| |
| |||||||
Log-Analyse und Auswertung: Probleme beim Hochfahren und zunehmende Anzahl der AbstürzeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
02.02.2014, 15:48
| #1 |
 |  Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Hallo, ich habe vor gut 3 Wochen das Spiel Star Wolves 2 auf meinem Rechner installiert. Dabei wurde der Kopierschutz StarForce mit installiert. Im Nachhinein habe ich dann mitbekommen, daß eben dieser Kopierschutz bei Windows 7 (64 Bit) zu massiven Problemen führen kann (wie bei mir dann auch: Rechner ließ sich nur noch im abgesicherten Modus hochfahren usw.). Nach einigem Rumdoktern habe ich StarForce auch wieder von meinem Rechner entfernen können. Allerdings verhält sich mein Rechner seit nunmehr gut 2 Wochen seltsam. Zuerst brauchte er relativ lange zum Hochfahren, bis er sich teilweise gar nicht mehr starten ließ und wie in einer Bootschleife gefangen war. Ich habe es bisher dann aber doch immer wieder irgendwie in den Griff bekommen. Ich habe den Rechner sowohl mit AVG scannen lassen als auch mit Malewarebytes Anti-Maleware. Das Antimalewareprogramm hat auch was gefunden und in Charantäne gesteckt, als ich die Logfile heute auslesen wollte, war sie nicht mehr verfügbar. In den letzten Tagen werden die Symptome immer schlimmer: Programme stürzen ab (Internet-Explorer, Firefox, Cyberlink Power-DVD), ich komme teilweise gar nicht mehr ins Internet (weshalb ich den Thread auch auf dem Rechner meiner Freundin schreibe) und es wird immer schwieriger den Rechner hochzufahren. Deshalb wollte ich nachfragen, ob ich mir mal wieder was eingefangen habe, noch Rest von StarForce für die Probleme verantwortlich sind oder ob es doch ein Hardwareproblem ist. Ach ja, Windows habe ich erst vor 3 bis 4 Monaten neu aufgesetzt. Also sollten es keine Probleme direkt von Windows sein (hoffe ich zumindest). So, hier nun die Logfiles: Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:45 on 02/02/2014 (Master of Desaster)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 04
Ran by Master of Desaster (administrator) on HORT-DES-CHAOS on 02-02-2014 13:46:37
Running from C:\Users\Master of Desaster\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe
() C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4956176 2013-11-07] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKU\S-1-5-21-2282248442-3872130878-3282906147-1000\...\MountPoints2: {2a5073f1-05a1-11e3-93f8-806e6f6e6963} - D:\SETUP.EXE
HKU\S-1-5-21-2282248442-3872130878-3282906147-1000\...\MountPoints2: {2a5073f2-05a1-11e3-93f8-806e6f6e6963} - E:\Start.exe
HKU\S-1-5-21-2282248442-3872130878-3282906147-1000\...\MountPoints2: {79fbe8cc-08b2-11e3-9c2e-806e6f6e6963} - D:\BSAutoRun.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x046AB6A1B199CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
FireFox:
========
FF ProfilePath: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default
FF user.js: detected! => C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\user.js
FF Homepage: www.web.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Programme\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Master of Desaster\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\aol-suche.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-28]
FF Extension: Ghostery - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\firefox@ghostery.com.xpi [2013-08-17]
FF Extension: Adblock Plus - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-15]
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-09-29]
FF HKCU\...\Firefox\Extensions: [{9309FA47-1B48-4768-AFA4-9E0556F5DC81}] - C:\Program Files (x86)\LyricsPal\128.xpi
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (DealPly Shopping) - C:\Users\Master of Desaster\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi [2013-08-15]
CHR HKLM-x32\...\Chrome\Extension: [pnbbffeddnekkhjmokkhdebbfbibbflc] - C:\Program Files (x86)\LyricsPal\128.crx [2013-08-15]
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4161512 2013-12-06] (Emsisoft GmbH)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3478544 2013-11-11] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864 2008-02-18] (Nero AG)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [529704 2008-02-28] (Nero AG)
R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe [1922600 2013-07-08] (Pandora.TV)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [167936 2005-08-07] ()
==================== Drivers (Whitelisted) ====================
S3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-11-05] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-08-15] (Emsisoft GmbH)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-11-14] ()
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-05] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [240920 2013-11-04] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [194872 2013-10-24] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-06] (Emsisoft GmbH)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-11-14] ()
R3 Ph3xIB64; C:\Windows\System32\DRIVERS\Ph3xIB64.sys [1627520 2009-06-10] (NXP Semiconductors)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [33048 2006-11-30] (X10 Wireless Technology, Inc.)
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-02 13:46 - 2014-02-02 13:46 - 00017154 _____ () C:\Users\Master of Desaster\Desktop\FRST.txt
2014-02-02 13:46 - 2014-02-02 13:46 - 00000000 ____D () C:\FRST
2014-02-02 13:45 - 2014-02-02 13:45 - 00000498 _____ () C:\Users\Master of Desaster\Desktop\defogger_disable.log
2014-02-02 13:45 - 2014-02-02 13:45 - 00000000 _____ () C:\Users\Master of Desaster\defogger_reenable
2014-02-02 13:45 - 2014-02-02 13:44 - 00050477 _____ () C:\Users\Master of Desaster\Desktop\Defogger.exe
2014-02-02 13:42 - 2014-02-02 13:42 - 00001217 _____ () C:\Users\Master of Desaster\Desktop\Continue Mipony Download Accelerator Installation.lnk
2014-02-02 13:42 - 2014-02-02 13:40 - 02080256 _____ (Farbar) C:\Users\Master of Desaster\Desktop\FRST64.exe
2014-02-02 13:42 - 2014-02-02 13:40 - 00380416 _____ () C:\Users\Master of Desaster\Desktop\Gmer-19357.exe
2014-02-02 12:31 - 2014-02-02 12:37 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\MemTest4
2014-02-02 12:31 - 2008-10-11 15:03 - 00024576 _____ () C:\Users\Master of Desaster\Desktop\memtest.exe
2014-02-02 12:29 - 2014-02-02 12:29 - 00013507 _____ () C:\Users\Master of Desaster\Downloads\MemTest4.zip
2014-02-02 09:57 - 2014-02-02 09:57 - 00274496 _____ () C:\Windows\Minidump\020214-64412-01.dmp
2014-02-02 09:54 - 2014-02-02 09:54 - 00274496 _____ () C:\Windows\Minidump\020214-26707-01.dmp
2014-02-01 11:45 - 2014-02-01 15:52 - 00000000 ____D () C:\Program Files\Unknown Device Identifier
2014-01-29 08:17 - 2014-01-29 08:20 - 01069512 _____ (Solid State Networks) C:\Users\Master of Desaster\Downloads\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
2014-01-29 08:08 - 2014-02-02 09:57 - 00000000 ____D () C:\Windows\Minidump
2014-01-29 08:08 - 2014-01-29 08:08 - 00262448 _____ () C:\Windows\Minidump\012914-38969-01.dmp
2014-01-29 08:07 - 2014-02-02 09:57 - 423783748 _____ () C:\Windows\MEMORY.DMP
2014-01-28 19:40 - 2014-01-28 19:40 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MPC-HC
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\Program Files\iTunes
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-28 18:03 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iPod
2014-01-22 10:02 - 2014-01-22 10:07 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Darksiders2
2014-01-22 07:43 - 2014-01-22 07:43 - 00000000 ____D () C:\ProgramData\McAfee
2014-01-21 07:56 - 2014-01-28 20:03 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-01-21 07:56 - 2014-01-28 20:03 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-01-21 07:56 - 2014-01-21 07:56 - 00000000 ____D () C:\Program Files (x86)\THQ
2014-01-20 10:03 - 2014-01-20 10:05 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Darksiders
2014-01-15 16:18 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 16:18 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 16:18 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 16:18 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-08 10:43 - 2014-01-15 15:33 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Bioshock
2014-01-08 10:43 - 2014-01-08 10:53 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Bioshock
2014-01-08 10:03 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-01-08 09:55 - 2014-01-08 09:55 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\InstallShield
2014-01-07 20:28 - 2014-01-07 20:28 - 00000000 ____D () C:\Users\Master of Desaster\Documents\NBGI
2014-01-07 20:27 - 2014-01-28 17:21 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\NBGI
2014-01-03 17:26 - 2014-01-03 17:26 - 00000000 ____D () C:\Program Files (x86)\1C
2014-01-03 17:21 - 2014-01-03 17:21 - 00000000 ____D () C:\Xbow Software
2014-01-03 16:53 - 2014-01-03 16:58 - 22414108 _____ () C:\Users\Master of Desaster\Downloads\StarWolves2_GermanPatch1.zip
==================== One Month Modified Files and Folders =======
2014-02-02 13:46 - 2014-02-02 13:46 - 00017154 _____ () C:\Users\Master of Desaster\Desktop\FRST.txt
2014-02-02 13:46 - 2014-02-02 13:46 - 00000000 ____D () C:\FRST
2014-02-02 13:45 - 2014-02-02 13:45 - 00000498 _____ () C:\Users\Master of Desaster\Desktop\defogger_disable.log
2014-02-02 13:45 - 2014-02-02 13:45 - 00000000 _____ () C:\Users\Master of Desaster\defogger_reenable
