014-01-27 23:19 - 01236282 _____ C:\Users\Sebastian\Downloads\adwcleaner.exe 2014-01-27 23:18 - 2014-01-27 23:18 - 00987425 _____ C:\Users\Sebastian\Downloads\SecurityCheck.exe 2014-01-27 22:59 - 2013-07-01 17:47 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Daedalic Entertainment 2014-01-27 22:24 - 2013-08-20 17:37 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\foobar2000 2014-01-27 22:24 - 2013-07-30 18:43 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\.minecraft 2014-01-27 19:03 - 2014-01-27 19:03 - 00000212 _____ C:\Users\Sebastian\Desktop\Neverwinter.url 2014-01-27 00:21 - 2013-06-30 17:16 - 00000000 ____D C:\Program Files (x86)\Adobe 2014-01-27 00:16 - 2013-06-30 17:16 - 00000000 ____D C:\ProgramData\Adobe 2014-01-27 00:14 - 2013-06-30 17:16 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Adobe 2014-01-27 00:12 - 2013-07-05 21:30 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Adobe 2014-01-26 14:44 - 2014-01-26 14:44 - 00000000 _____ C:\Windows\setuperr.log 2014-01-25 08:48 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2014-01-23 17:59 - 2014-01-23 17:59 - 00000377 _____ C:\Windows\wininit.ini 2014-01-23 17:59 - 2013-07-01 14:57 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2014-01-23 16:59 - 2013-07-01 14:57 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-01-23 12:40 - 2014-01-19 12:47 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\VOPackage 2014-01-23 12:12 - 2014-01-23 12:12 - 00001131 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-23 12:12 - 2014-01-23 12:12 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Malwarebytes 2014-01-23 12:12 - 2014-01-23 12:12 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-23 12:12 - 2014-01-23 12:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-01-23 12:11 - 2014-01-23 12:11 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Sebastian\Downloads\mbam-setup-1.75.0.1300.exe 2014-01-23 09:14 - 2014-01-23 09:14 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-01-23 09:14 - 2014-01-23 09:14 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-23 09:14 - 2014-01-23 09:14 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-01-23 09:14 - 2014-01-23 09:14 - 00000000 ____D C:\Windows\system32\Macromed 2014-01-23 09:14 - 2014-01-23 09:14 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Macromedia 2014-01-22 21:23 - 2013-07-04 08:46 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\vlc 2014-01-21 23:39 - 2014-01-21 23:39 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Mozilla 2014-01-21 23:39 - 2014-01-21 23:39 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Mozilla 2014-01-21 23:38 - 2013-06-30 21:06 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Google 2014-01-21 23:38 - 2013-06-30 21:06 - 00000000 ____D C:\Program Files (x86)\Google 2014-01-21 23:37 - 2014-01-21 23:37 - 00001157 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-01-21 23:37 - 2014-01-21 23:37 - 00000000 ____D C:\ProgramData\Mozilla 2014-01-21 23:37 - 2014-01-21 23:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2014-01-21 23:37 - 2014-01-21 23:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2014-01-21 23:36 - 2014-01-21 23:34 - 23867560 _____ (Mozilla) C:\Users\Sebastian\Downloads\Firefox_Setup_26.0.exe 2014-01-19 12:52 - 2014-01-19 12:52 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\NVIDIA 2014-01-19 12:49 - 2013-06-30 17:02 - 00000000 ___RD C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-01-19 12:47 - 2014-01-19 12:47 - 00000000 ____D C:\Users\Sebastian\AppData\Local\cache 2014-01-19 12:47 - 2014-01-19 12:47 - 00000000 ____D C:\Users\Sebastian\.android 2014-01-19 12:47 - 2014-01-19 12:47 - 00000000 _____ C:\Users\Sebastian\daemonprocess.txt 2014-01-19 12:47 - 2013-06-30 17:02 - 00000000 ____D C:\Users\Sebastian 2014-01-19 12:36 - 2014-01-19 12:36 - 00001381 _____ C:\Users\Public\Desktop\GeForce Experience.lnk 2014-01-19 12:36 - 2014-01-19 12:36 - 00000000 ____D C:\Users\Sebastian\AppData\Local\NVIDIA Corporation 2014-01-19 12:36 - 2014-01-19 12:35 - 00000000 ____D C:\Users\Sebastian\AppData\Local\NVIDIA 2014-01-19 12:36 - 2014-01-19 12:34 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2014-01-19 12:36 - 2014-01-19 12:33 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2014-01-19 12:36 - 2014-01-19 12:31 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2014-01-19 