2014-02-02 13:45 - 2013-08-15 13:06 - 00000000 ____D () C:\Users\Master of Desaster
2014-02-02 13:44 - 2014-02-02 13:45 - 00050477 _____ () C:\Users\Master of Desaster\Desktop\Defogger.exe
2014-02-02 13:43 - 2010-11-21 07:50 - 00702700 _____ () C:\Windows\system32\perfh007.dat
2014-02-02 13:43 - 2010-11-21 07:50 - 00150340 _____ () C:\Windows\system32\perfc007.dat
2014-02-02 13:43 - 2009-07-14 06:13 - 01628300 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-02 13:42 - 2014-02-02 13:42 - 00001217 _____ () C:\Users\Master of Desaster\Desktop\Continue Mipony Download Accelerator Installation.lnk
2014-02-02 13:42 - 2013-08-15 13:02 - 01217269 _____ () C:\Windows\WindowsUpdate.log
2014-02-02 13:40 - 2014-02-02 13:42 - 02080256 _____ (Farbar) C:\Users\Master of Desaster\Desktop\FRST64.exe
2014-02-02 13:40 - 2014-02-02 13:42 - 00380416 _____ () C:\Users\Master of Desaster\Desktop\Gmer-19357.exe
2014-02-02 13:13 - 2009-07-14 05:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-02 13:13 - 2009-07-14 05:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-02 13:06 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-02 13:06 - 2009-07-14 05:51 - 00075724 _____ () C:\Windows\setupact.log
2014-02-02 12:37 - 2014-02-02 12:31 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\MemTest4
2014-02-02 12:37 - 2013-08-15 15:05 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-02-02 12:29 - 2014-02-02 12:29 - 00013507 _____ () C:\Users\Master of Desaster\Downloads\MemTest4.zip
2014-02-02 11:56 - 2013-08-15 14:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-02 10:22 - 2013-08-15 15:16 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-02 10:04 - 2013-08-15 13:57 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-02 09:57 - 2014-02-02 09:57 - 00274496 _____ () C:\Windows\Minidump\020214-64412-01.dmp
2014-02-02 09:57 - 2014-01-29 08:08 - 00000000 ____D () C:\Windows\Minidump
2014-02-02 09:57 - 2014-01-29 08:07 - 423783748 _____ () C:\Windows\MEMORY.DMP
2014-02-02 09:54 - 2014-02-02 09:54 - 00274496 _____ () C:\Windows\Minidump\020214-26707-01.dmp
2014-02-01 16:35 - 2014-01-02 08:12 - 01601644 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-01 16:15 - 2013-08-16 07:25 - 00035328 _____ () C:\Users\Master of Desaster\Desktop\Abrechnung.xls
2014-02-01 15:52 - 2014-02-01 11:45 - 00000000 ____D () C:\Program Files\Unknown Device Identifier
2014-02-01 15:52 - 2013-08-15 15:11 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Winamp
2014-02-01 15:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-02-01 15:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-01-29 15:39 - 2013-08-15 20:34 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Arbeit
2014-01-29 15:38 - 2013-08-18 17:52 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Outlook-Dateien
2014-01-29 08:20 - 2014-01-29 08:17 - 01069512 _____ (Solid State Networks) C:\Users\Master of Desaster\Downloads\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
2014-01-29 08:08 - 2014-01-29 08:08 - 00262448 _____ () C:\Windows\Minidump\012914-38969-01.dmp
2014-01-28 20:03 - 2014-01-21 07:56 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-01-28 20:03 - 2014-01-21 07:56 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-01-28 19:46 - 2013-08-15 14:51 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Programme
2014-01-28 19:40 - 2014-01-28 19:40 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MPC-HC
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iTunes
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-28 18:03 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iPod
2014-01-28 17:24 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-01-28 17:23 - 2013-12-12 07:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-01-28 17:23 - 2013-08-16 07:37 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Spiele
2014-01-28 17:23 - 2013-08-15 20:53 - 00000000 ____D () C:\Program Files (x86)\WinRAR
2014-01-28 17:23 - 2013-08-15 20:51 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-01-28 17:23 - 2013-08-15 20:45 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-28 17:23 - 2013-08-15 15:03 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Audible
2014-01-28 17:23 - 2013-08-15 14:42 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-01-28 17:22 - 2013-12-13 08:20 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Two Worlds II
2014-01-28 17:22 - 2013-12-11 22:42 - 00000000 ____D () C:\Users\Master of Desaster\Documents\The Witcher
2014-01-28 17:22 - 2013-12-04 12:37 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Witcher 2
2014-01-28 17:22 - 2013-11-18 16:14 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Skype
2014-01-28 17:22 - 2013-08-17 08:43 - 00000000 ____D () C:\Users\Master of Desaster\Documents\My Games
2014-01-28 17:21 - 2014-01-07 20:27 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\NBGI
2014-01-28 17:21 - 2014-01-02 10:58 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-01-28 17:21 - 2014-01-02 08:19 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-01-28 17:21 - 2014-01-02 08:16 - 00000000 ____D () C:\Program Files\AMD
2014-01-28 17:21 - 2014-01-02 08:08 - 00000000 ____D () C:\ProgramData\Package Cache
2014-01-28 17:21 - 2014-01-02 08:07 - 00000000 ____D () C:\AMD
2014-01-28 17:21 - 2014-01-01 16:16 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-01-28 17:21 - 2013-12-16 16:32 - 00000000 ____D () C:\Program Files\QGIS Dufour
2014-01-28 17:21 - 2013-11-18 16:13 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-01-28 17:21 - 2013-11-18 16:13 - 00000000 ____D () C:\ProgramData\Skype
2014-01-28 17:21 - 2013-11-14 08:52 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Atari
2014-01-28 17:21 - 2013-08-29 11:55 - 00000000 __RHD () C:\MSOCache
2014-01-28 17:21 - 2013-08-15 19:39 - 00000000 ____D () C:\ProgramData\Apple
2014-01-27 13:34 - 2013-08-15 15:04 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Audible
2014-01-23 17:43 - 2013-08-16 14:41 - 00000108 _____ () C:\Users\Master of Desaster\AppData\default.pls
2014-01-22 10:07 - 2014-01-22 10:02 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Darksiders2
2014-01-22 09:50 - 2013-08-15 20:37 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MySQL
2014-01-22 07:43 - 2014-01-22 07:43 - 00000000 ____D () C:\ProgramData\McAfee
2014-01-21 07:56 - 2014-01-21 07:56 - 00000000 ____D () C:\Program Files (x86)\THQ
2014-01-20 19:55 - 2013-10-24 09:56 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Bewerbungen
2014-01-20 10:05 - 2014-01-20 10:03 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Darksiders
2014-01-16 19:20 - 2014-01-01 16:17 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Might & Magic Heroes VI
2014-01-15 19:02 - 2009-07-14 05:45 - 00417096 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-15 17:45 - 2013-08-15 14:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-15 17:43 - 2013-08-15 14:52 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 15:33 - 2014-01-08 10:43 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Bioshock
2014-01-14 18:27 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-08 10:53 - 2014-01-08 10:43 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Bioshock
2014-01-08 10:03 - 2013-08-15 14:23 - 00431428 _____ () C:\Windows\DirectX.log
2014-01-08 09:56 - 2013-08-16 21:32 - 00000000 ____D () C:\Spiele
2014-01-08 09:56 - 2013-08-15 14:12 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-01-08 09:55 - 2014-01-08 09:55 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\InstallShield
2014-01-07 20:28 - 2014-01-07 20:28 - 00000000 ____D () C:\Users\Master of Desaster\Documents\NBGI
2014-01-07 20:27 - 2013-09-30 14:46 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2014-01-03 17:26 - 2014-01-03 17:26 - 00000000 ____D () C:\Program Files (x86)\1C
2014-01-03 17:21 - 2014-01-03 17:21 - 00000000 ____D () C:\Xbow Software
2014-01-03 16:58 - 2014-01-03 16:53 - 22414108 _____ () C:\Users\Master of Desaster\Downloads\StarWolves2_GermanPatch1.zip
Some content of TEMP:
====================
C:\Users\Master of Desaster\AppData\Local\Temp\drm_dyndata_7340007.dll
C:\Users\Master of Desaster\AppData\Local\Temp\ICReinstall_DownloadAcceleratorSetup.exe
C:\Users\Master of Desaster\AppData\Local\Temp\_is4C4B.exe
C:\Users\Master of Desaster\AppData\Local\Temp\_is99AF.exe
C:\Users\Master of Desaster\AppData\Local\Temp\_isFAF1.exe
C:\Users\Master of Desaster\AppData\Local\Temp\_isFEA8.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-29 20:56
==================== End Of Log ============================
--- --- --- und die Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2014 04
Ran by Master of Desaster at 2014-02-02 13:47:05
Running from C:\Users\Master of Desaster\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
==================== Installed Programs ======================
Adobe Acrobat 8 Standard - English, Français, Deutsch (x32 Version: 8.0.0 - Adobe Systems)
Adobe Acrobat 8 Standard - English, Français, Deutsch (x32 Version: 8.0.0 - Adobe Systems) Hidden
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Alan Wake (x32 Version: - Remedy Entertainment)
Amazon MP3-Downloader 1.0.18 (HKCU Version: 1.0.18 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
Amnesia: The Dark Descent (x32 Version: - Frictional Games)
Apple Application Support (x32 Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
AudibleManager (x32 Version: 2010791118.48.56.10882282 - Audible, Inc.)
AVG 2014 (Version: 14.0.3684 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4259 - AVG Technologies) Hidden
AVG 2014 (Version: 2014.0.4259 - AVG Technologies)
Biet-O-Matic v2.14.12 (x32 Version: 2.14.12 - BOM Development Team)
BioShock (x32 Version: 2.62.0000 - 2K Games)
BioShock Infinite (x32 Version: - Irrational Games)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Brothers - A Tale of Two Sons (x32 Version: - Starbreeze Studios AB)
Canon Inkjet Printer Driver Add-On Module V2.00 (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
ConvertHelper 2.2 (x32 Version: - DownloadHelper)
CPUID CPU-Z 1.64.0 (Version: - )
Dark Souls: Prepare to Die Edition (x32 Version: - FromSoftware)
Darksiders (x32 Version: - Vigil Games)
Darksiders II (x32 Version: - Vigil Games)
Dead Space™ (x32 Version: 1.0.222.0 - Electronic Arts)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (Version: - Microsoft)
DeskPins (remove only) (x32 Version: - )
Deus Ex: Human Revolution (x32 Version: - Eidos Montreal)
Dishonored (x32 Version: 1.0 - Bethesda Softworks)
Dropbox (HKCU Version: 2.2.13 - Dropbox, Inc.)
Emsisoft Anti-Malware (x32 Version: 6.0 - Emsi Software GmbH)
EndNote X6 (x32 Version: 16.0.0.6348 - Thomson Reuters)
Free YouTube to MP3 Converter version 3.12.12.827 (x32 Version: 3.12.12.827 - DVDVideoSoft Ltd.)
Ghostbusters: The Video Game (x32 Version: - Terminal Reality)
Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION
iTunes (Version: 11.1.4.62 - Apple Inc.)
Java 7 Update 25 (64-bit) (Version: 7.0.250 - Oracle)
K-Lite Codec Pack 10.2.0 Full (x32 Version: 10.2.0 - )
KMP Service (x32 Version: - KMP)
Lyrics-Pal (x32 Version: - LyricsPal Soft. LTD) <==== ATTENTION
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Metro 2033 (x32 Version: - 4A Games)
Metro: Last Light (x32 Version: - 4A Games)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Might & Magic: Heroes VI (x32 Version: - Blackhole)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (x32 Version: 8.3.124 - Nero AG)
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Neverwinter Nights 2 (x32 Version: 1.00.0000 - Obsidian)
NVIDIA PhysX (x32 Version: 9.13.0604 - NVIDIA Corporation)
Orcs Must Die! 2 (x32 Version: - Robot Entertainment)
Outlast (x32 Version: - Red Barrels)
PDF Architect (x32 Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (x32 Version: 1.7.1 - pdfforge)
Picasa 3 (x32 Version: 3.9 - Google, Inc.)
Portal (x32 Version: - Valve)
Portal 2 (x32 Version: - Valve)
PowerDVD (x32 Version: 7.0.2414.0 - CyberLink Corporation)
QGIS Dufour 2.0.1 Dufour (Version: - QGIS Development Team)
QuickTime (x32 Version: 7.74.80.86 - Apple Inc.)
ResearchSoft Direct Export Helper (x32 Version: - )
Risen 2 - Dark Waters (x32 Version: - Piranha Bytes)
Secure Download Manager (x32 Version: 3.1.20 - Kivuto Solutions Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft) Hidden
SigmaPlot 10.0 (x32 Version: 10.0.0 - Systat Software, Inc.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
SUPERAntiSpyware (Version: 5.6.1030 - SUPERAntiSpyware.com)
The Chronicles of Riddick: Assault on Dark Athena (x32 Version: - Starbreeze Studios AB)
The Elder Scrolls V: Skyrim (x32 Version: - Bethesda Game Studios)
The Inner World (x32 Version: - )
The KMPlayer (remove only) (x32 Version: 3.7.0.113 - KMP Media co., Ltd)
The Walking Dead (x32 Version: - )
The Witcher 2: Assassins of Kings Enhanced Edition (x32 Version: - CD Projekt RED)
The Witcher Enhanced Edition (x32 Version: 1.00.0000 - CD Projekt Red)
Titan Quest (x32 Version: - Iron Lore Entertainment)
Titan Quest: Immortal Throne (x32 Version: - Iron Lore Entertainment)
Torchlight II (x32 Version: - White Rabbit Interactive)
Trine 2 (x32 Version: - Frozenbyte)
Two Worlds II (x32 Version: - Reality Pump Studios)
Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 64-Bit Edition (Version: - Microsoft)
VCRedistSetup (x32 Version: 1.0.0 - Nero AG) Hidden
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.7 (Version: 2.0.7 - VideoLAN)
Warhammer® 40,000™: Dawn of War® II - Chaos Rising™ (x32 Version: - Relic Entertainment)
Warhammer® 40,000™: Dawn of War® II – Retribution™ (x32 Version: - Relic Entertainment)
Warhammer® 40,000™: Dawn of War® II (x32 Version: - Relic Entertainment)
Winamp (x32 Version: 5.65 - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1 - Nullsoft, Inc)
Winamp Essentials Pack (x32 Version: v5.64 - Christoph Grether)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR (x32 Version: - )
x64 Components v4.2.2 (Version: 4.2.2 - Shark007)
Xfire (remove only) (x32 Version: - )
==================== Restore Points =========================
21-01-2014 06:53:44 Microsoft Visual C++ 2005 Redistributable wird installiert
21-01-2014 06:56:15 Installed DarksidersInstaller.