12:35 - 2014-01-19 12:35 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies 2014-01-19 12:31 - 2014-01-19 12:31 - 00000000 ____D C:\NVIDIA 2014-01-19 12:17 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help 2014-01-19 10:27 - 2014-01-19 10:22 - 262041840 _____ (NVIDIA Corporation) C:\Users\Sebastian\Downloads\332.21-desktop-win8-win7-winvista-64bit-international-whql.exe 2014-01-19 10:22 - 2014-01-19 10:22 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Driver Cleaner Pro 2014-01-19 10:22 - 2014-01-19 10:22 - 00000000 ____D C:\Program Files (x86)\Driver Cleaner Pro 2014-01-19 10:21 - 2014-01-19 10:21 - 02817354 _____ C:\Users\Sebastian\Downloads\DCProSetup_15.zip 2014-01-19 08:33 - 2010-11-21 04:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-01-19 01:03 - 2014-01-19 01:03 - 00347816 _____ (Microsoft Corporation) C:\Users\Sebastian\Downloads\MicrosoftFixit.Aero.Run.exe 2014-01-18 16:09 - 2013-07-05 21:32 - 00002547 _____ C:\Users\Public\Desktop\Skype.lnk 2014-01-18 16:09 - 2013-07-05 21:32 - 00000000 ____D C:\ProgramData\Skype 2014-01-18 15:46 - 2014-01-18 15:46 - 00000000 ____D C:\ProgramData\CheckPoint 2014-01-18 15:45 - 2014-01-18 15:45 - 02465360 _____ (Check Point Software Technologies LTD) C:\Users\Sebastian\Downloads\zaSetupWeb_120_104_000.exe 2014-01-15 19:48 - 2013-10-21 07:55 - 00000000 ____D C:\ProgramData\Oracle 2014-01-15 19:36 - 2014-01-15 19:36 - 00005292 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log 2014-01-15 18:51 - 2009-07-14 05:45 - 04978136 _____ C:\Windows\system32\FNTCACHE.DAT 2014-01-15 08:56 - 2013-07-01 15:33 - 00000000 ____D C:\ProgramData\Microsoft Help 2014-01-15 08:55 - 2013-07-18 09:42 - 00000000 ____D C:\Windows\system32\MRT 2014-01-15 08:54 - 2013-07-04 08:30 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-12-30 15:54 - 2013-12-30 15:49 - 255488144 _____ (NVIDIA Corporation) C:\Users\Sebastian\Downloads\331.82-desktop-win8-win7-winvista-64bit-international-whql.exe 2013-12-29 12:52 - 2013-07-01 17:55 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Daedalic Entertainment 2013-12-29 12:50 - 2013-12-29 12:50 - 00000000 ____D C:\ProgramData\Package Cache Some content of TEMP: ==================== C:\Users\Sebastian\AppData\Local\Temp\ntdll_dump.dll C:\Users\Sebastian\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-01-19 18:23 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-01-2014 02 Ran by Sebastian at 2014-01-28 13:21:00 Running from C:\Users\Sebastian\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2} ==================== Installed Programs ====================== Acrobat.com (x32 Version: 2.0.0 - Adobe Systems Incorporated) Hidden Acrobat.com (x32 Version: 2.0.0.0 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 3.8.0.1280 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 3.8.0.1280 - Adobe Systems Incorporated) Hidden Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated) Adobe Reader 9 (x32 Version: 9.0.0 - Adobe Systems Incorporated) Alan Wake (x32 Version: - Remedy Entertainment) Arduino (x32 Version: 1.0.5 - Arduino LLC) ASRock App Charger v1.0.5 (Version: - ASRock Inc.) ASRock eXtreme Tuner v0.1.270 (x32 Version: - ) ASRock InstantBoot v1.29 (x32 Version: - ) ASRock SmartConnect v1.0.6 (Version: - ASRock Inc.) ASRock XFast RAM v2.0.9 (Version: - ASRock Inc.) ASUS GPU Tweak (x32 Version: 2.2.8.1 - ASUSTek COMPUTER INC.) ASUS GPU Tweak (x32 Version: 2.2.8.1 - ASUSTek COMPUTER INC.) Hidden ASUS PCE-N15 WLAN Card Utilities & Driver (x32 Version: 1.0.0.8 - ) Audacity 2.0.3 (x32 Version: 2.0.3 - Audacity Team) Big Fish Games Client (x32 Version: 1.2.5.17d - ) BlueStacks App Player (x32 Version: 0.7.18.921 - BlueStack Systems, Inc.) BlueStacks Notification Center (x32 Version: 0.7.18.921 - BlueStack Systems, Inc.) Bonjour (Version: 3.0.0.10 - Apple Inc.) CCleaner (Version: 4.03 - Piriform) CDBurnerXP (x32 Version: 4.5.2.4214 - CDBurnerXP) CheckDrive (x32 Version: 3.0 - Abelssoft) Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) CPUID HWMonitor 1.23 (Version: - ) Craften Terminal 3.3.4897.28268 (x32 Version: 3.3.4897.28268 - Craften Dev Team) Cry of Fear (x32 Version: - Team Psykskallar) Dead Island Riptide (x32 Version: - Techland) Dead Space™ 3 (x32 Version: 1.0.0.0 - Electronic Arts, Inc.) Demo SPS-VISU S5/S7 (32) V2.66 (x32 Version: - ) DH Driver Cleaner Professional Edition (x32 Version: Version 1.5 - Ruud Ketelaars) Diablo III (x32 Version: - Blizzard Entertainment) DMUninstaller (x32 Version: - ) Dolphin (x32 Version: 4.0.1 - Dolphin Development Team) Dolphin x86 (x32 Version: 4.0.1 - Dolphin Development Team) Edna Bricht Aus - Sammler Edition (x32 Version: 1.2 - Daedalic Entertainment) Edna Bricht Aus 1.1 (x32 Version: - ) Elgato Game Capture HD (x32 Version: 1.32.0.415 - Elgato Systems GmbH) eLicenser Control (x32 Version: - Steinberg Media Technologies GmbH) Evernote v. 4.6.7 (x32 Version: 4.6.7.8409 - Evernote Corp.) foobar2000 v1.2.9 (x32 Version: 1.2.9 - Peter Pawlowski) FormatFactory 3.1.1 (x32 Version: 3.1.1 - Free Time) Fraps (remove only) (x32 Version: - ) Game Capture HD v2.3.3.38 (x32 Version: 2.3.3.38 - Elgato Systems) Geeks3D FurMark 1.11.0 (x32 Version: - Geeks3D) GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden Haunted Memories (x32 Version: - MadMan Theory Games) Intel(R) Control Center (x32 Version: 1.2.1.1008 - Intel Corporation) Intel(R) Manageability Engine Firmware Recovery Agent (x32 Version: 1.0.0.36354 - Intel Corporation) Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation) Intel(R) OpenCL CPU Runtime (x32 Version: - Intel Corporation) Intel(R) Processor Graphics (x32 Version: 9.17.10.2932 - Intel Corporation) Intel(R) Rapid Storage Technology (x32 Version: 11.2.0.1006 - Intel Corporation) Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.5.235 - Intel Corporation) Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden Java 7 Update 25 (64-bit) (Version: 7.0.250 - Oracle) Java 7 Update 51 (x32 Version: 7.0.510 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden LAME v3.99.3 (for Windows) (x32 Version: - ) Landwirtschafts Simulator 2013 (x32 Version: 1.0 - GIANTS Software) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation) Megaplex Madness: Now Playing ™ (x32 Version: - ) Metro: Last Light (x32 Version: - 4A Games) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Security Client (Version: 4.4.0304.0 - Microsoft Corporation) Hidden Microsoft Security Essentials (Version: 4.4.304.0 - Microsoft Corporation) Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla) Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation) Neverwinter (x32 Version: - Cryptic Studios) Notepad++ (x32 Version: 6.4.3 - Notepad++ Team) NVIDIA 3D Vision Controller-Treiber 332.21 (Version: 332.21 - NVIDIA Corporation) NVIDIA 3D Vision Treiber 332.21 (Version: 332.21 - NVIDIA Corporation) NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation) NVIDIA Grafiktreiber 332.21 (Version: 332.21 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.3.30.1 (Version: 1.3.30.1 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation) NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3221 - NVIDIA Corporation) Hidden NVIDIA Systemsteuerung 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation) Origin (x32 Version: 9.1.10.2728 - Electronic Arts, Inc.) Project 64 version 2.1.0.1 (x32 Version: 2.1.0.1 - ) Realtek Ethernet Controller Driver (x32 Version: 7.48.823.2011 - Realtek) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6690 - Realtek Semiconductor Corp.) Robin Hood TsoSF (x32 Version: - ) SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden SimCity™ (x32 Version: 1.0.0.0 - Electronic Arts) Skype™ 6.9 (x32 Version: 6.9.106 - Skype Technologies S.A.) Spybot - Search & Destroy (x32 Version: 2.1.19 - Safer-Networking Ltd.) SSD Fresh (x32 Version: 2013 - Abelssoft) Steam (x32 Version: 1.0.0.0 - Valve Corporation) TechPowerUp GPU-Z (x32 Version: - TechPowerUp) The Walking Dead (x32 Version: 1.0.0.15 - Telltale Games) THX TruStudio (x32 Version: 1.00.01 - Creative Technology Limited) Update for 2007 Microsoft Office System (KB967642) (x32 Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (x32 Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (x32 Version: - Microsoft) Update für Microsoft Office Outlook 2007 Help (KB963677) (x32 Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (x32 Version: - Microsoft) VIRTU MVP 2.1.111 (Version: 2.1.111 - Lucidlogix Technologies LTD) VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN) WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0 - win.rar GmbH) WinSPS-S7 v3.45 (x32 Version: - ) ==================== Restore Points ========================= 26-01-2014 23:20:56 Removed Adobe