28-01-2014 21:06:39 Geplanter Prüfpunkt
29-01-2014 21:19:00 Windows Update
30-01-2014 16:12:20 Windows Update
01-02-2014 15:30:37 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {1CB9C954-B0D7-45AE-8B83-7519F5B1825F} - System32\Tasks\Apple\AppleSoftwareUpdate => c:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {8CE39ED2-DD40-4B15-AF76-A811A75F4F73} - System32\Tasks\{14BBE0E6-EF0F-4F8C-A518-200CE967060A} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=6.10.0.104&LastError=12007
Task: {8E90FA96-BDCB-495B-A0A2-BE02B39D2B4D} - System32\Tasks\{435EE627-87A3-402F-B74E-57D291748A61} => Firefox.exe hxxp://ui.skype.com/ui/0/6.11.0.102/de/abandoninstall?source=lightinstaller&page=tsInstall
Task: {9BE95EDC-855E-45A0-A97E-E2F0C217F97D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {BB69E8A4-909B-471F-87D4-E1C39C445536} - \Dealply No Task File
Task: {C9BD0143-5E25-41C5-B340-1841E04FBD34} - \DealPlyUpdate No Task File
Task: {DD933F73-5CF0-4711-859A-B0889362368B} - System32\Tasks\{00F22BFA-20E6-4FFC-8D1C-193B91792321} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=6.10.0.104&LastError=12007
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-08-15 20:53 - 2006-12-11 01:14 - 00043008 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-10-22 09:42 - 2012-10-22 10:21 - 01277952 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\avformat-53.dll
2013-10-22 09:42 - 2012-07-09 16:57 - 02090496 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\avcodec-53.dll
2013-10-22 09:42 - 2011-12-06 15:19 - 00133632 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\avutil-51.dll
2013-10-22 09:42 - 2012-03-23 09:07 - 00224768 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\libupnp.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster:gs5sys
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\Templates:gs5sys
AlternateDataStreams: C:\ProgramData\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Cookies:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Lokale Einstellungen:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\AppData\Local\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\AppData\Local\Verlauf:gs5sys
AlternateDataStreams: C:\Users\Master of Desaster\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/02/2014 01:24:06 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428, Zeitstempel: 0x525b664c
Name des fehlerhaften Moduls: aticfx32.dll, Version: 8.17.10.1247, Zeitstempel: 0x52a23930
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0008f3cd
ID des fehlerhaften Prozesses: 0xe84
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (02/02/2014 01:22:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428, Zeitstempel: 0x525b664c
Name des fehlerhaften Moduls: aticfx32.dll, Version: 8.17.10.1247, Zeitstempel: 0x52a23930
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0008f3cd
ID des fehlerhaften Prozesses: 0x14f4
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (02/02/2014 01:22:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428, Zeitstempel: 0x525b664c
Name des fehlerhaften Moduls: aticfx32.dll, Version: 8.17.10.1247, Zeitstempel: 0x52a23930
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0008f3cd
ID des fehlerhaften Prozesses: 0x50c
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (02/02/2014 01:21:54 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428, Zeitstempel: 0x525b664c
Name des fehlerhaften Moduls: aticfx32.dll, Version: 8.17.10.1247, Zeitstempel: 0x52a23930
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0008f3cd
ID des fehlerhaften Prozesses: 0x1330
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (02/02/2014 01:07:10 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/02/2014 01:06:28 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ConversionService.exe, Version: 1.1.83.9982, Zeitstempel: 0x5162ddc7
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0034d8c8
ID des fehlerhaften Prozesses: 0x9fc
Startzeit der fehlerhaften Anwendung: 0xConversionService.exe0
Pfad der fehlerhaften Anwendung: ConversionService.exe1
Pfad des fehlerhaften Moduls: ConversionService.exe2
Berichtskennung: ConversionService.exe3
Error: (02/02/2014 01:06:14 PM) (Source: KMPService.exe) (User: )
Description: Socket Error # 11001
Host not found.
Error: (02/02/2014 10:02:01 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: BioShockInfinite.exe, Version: 1.1.24.21018, Zeitstempel: 0x52ab5a1a
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x107c
Startzeit der fehlerhaften Anwendung: 0xBioShockInfinite.exe0
Pfad der fehlerhaften Anwendung: BioShockInfinite.exe1
Pfad des fehlerhaften Moduls: BioShockInfinite.exe2
Berichtskennung: BioShockInfinite.exe3
Error: (02/02/2014 10:00:50 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: BioShockInfinite.exe, Version: 1.1.24.21018, Zeitstempel: 0x52ab5a1a
Name des fehlerhaften Moduls: BioShockInfinite.exe, Version: 1.1.24.21018, Zeitstempel: 0x52ab5a1a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x005c4c87
ID des fehlerhaften Prozesses: 0xd04
Startzeit der fehlerhaften Anwendung: 0xBioShockInfinite.exe0
Pfad der fehlerhaften Anwendung: BioShockInfinite.exe1
Pfad des fehlerhaften Moduls: BioShockInfinite.exe2
Berichtskennung: BioShockInfinite.exe3
Error: (02/02/2014 10:00:42 AM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
System errors:
=============
Error: (02/02/2014 01:06:32 PM) (Source: Service Control Manager) (User: )
Description: Dienst "PDF Architect Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (02/02/2014 10:00:41 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/02/2014 10:00:41 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
Error: (02/02/2014 09:57:41 AM) (Source: BugCheck) (User: )
Description: 0x0000001e (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000)C:\Windows\MEMORY.DMP020214-64412-01
Error: (02/02/2014 09:54:42 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753637.
Error: (02/02/2014 09:54:24 AM) (Source: BugCheck) (User: )
Description: 0x0000007e (0xffffffffc0000096, 0xfffff80002ec37d4, 0xfffff880033167a8, 0xfffff88003316000)C:\Windows\MEMORY.DMP020214-26707-01
Error: (02/02/2014 09:52:14 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DNS-Client" ist vom Dienst "NetIO-Legacy-TDI-Supporttreiber" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%577
Error: (02/02/2014 09:52:14 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NetIO-Legacy-TDI-Supporttreiber" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error: (02/02/2014 09:52:13 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Avgldx64
Avgtdia
NetBT
Psched
tdx
Error: (02/02/2014 09:52:02 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753637.
Microsoft Office Sessions:
=========================
Error: (02/02/2014 01:24:06 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.16428525b664caticfx32.dll8.17.10.124752a23930c00000050008f3cde8401cf201198f038e3C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\aticfx32.dlle84a3b30-8c04-11e3-ba8d-0021850a468a
Error: (02/02/2014 01:22:02 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.16428525b664caticfx32.dll8.17.10.124752a23930c00000050008f3cd14f401cf2010756b51e5C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\aticfx32.dll9e2a1425-8c04-11e3-ba8d-0021850a468a
Error: (02/02/2014 01:22:02 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.16428525b664caticfx32.dll8.17.10.124752a23930c00000050008f3cd50c01cf20112601ea63C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\aticfx32.dll9e258033-8c04-11e3-ba8d-0021850a468a
Error: (02/02/2014 01:21:54 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.16428525b664caticfx32.dll8.17.10.124752a23930c00000050008f3cd133001cf20110b9ceff3C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\aticfx32.dll99a93613-8c04-11e3-ba8d-0021850a468a
Error: (02/02/2014 01:07:10 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/02/2014 01:06:28 PM) (Source: Application Error)(User: )
Description: ConversionService.exe1.1.83.99825162ddc7unknown0.0.0.000000000c00000050034d8c89fc01cf200f2a0a1255C:\Program Files (x86)\PDF Architect\ConversionService.exeunknown718d484f-8c02-11e3-ba8d-0021850a468a
Error: (02/02/2014 01:06:14 PM) (Source: KMPService.exe)(User: )
Description: Socket Error # 11001
Host not found.
Error: (02/02/2014 10:02:01 AM) (Source: Application Error)(User: )
Description: BioShockInfinite.exe1.1.24.2101852ab5a1aunknown0.0.0.000000000c000000500000000107c01cf1ff5699a56eaC:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exeunknownad4c2b44-8be8-11e3-819c-0021850a468a
Error: (02/02/2014 10:00:50 AM) (Source: Application Error)(User: )
Description: BioShockInfinite.exe1.1.24.2101852ab5a1aBioShockInfinite.exe1.1.24.2101852ab5a1ac0000005005c4c87d0401cf1ff53e4b2082C:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exeC:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe8319b3a7-8be8-11e3-819c-0021850a468a
Error: (02/02/2014 10:00:42 AM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
CodeIntegrity Errors:
===================================
Date: 2014-02-02 09:52:14.641
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tdx.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:52:14.602
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tdx.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.269
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.222
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.176
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\netbt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.144
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\netbt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.098
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgtdia.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.066
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avgtdia.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:15.020
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tdx.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-02 09:51:14.988
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tdx.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 20%
Total physical RAM: 8190.18 MB
Available physical RAM: 6491.63 MB
Total Pagefile: 16378.53 MB
Available Pagefile: 14347.82 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (Hort des Chaos) (Fixed) (Total:465.66 GB) (Free:127.73 GB) NTFS
Drive d: (BIOSHOCK) (CDROM) (Total:4.38 GB) (Free:0 GB) UDF
Drive e: (GUARDIAN_OF_THE_SPIRIT_5) (CDROM) (Total:7.13 GB) (Free:0 GB) UDF
Drive i: (ASGARD) (Fixed) (Total:465.65 GB) (Free:108.86 GB) FAT32
Drive j: (BIFRÖST) (Removable) (Total:14.95 GB) (Free:14.23 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 341942CD)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: EAB39E2C)
Partition 1: (Active) - (Size=466 GB) - (Type=0C)
========================================================
Disk: 5 (Size: 15 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)
==================== End Of Log ============================
[code] GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-02 14:12:37
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-4 WDC_WD5000AACS-00ZUB0 rev.01.01B01 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\MASTER~1\AppData\Local\Temp\axldyfob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff8000d7f0000 45 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff8000d7f002f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\csrss.exe[764] C:\Windows\system32\GDI32.dll!GetRandomRgn + 116 000007fefce921dc 1 byte [35]
.text C:\Windows\System32\spoolsv.exe[1688] C:\Windows\System32\spoolsv.exe!PrvEnumPortsW + 457 00000000ffa5d65d 1 byte [72]
.text C:\Windows\System32\spoolsv.exe[1688] C:\Windows\System32\spoolsv.exe!PrvConfigurePortW + 214 00000000ffa5dc16 1 byte [20]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe[2428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000767c1465 2 bytes [7C, 76]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe[2428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767c14bb 2 bytes [7C, 76]
.text ... * 2
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe[3152] C:\Program Files (x86)\PANDORA.TV\PanService\avformat-53.dll!ff_http_auth_create_response + 294 000000006ab32c36 4 bytes [24, D9, B9, 68]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe[3152] C:\Program Files (x86)\PANDORA.TV\PanService\avformat-53.dll!ff_mp4_read_dec_config_descr + 435 000000006ab37e43 4 bytes [74, 4C, 09, 66]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe[3152] C:\Program Files (x86)\PANDORA.TV\PanService\avformat-53.dll!ff_nut_add_sp + 70 000000006ab75de6 4 bytes [20, EF, B9, 68]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000767c1465 2 bytes [7C, 76]
.text C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767c14bb 2 bytes [7C, 76]
.text ... * 2
---- EOF - GMER 2.1 ----
Danke schonmal im Vorraus. Liebe Grüße Holger Saar Geändert von Heimdal82 (02.02.2014 um 15:55 Uhr) |
|
02.02.2014, 22:04
| #2 | |
| /// the machine /// TB-Ausbilder    | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
02.02.2014, 23:47
| #3 |
| | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Hallo "Schrauber",
__________________okay, hab Combofix durchlaufen lassen. Beim ersten Durchlauf hat sich mein Rechner allerdings automatisch heruntergefahren (macht er irgendwie öfters in letzter Zeit). Der zweite Durchlauf hat dann einwandfrei funktioniert. Ich hoffe, dies hatte keine Auswirkungen auf das Programm. Hier die Logfile: Code:
ATTFilter Combofix Logfile: Holger Saar |
|
03.02.2014, 21:52
| #4 |
| /// the machine /// TB-Ausbilder | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.02.2014, 08:25
| #5 |
| | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Hallo Schrauber, sorry, daß ich erst jetzt zurückschreibe, hatte einiges um die Ohren in der letzten Zeit. Die beschriebenen Probleme scheinen sich auf einen Hardwarefehler zurückzuführen lassen. Als sich mein Rechner letzte Woche gar nicht mehr hochfahren ließ, hab ich einen Fachmann einen Blick auf die Komponenten werfen lassen...und siehe da, daß Mainboard ist hin. Da ich mir nun einen neuen Rechner zusammenbaue, sollten sich die Probleme erledigt haben. Außer du konntest mit den bisher vorliegenden Daten schon auf eine Infektion schließen (ich hoffe nämlich, die Festplatte nicht formatieren zu müssen). Liebe Grüße und nochmal sorry, wegen der späten Rückantwort Holger |
|
11.02.2014, 18:57
| #6 |
| /// the machine /// TB-Ausbilder | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Adware ist schon en bissl drauf, können wir aber locker angehen wenn der Rechner wieder läuft.
__________________ --> Probleme beim Hochfahren und zunehmende Anzahl der Abstürze |
|
19.02.2014, 15:34
| #7 |
| | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Hallo Schrauber, okay, mein Rechner funktioniert wieder. Da ich nun einige neue Teile drin habe (u.a. Mainboard und Prozessor), soll ich noch mal von vorne beginnen, also Defogger, FRST und Gmer? Oder kann ich einfach bei deiner letzten Antwort weitermachen? Liebe Grüße Holger |
|
20.02.2014, 12:21
| #8 |
| /// the machine /// TB-Ausbilder | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Einfach da weiter machen 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.02.2014, 10:54
| #9 |
| | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Hallo Schrauber, okay, hab alles durchlaufen lassen. Malewarebytes Anti-Maleware hat nix gefunden. Hier die Logfile: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.21.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16518 Master of Desaster :: HORT-DES-CHAOS [Administrator] 21.02.2014 08:51:57 mbam-log-2014-02-21 (08-51-57).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 224785 Laufzeit: 3 Minute(n), 39 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.019 - Bericht erstellt am 21/02/2014 um 09:00:12
# Aktualisiert 17/02/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Master of Desaster - HORT-DES-CHAOS
# Gestartet von : C:\Users\Master of Desaster\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\PC Speed Maximizer
Ordner Gelöscht : C:\Users\Master of Desaster\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Master of Desaster\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\Master of Desaster\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi
Datei Gelöscht : C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\user.js
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{9309FA47-1B48-4768-AFA4-9E0556F5DC81}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pnbbffeddnekkhjmokkhdebbfbibbflc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\webcakeupdater
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A0B10EBE-4E51-4CAE-949B-E6B9E7D68CEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F511AFDB-726E-4458-90E7-1ECB97406544}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0AFD55C8-ADF8-4A33-A6E1-DEDB7A36AEB4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\AVG Nation toolbar
Schlüssel Gelöscht : HKCU\Software\BI
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\lyricspal
Schlüssel Gelöscht : HKLM\Software\AVG Nation toolbar
Schlüssel Gelöscht : HKLM\Software\AVG Security Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lrcspal@lyricspal.co
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16518
-\\ Mozilla Firefox v27.0.1 (de)
[ Datei : C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\prefs.js ]
*************************
AdwCleaner[0].txt - [7971 octets] - [15/08/2013 21:32:19]
AdwCleaner[R0].txt - [4341 octets] - [21/02/2014 08:57:35]
AdwCleaner[S0].txt - [4142 octets] - [21/02/2014 09:00:12]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4202 octets] ##########
[/code] Dann noch die Logfile vom Junkware Removal Tool: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Professional x64
Ran by Master of Desaster on 21.02.2014 at 10:34:08,71
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Master of Desaster\AppData\Roaming\mozilla\firefox\profiles\mbvz594t.default\minidumps [44 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.02.2014 at 10:37:44,70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-02-2014
Ran by Master of Desaster (administrator) on HORT-DES-CHAOS on 21-02-2014 10:41:55
Running from C:\Users\Master of Desaster\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(AMD) C:\Windows\system32\atieclxx.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) c:\Program Files\Bonjour\mDNSResponder.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe
() C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)
HKLM\...\Run: [XFast LAN] - C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [1441152 2011-10-19] (cFos Software GmbH)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4962320 2014-01-22] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-03-12] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-11] (Intel Corporation)
HKLM-x32\...\Run: [XFastUSB] - C:\Program Files (x86)\XFastUSB\XFastUsb.exe [5021448 2014-02-17] (FNet Co., Ltd.)