Community Help 28-01-2014 08:39:08 DirectX wurde installiert ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {0607DA09-CBF5-4DE1-A53D-A8ECA882323F} - System32\Tasks\asrRd => C:\Program Files\ASRock Utility\XFast RAM\asrRd.exe [2012-01-13] () Task: {08B532AB-8175-4117-810F-D5669994A7F9} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe Task: {20A72FE6-86AC-4EAC-9EE9-B213F5102CC8} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16] (Intel Corporation) Task: {39B215E4-1F3C-4928-8384-5CACD251FAAD} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {49D8E781-F699-4326-9DF0-8D788E904DD2} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {538103E5-1F67-4A43-9717-F96122687076} - System32\Tasks\{B61A69BE-D836-4A60-9477-0C7923ED4007} => B:\Program Files (x86)\Origin Games\SimCity\SimCity\SimCity.exe [2013-12-24] (Electronic Arts Inc.) Task: {60A83E9D-CBBD-45B7-95E1-3E479D29277D} - System32\Tasks\AsrXTU => C:\Program Files (x86)\ASRock Utility\AXTU\Bin\AsrXTU.exe [2012-08-03] () Task: {725A5C33-F9E3-498F-A083-68C081C9D05A} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe Task: {73852981-AEE4-4CF4-8983-3C24CC67E473} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16] (Intel Corporation) Task: {7A3457E2-7813-4AF2-A9F9-3AE800C00220} - System32\Tasks\CCleanerSkipUAC => B:\Programme\CCleaner\CCleaner.exe [2013-06-19] (Piriform Ltd) Task: {7AEA5361-9DCB-4C00-824F-7B227F46FA1F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-23] (Adobe Systems Incorporated) Task: {856712CF-135F-4145-AE13-2833CD8E6D1A} - System32\Tasks\{EF590E28-4DEA-423A-90B6-8AA8CBC59A97} => C:\Program Files (x86)\BlueStacks\HD-StartLauncher.exe [2013-09-19] (BlueStack Systems, Inc.) Task: {9BA2757C-826F-4CC0-BF98-87172FAA929D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {9E1EED5E-B2F3-48B3-BBD3-A38E887A283B} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {C2F88DB2-A7A0-4643-890C-1FB53C26D1DC} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe Task: {CC82FCF3-F883-4303-990B-6AE68725E303} - System32\Tasks\CheckDriveBackgroundGuard => C:\Program Files (x86)\CheckDrive\CheckDriveBackgroundGuard.exe [2012-10-17] (Abelssoft) Task: {D3A69BF8-FA5C-4766-9666-3B8D85222468} - \BitGuard No Task File Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\CheckDriveBackgroundGuard.job => C:\Program Files (x86)\CheckDrive\CheckDriveBackgroundGuard.exe Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe ==================== Loaded Modules (whitelisted) ============= 2013-06-30 17:17 - 2011-05-19 08:58 - 00246784 _____ () C:\Windows\SYSTEM32\APOMgr64.DLL 2013-06-30 17:08 - 2012-05-21 03:38 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2013-09-20 20:14 - 2012-10-17 10:47 - 00013776 _____ () C:\Program Files (x86)\CheckDrive\AbMessages.dll 2013-09-20 20:14 - 2012-10-17 10:47 - 00585680 _____ () C:\Program Files (x86)\CheckDrive\AbScheduler.dll 2013-07-01 14:57 - 2013-05-16 09:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2013-07-01 14:57 - 2013-05-16 09:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2013-07-01 14:57 - 2013-05-16 09:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2013-07-01 14:57 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll 2013-07-01 14:57 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll 2013-08-15 11:59 - 2013-08-15 11:59 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\d5fbd408c39e0de3296b93ac03a5c147\IsdiInterop.ni.dll 2013-06-30 17:10 - 2012-05-30 12:55 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll 2013-06-30 17:13 - 2012-06-25 09:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll 2012-09-08 12:16 - 2012-09-08 12:16 - 00433664 _____ () B:\Programme\libxml2.dll 2012-09-08 12:16 - 2012-09-08 12:16 - 00315392 _____ () B:\Programme\libtidy.dll 2013-06-30 17:17 - 2011-05-04 15:32 - 00094208 ____N () C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\de-DE\THXAudNB.resources.dll 2013-06-30 17:15 - 2012-02-24 09:53 - 00094208 _____ () C:\Program Files (x86)\ASRock Utility\AXTU\Bin\IccLibDll.DLL 2014-01-21 23:37 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\ProgramData\Temp:A688EF17 AlternateDataStreams: C:\Users\Sebastian\Lokale Einstellungen:dtWNN9so0wqRtFUsm73gxHYO AlternateDataStreams: C:\Users\Sebastian\AppData\Local:dtWNN9so0wqRtFUsm73gxHYO AlternateDataStreams: C:\Users\Sebastian\AppData\Local\Anwendungsdaten:dtWNN9so0wqRtFUsm73gxHYO