HKU\S-1-5-21-2282248442-3872130878-3282906147-1000\...\Run: [ASRock A-Tuning] - [X]
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x046AB6A1B199CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
FireFox:
========
FF ProfilePath: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default
FF Homepage: www.web.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Programme\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Master of Desaster\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\aol-suche.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-28]
FF Extension: Ghostery - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\firefox@ghostery.com.xpi [2013-08-17]
FF Extension: Adblock Plus - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-15]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-09-29]
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4161512 2013-12-06] (Emsisoft GmbH)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3788816 2014-01-22] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [395136 2011-10-19] (cFos Software GmbH)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-03-12] (Intel Corporation)
S3 intelsba; C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [48832 2013-01-28] (Intel Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [182248 2013-03-14] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation)
R2 Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864 2008-02-18] (Nero AG)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [529704 2008-02-28] (Nero AG)
R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe [1922600 2013-07-08] (Pandora.TV)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [167936 2005-08-07] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
==================== Drivers (Whitelisted) ====================
S3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-11-05] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-08-15] (Emsisoft GmbH)
S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-02-17] (ASRock Incorporation)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [34640 2012-08-09] (ASRock Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-11-14] ()
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-06] (Emsisoft GmbH)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [496400 2013-02-26] (Intel Corporation)
R3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2014-02-18] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2014-02-17] (FNet Co., Ltd.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-04-30] (Intel Corporation)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [21048 2013-03-14] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [21048 2013-03-14] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-03-14] ()
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-11-14] ()
S3 Ph3xIB64; C:\Windows\System32\DRIVERS\Ph3xIB64.sys [1627520 2009-06-10] (NXP Semiconductors)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2014-02-21] ()
S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [33048 2006-11-30] (X10 Wireless Technology, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-21 10:40 - 2014-02-21 10:41 - 02153984 _____ (Farbar) C:\Users\Master of Desaster\Desktop\FRST64.exe
2014-02-21 10:37 - 2014-02-21 10:38 - 00000886 _____ () C:\Users\Master of Desaster\Desktop\JRT.txt
2014-02-21 10:34 - 2014-02-21 10:34 - 00000000 ____D () C:\Windows\ERUNT
2014-02-21 10:33 - 2014-02-21 10:33 - 01037734 _____ (Thisisu) C:\Users\Master of Desaster\Desktop\JRT.exe
2014-02-21 10:32 - 2014-02-21 10:32 - 00017194 _____ () C:\Users\Master of Desaster\Downloads\WaWi_12_2013.xls
2014-02-21 10:32 - 2014-02-21 10:32 - 00014979 _____ () C:\Users\Master of Desaster\Downloads\WuA_12_2013.xls
2014-02-21 09:06 - 2014-02-21 09:06 - 00004302 _____ () C:\Users\Master of Desaster\Desktop\AdwCleaner[S0].txt
2014-02-21 09:02 - 2014-02-21 09:02 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2014-02-21 08:54 - 2014-02-21 08:54 - 01241834 _____ () C:\Users\Master of Desaster\Desktop\adwcleaner.exe
2014-02-19 12:22 - 2014-02-20 18:21 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Arbeit
2014-02-19 00:10 - 2014-02-19 00:10 - 00000221 _____ () C:\Users\Master of Desaster\Desktop\Overlord II.url
2014-02-18 19:27 - 2014-02-18 20:49 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Overlord
2014-02-18 19:12 - 2014-02-18 19:12 - 00000221 _____ () C:\Users\Master of Desaster\Desktop\Overlord Raising Hell.url
2014-02-18 14:10 - 2014-02-18 14:10 - 00000221 _____ () C:\Users\Master of Desaster\Desktop\Overlord.url
2014-02-18 00:21 - 2014-02-18 00:21 - 00032320 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS
2014-02-17 22:07 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-17 22:07 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-17 22:06 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-17 22:06 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-17 22:06 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-17 22:06 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-17 22:06 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-17 22:06 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-17 22:06 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-17 22:06 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-17 22:06 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-17 22:06 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-17 22:06 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-17 22:06 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-17 22:06 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-17 22:06 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-17 22:06 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-17 22:06 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-17 22:06 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-17 22:06 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-17 22:06 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-17 22:06 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-17 22:06 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-17 22:06 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-17 22:06 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-17 22:06 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-17 22:06 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-17 22:06 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-17 22:06 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-17 22:06 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-17 22:06 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-17 22:06 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-17 22:06 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-17 22:06 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-17 22:06 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-17 22:06 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-17 22:06 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-17 22:06 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-17 22:06 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-17 22:06 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-17 22:06 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-17 22:00 - 2014-02-17 22:00 - 00000000 _____ () C:\Users\Master of Desaster\agent.log
2014-02-17 21:42 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-17 21:42 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-17 21:42 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-17 21:42 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-17 21:42 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-17 21:42 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-17 21:42 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-17 21:42 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-17 21:42 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-17 21:42 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-17 21:42 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-17 21:42 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-17 21:42 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-17 21:42 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-17 21:42 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-17 21:42 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-17 21:42 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-17 21:42 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-17 21:42 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-17 21:42 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-17 21:42 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-17 21:42 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-17 21:42 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-17 21:42 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-17 21:41 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-17 21:41 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-17 21:41 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-17 21:41 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-17 21:35 - 2014-02-21 09:02 - 00034752 _____ () C:\Windows\system32\Drivers\WPRO_41_2001.sys
2014-02-17 21:32 - 2014-02-17 21:32 - 00001350 _____ () C:\Users\Public\Desktop\Intel(R) Small Business Advantage.lnk