AlternateDataStreams: C:\Users\Sebastian\AppData\Local\Temp:uKL8bALobSp25R0ZQNTXF9TZUV ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (01/28/2014 00:41:05 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/28/2014 08:36:29 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/27/2014 11:24:52 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/27/2014 10:17:03 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/27/2014 05:09:35 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/27/2014 11:36:45 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/27/2014 07:50:33 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/26/2014 10:51:45 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/26/2014 05:48:32 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/26/2014 02:44:08 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (01/28/2014 00:41:00 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (01/28/2014 08:52:24 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (01/28/2014 08:52:24 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht. Error: (01/28/2014 08:36:26 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (01/27/2014 11:24:48 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (01/27/2014 10:16:59 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (01/27/2014 05:09:30 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (01/27/2014 11:36:42 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (01/27/2014 07:50:29 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (01/26/2014 10:51:41 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Microsoft Office Sessions: ========================= Error: (10/26/2013 05:22:20 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash. ==================== Memory info =========================== Percentage of memory in use: 20% Total physical RAM: 16265.63 MB Available physical RAM: 12966.37 MB Total Pagefile: 18311.81 MB Available Pagefile: 14847.88 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive b: (Daten) (Fixed) (Total:931.39 GB) (Free:709.47 GB) NTFS Drive c: () (Fixed) (Total:59.4 GB) (Free:19.43 GB) NTFS Drive e: (Auslagerungsdateien) (Fixed) (Total:465.76 GB) (Free:465.62 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 00000000) Partition: GPT Partition Type ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 60 GB) (Disk ID: 00000000) Partition: GPT Partition Type ======================================================== Disk: 2 (Size: 466 GB) (Disk ID: 46381072) Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19355 - hxxp://www.gmer.net Rootkit scan 2014-01-28 13:26:34 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2 SanDisk_ rev.2.0. 59,63GB Running: qi3ww0yk.exe; Driver: C:\Users\SEBAST~1\AppData\Local\Temp\kglyauoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077411465 2 bytes [41, 77] .text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000774114bb 2 bytes [41, 77] .text ... * 2 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2356] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000077411465 2 bytes [41, 77] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2356] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000774114bb 2 bytes [41, 77] .text ... * 2 .text C:\Program Files (x86)\BlueStacks\HD-Service.exe[2736] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000077411465 2 bytes [41, 77] .text C:\Program Files (x86)\BlueStacks\HD-Service.exe[2736] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000774114bb 2 bytes [41, 77] .text ... * 2 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[2284] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000077411465 2 bytes [41, 77] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[2284] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000774114bb 2 bytes [41, 77] .text ... * 2 ---- Processes - GMER 2.1 ---- Library C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D6DF924A-DDB1-4FEE-9903-685063FDF487}\mpengine.dll (*** suspicious ***) @ C:\Program Files\Microsoft Security Client\MsMpEng.exe [736] (Microsoft Malware Protection Engine/Microsoft Corporation(2014-01-27 16:20:29) 000007fefa530000 Library \\?\C:\Program Files (x86)\Spybot - Search & Destroy 2\av\avxdisk.dll (*** suspicious ***) @ C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2356] 00000000062a0000 ---- EOF - GMER 2.1 ---- |