2014-02-17 21:32 - 2014-02-17 21:32 - 00000000 ____D () C:\Windows\System32\Tasks\Intel(R) Small Business Advantage
2014-02-17 21:30 - 2014-02-17 21:30 - 00001062 _____ () C:\Users\Public\Desktop\ASRock SmartConnect.lnk
2014-02-17 21:30 - 2014-02-17 21:30 - 00000000 ____D () C:\ProgramData\ASRock
2014-02-17 21:29 - 2014-02-17 21:29 - 00000003 _____ () C:\Users\Master of Desaster\AppData\Local\user_data.ini
2014-02-17 21:29 - 2014-02-17 21:29 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\cFos
2014-02-17 21:29 - 2014-02-17 21:29 - 00000000 ____D () C:\Program Files\ASRock
2014-02-17 21:29 - 2011-07-04 15:19 - 01632128 _____ (cFos Software GmbH) C:\Windows\system32\Drivers\cfosspeed6.sys
2014-02-17 21:28 - 2014-02-17 21:28 - 00022280 _____ (ASRock Incorporation) C:\Windows\SysWOW64\Drivers\AsrDrv101.sys
2014-02-17 21:28 - 2014-02-17 21:28 - 00016648 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETURPX.SYS
2014-02-17 21:28 - 2014-02-17 21:28 - 00001903 _____ () C:\Users\Public\Desktop\XFast USB.LNK
2014-02-17 21:28 - 2014-02-17 21:28 - 00001281 _____ () C:\Users\Public\Desktop\A-Tuning.lnk
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Windows\ASRock
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\ProgramData\FNET
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\ProgramData\cFos
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Program Files (x86)\XFastUSB
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Program Files (x86)\ASRock Utility
2014-02-17 21:28 - 2012-08-09 17:03 - 00034640 _____ (ASRock Inc.) C:\Windows\system32\Drivers\AsrRamDisk.sys
2014-02-17 21:27 - 2014-02-17 21:35 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\ASRSetup
2014-02-17 21:27 - 2014-02-17 21:30 - 00000000 ____D () C:\Program Files\ASRock Utility
2014-02-17 21:27 - 2013-02-08 19:37 - 00544568 ____R (Intel Corporation) C:\Windows\system32\PROUnstl.exe
2014-02-17 21:27 - 2011-05-10 16:28 - 00017192 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\AsrAppCharger.sys
2014-02-17 21:27 - 2006-01-12 08:52 - 00001904 ____N () C:\Windows\system32\SetupBD.din
2014-02-17 21:26 - 2013-02-26 10:23 - 00496400 _____ (Intel Corporation) C:\Windows\system32\Drivers\e1d62x64.sys
2014-02-17 21:26 - 2012-12-05 21:34 - 00073032 _____ (Intel Corporation) C:\Windows\system32\e1dmsg.dll
2014-02-17 21:26 - 2012-11-13 22:01 - 00101224 _____ (Intel Corporation) C:\Windows\system32\NicInstD.dll
2014-02-17 21:26 - 2012-01-06 07:03 - 00003114 _____ () C:\Windows\system32\e1d62x64.din
2014-02-17 21:26 - 2009-05-26 03:05 - 00036472 _____ (Intel Corporation) C:\Windows\system32\NicCo36.dll
2014-02-17 21:24 - 2014-02-17 21:24 - 00004614 _____ () C:\Windows\DPINST.LOG
2014-02-17 21:22 - 2014-02-17 21:22 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_iusb3hcs_01009.Wdf
2014-02-17 21:22 - 2013-04-11 04:10 - 00020464 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3hcs.sys
2014-02-17 21:21 - 2013-04-11 04:10 - 00785904 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3xhc.sys
2014-02-17 21:21 - 2013-04-11 04:10 - 00366576 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3hub.sys
2014-02-17 21:18 - 2014-02-17 21:18 - 00003932 _____ () C:\Windows\System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d
2014-02-17 21:18 - 2014-02-17 21:18 - 00003684 _____ () C:\Windows\System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon
2014-02-17 21:18 - 2014-02-17 21:18 - 00000000 _____ () C:\Windows\SysWOW64\agent.log
2014-02-17 21:18 - 2013-03-12 13:19 - 00016344 _____ (Intel Corporation) C:\Windows\system32\Drivers\IntelMEFWVer.dll
2014-02-17 21:15 - 2013-03-12 13:19 - 00064624 _____ (Intel Corporation) C:\Windows\system32\Drivers\HECIx64.sys
2014-02-17 21:12 - 2014-02-17 21:35 - 00000000 ____D () C:\ProgramData\Intel
2014-02-17 21:12 - 2014-02-17 21:31 - 00000000 ____D () C:\Program Files\Intel
2014-02-17 21:12 - 2014-02-17 21:12 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Intel Corporation
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Windows\system32\SRSLabs
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Users\Master of Desaster\Intel
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Program Files\Realtek
2014-02-17 21:10 - 2014-02-17 21:10 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-02-17 21:10 - 2013-03-29 14:42 - 03379272 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2014-02-17 21:10 - 2013-03-29 10:10 - 00449481 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2014-02-17 21:10 - 2013-03-27 09:57 - 00135240 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2014-02-17 21:10 - 2013-03-26 10:06 - 02797128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2014-02-17 21:10 - 2013-03-26 10:04 - 02734624 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2014-02-17 21:10 - 2013-03-26 08:40 - 03693128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2014-02-17 21:10 - 2013-03-26 07:38 - 01659464 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2014-02-17 21:10 - 2013-03-22 20:43 - 00208072 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2014-02-17 21:10 - 2013-03-12 11:16 - 00613448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2014-02-17 21:10 - 2013-02-20 11:55 - 01284680 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2014-02-17 21:10 - 2013-02-19 11:52 - 00991816 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2014-02-17 21:10 - 2013-01-16 09:02 - 02079816 ____R (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2014-02-17 21:10 - 2012-06-20 10:26 - 00110592 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2014-02-17 21:10 - 2012-03-08 04:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2014-02-17 21:10 - 2012-01-30 04:43 - 00836544 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2014-02-17 21:10 - 2012-01-10 03:20 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2014-02-17 21:10 - 2011-12-20 08:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2014-02-17 21:10 - 2011-11-22 09:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2014-02-17 21:10 - 2011-03-17 05:17 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2014-02-17 21:10 - 2011-03-07 10:11 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2014-02-17 21:10 - 2010-11-03 11:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2014-02-17 19:02 - 2014-02-17 19:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-03 09:12 - 2014-02-03 09:12 - 00274440 _____ () C:\Windows\Minidump\020314-55536-01.dmp
2014-02-03 08:52 - 2014-02-03 08:52 - 00274496 _____ () C:\Windows\Minidump\020314-19203-01.dmp
2014-02-03 08:48 - 2014-02-03 08:48 - 00274440 _____ () C:\Windows\Minidump\020314-49920-01.dmp
2014-02-03 08:46 - 2012-07-28 03:15 - 00931328 _____ () C:\Windows\SysWOW64\SET35A3.tmp
2014-02-03 08:42 - 2014-02-03 08:42 - 00315016 _____ () C:\Windows\Minidump\020314-42915-01.dmp
2014-02-02 23:42 - 2014-02-02 23:42 - 00119047 _____ () C:\ComboFix.txt
2014-02-02 23:25 - 2014-02-02 23:25 - 00274496 _____ () C:\Windows\Minidump\020214-44023-01.dmp
2014-02-02 23:20 - 2014-02-02 23:42 - 00000000 ____D () C:\Qoobox
2014-02-02 23:20 - 2014-02-02 23:41 - 00000000 ____D () C:\Windows\erdnt
2014-02-02 23:20 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-02 23:20 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-02 23:20 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-02 23:20 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-02 23:20 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-02 23:20 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-02 23:20 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-02 23:20 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-02 23:17 - 2014-02-02 23:17 - 00274496 _____ () C:\Windows\Minidump\020214-43727-01.dmp
2014-02-02 23:14 - 2014-02-02 23:19 - 05179159 ____R (Swearware) C:\Users\Master of Desaster\Downloads\ComboFix.exe
2014-02-02 17:05 - 2014-02-02 17:05 - 00274496 _____ () C:\Windows\Minidump\020214-47627-01.dmp
2014-02-02 16:22 - 2014-02-02 16:22 - 00274496 _____ () C:\Windows\Minidump\020214-50965-01.dmp
2014-02-02 15:17 - 2014-02-17 21:32 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-02-02 15:17 - 2013-08-05 11:50 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll
2014-02-02 15:16 - 2014-02-03 08:54 - 00000000 ____D () C:\Medion
2014-02-02 15:16 - 2014-02-02 15:16 - 00000000 ____D () C:\Intel
2014-02-02 15:15 - 2014-02-02 13:54 - 04607585 _____ (SWE Sven Ritter ) C:\Users\Master of Desaster\Desktop\chpintel_inf9x.exe
2014-02-02 14:27 - 2014-02-02 14:27 - 00274496 _____ () C:\Windows\Minidump\020214-48968-01.dmp
2014-02-02 14:12 - 2014-02-02 14:12 - 00003327 _____ () C:\Users\Master of Desaster\Desktop\Gamer.txt
2014-02-02 13:47 - 2014-02-02 13:47 - 00035952 _____ () C:\Users\Master of Desaster\Desktop\Addition.txt
2014-02-02 13:46 - 2014-02-21 10:41 - 00019916 _____ () C:\Users\Master of Desaster\Desktop\FRST.txt
2014-02-02 13:46 - 2014-02-21 10:41 - 00000000 ____D () C:\FRST
2014-02-02 13:45 - 2014-02-02 13:45 - 00000498 _____ () C:\Users\Master of Desaster\Desktop\defogger_disable.log
2014-02-02 13:45 - 2014-02-02 13:45 - 00000000 _____ () C:\Users\Master of Desaster\defogger_reenable
2014-02-02 13:45 - 2014-02-02 13:44 - 00050477 _____ () C:\Users\Master of Desaster\Desktop\Defogger.exe
2014-02-02 13:42 - 2014-02-02 13:40 - 00380416 _____ () C:\Users\Master of Desaster\Desktop\Gmer-19357.exe
2014-02-02 12:31 - 2014-02-02 12:37 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\MemTest4
2014-02-02 12:29 - 2014-02-02 12:29 - 00013507 _____ () C:\Users\Master of Desaster\Downloads\MemTest4.zip
2014-02-02 09:57 - 2014-02-02 09:57 - 00274496 _____ () C:\Windows\Minidump\020214-64412-01.dmp
2014-02-02 09:54 - 2014-02-02 09:54 - 00274496 _____ () C:\Windows\Minidump\020214-26707-01.dmp
2014-02-01 11:45 - 2014-02-01 15:52 - 00000000 ____D () C:\Program Files\Unknown Device Identifier
2014-01-29 08:17 - 2014-01-29 08:20 - 01069512 _____ (Solid State Networks) C:\Users\Master of Desaster\Downloads\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
2014-01-29 08:08 - 2014-02-03 09:12 - 00000000 ____D () C:\Windows\Minidump
2014-01-29 08:08 - 2014-01-29 08:08 - 00262448 _____ () C:\Windows\Minidump\012914-38969-01.dmp
2014-01-29 08:07 - 2014-02-03 09:12 - 581896780 _____ () C:\Windows\MEMORY.DMP
2014-01-28 19:40 - 2014-01-28 19:40 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MPC-HC
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\Program Files\iTunes
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-28 18:03 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iPod
2014-01-22 10:02 - 2014-01-22 10:07 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Darksiders2
2014-01-22 07:43 - 2014-01-22 07:43 - 00000000 ____D () C:\ProgramData\McAfee
==================== One Month Modified Files and Folders =======
2014-02-21 10:42 - 2014-02-02 13:46 - 00019916 _____ () C:\Users\Master of Desaster\Desktop\FRST.txt
2014-02-21 10:41 - 2014-02-21 10:40 - 02153984 _____ (Farbar) C:\Users\Master of Desaster\Desktop\FRST64.exe
2014-02-21 10:41 - 2014-02-02 13:46 - 00000000 ____D () C:\FRST
2014-02-21 10:38 - 2014-02-21 10:37 - 00000886 _____ () C:\Users\Master of Desaster\Desktop\JRT.txt
2014-02-21 10:34 - 2014-02-21 10:34 - 00000000 ____D () C:\Windows\ERUNT
2014-02-21 10:33 - 2014-02-21 10:33 - 01037734 _____ (Thisisu) C:\Users\Master of Desaster\Desktop\JRT.exe
2014-02-21 10:32 - 2014-02-21 10:32 - 00017194 _____ () C:\Users\Master of Desaster\Downloads\WaWi_12_2013.xls
2014-02-21 10:32 - 2014-02-21 10:32 - 00014979 _____ () C:\Users\Master of Desaster\Downloads\WuA_12_2013.xls
2014-02-21 09:56 - 2013-08-15 14:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-21 09:28 - 2013-08-15 13:57 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-21 09:09 - 2009-07-14 05:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-21 09:09 - 2009-07-14 05:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-21 09:06 - 2014-02-21 09:06 - 00004302 _____ () C:\Users\Master of Desaster\Desktop\AdwCleaner[S0].txt
2014-02-21 09:02 - 2014-02-21 09:02 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2014-02-21 09:02 - 2014-02-17 21:35 - 00034752 _____ () C:\Windows\system32\Drivers\WPRO_41_2001.sys
2014-02-21 09:01 - 2010-11-21 04:47 - 00087776 _____ () C:\Windows\PFRO.log
2014-02-21 09:01 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-21 09:01 - 2009-07-14 05:51 - 00079405 _____ () C:\Windows\setupact.log
2014-02-21 09:00 - 2013-08-15 21:32 - 00000000 ____D () C:\AdwCleaner
2014-02-21 09:00 - 2013-08-15 15:05 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-02-21 09:00 - 2013-08-15 13:02 - 01884029 _____ () C:\Windows\WindowsUpdate.log
2014-02-21 08:54 - 2014-02-21 08:54 - 01241834 _____ () C:\Users\Master of Desaster\Desktop\adwcleaner.exe
2014-02-21 00:04 - 2013-08-15 14:30 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-21 00:04 - 2013-08-15 14:30 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-21 00:04 - 2013-08-15 14:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-20 22:29 - 2013-08-15 15:16 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-20 22:26 - 2010-11-21 07:50 - 00703754 _____ () C:\Windows\system32\perfh007.dat
2014-02-20 22:26 - 2010-11-21 07:50 - 00150892 _____ () C:\Windows\system32\perfc007.dat
2014-02-20 22:26 - 2009-07-14 06:13 - 01631858 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-20 18:21 - 2014-02-19 12:22 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Arbeit
2014-02-20 12:46 - 2013-08-16 07:25 - 00035328 _____ () C:\Users\Master of Desaster\Desktop\Abrechnung.xls
2014-02-20 11:34 - 2013-08-15 15:32 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Rezepte
2014-02-19 12:21 - 2013-08-18 17:52 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Outlook-Dateien
2014-02-19 12:19 - 2013-08-15 20:37 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MySQL
2014-02-19 09:04 - 2013-08-15 14:23 - 00449055 _____ () C:\Windows\DirectX.log
2014-02-19 00:10 - 2014-02-19 00:10 - 00000221 _____ () C:\Users\Master of Desaster\Desktop\Overlord II.url
2014-02-18 20:49 - 2014-02-18 19:27 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Overlord
2014-02-18 19:12 - 2014-02-18 19:12 - 00000221 _____ () C:\Users\Master of Desaster\Desktop\Overlord Raising Hell.url
2014-02-18 14:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-18 14:10 - 2014-02-18 14:10 - 00000221 _____ () C:\Users\Master of Desaster\Desktop\Overlord.url
2014-02-18 00:21 - 2014-02-18 00:21 - 00032320 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS
2014-02-17 22:14 - 2013-08-15 15:36 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-17 22:13 - 2013-08-15 14:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-17 22:12 - 2013-08-15 14:52 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-17 22:09 - 2014-01-02 08:12 - 01605202 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-17 22:07 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2014-02-17 22:00 - 2014-02-17 22:00 - 00000000 _____ () C:\Users\Master of Desaster\agent.log
2014-02-17 22:00 - 2013-08-15 13:06 - 00000000 ____D () C:\Users\Master of Desaster
2014-02-17 21:35 - 2014-02-17 21:27 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\ASRSetup
2014-02-17 21:35 - 2014-02-17 21:12 - 00000000 ____D () C:\ProgramData\Intel
2014-02-17 21:35 - 2009-07-14 05:45 - 00418472 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-17 21:32 - 2014-02-17 21:32 - 00001350 _____ () C:\Users\Public\Desktop\Intel(R) Small Business Advantage.lnk
2014-02-17 21:32 - 2014-02-17 21:32 - 00000000 ____D () C:\Windows\System32\Tasks\Intel(R) Small Business Advantage
2014-02-17 21:32 - 2014-02-02 15:17 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-02-17 21:31 - 2014-02-17 21:12 - 00000000 ____D () C:\Program Files\Intel
2014-02-17 21:30 - 2014-02-17 21:30 - 00001062 _____ () C:\Users\Public\Desktop\ASRock SmartConnect.lnk
2014-02-17 21:30 - 2014-02-17 21:30 - 00000000 ____D () C:\ProgramData\ASRock
2014-02-17 21:30 - 2014-02-17 21:27 - 00000000 ____D () C:\Program Files\ASRock Utility
2014-02-17 21:29 - 2014-02-17 21:29 - 00000003 _____ () C:\Users\Master of Desaster\AppData\Local\user_data.ini
2014-02-17 21:29 - 2014-02-17 21:29 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\cFos
2014-02-17 21:29 - 2014-02-17 21:29 - 00000000 ____D () C:\Program Files\ASRock
2014-02-17 21:28 - 2014-02-17 21:28 - 00022280 _____ (ASRock Incorporation) C:\Windows\SysWOW64\Drivers\AsrDrv101.sys
2014-02-17 21:28 - 2014-02-17 21:28 - 00016648 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETURPX.SYS
2014-02-17 21:28 - 2014-02-17 21:28 - 00001903 _____ () C:\Users\Public\Desktop\XFast USB.LNK
2014-02-17 21:28 - 2014-02-17 21:28 - 00001281 _____ () C:\Users\Public\Desktop\A-Tuning.lnk
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Windows\ASRock
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\ProgramData\FNET
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\ProgramData\cFos
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Program Files (x86)\XFastUSB
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Program Files (x86)\ASRock Utility
2014-02-17 21:28 - 2013-08-15 19:09 - 00110064 _____ () C:\Users\Master of Desaster\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-17 21:24 - 2014-02-17 21:24 - 00004614 _____ () C:\Windows\DPINST.LOG
2014-02-17 21:22 - 2014-02-17 21:22 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_iusb3hcs_01009.Wdf
2014-02-17 21:18 - 2014-02-17 21:18 - 00003932 _____ () C:\Windows\System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d
2014-02-17 21:18 - 2014-02-17 21:18 - 00003684 _____ () C:\Windows\System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon
2014-02-17 21:18 - 2014-02-17 21:18 - 00000000 _____ () C:\Windows\SysWOW64\agent.log
2014-02-17 21:15 - 2013-08-15 14:12 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-17 21:12 - 2014-02-17 21:12 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Intel Corporation
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Windows\system32\SRSLabs
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Users\Master of Desaster\Intel
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Program Files\Realtek
2014-02-17 21:10 - 2014-02-17 21:10 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-02-17 20:28 - 2013-08-15 14:51 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Programme
2014-02-17 20:28 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-02-17 20:27 - 2013-08-15 13:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-17 20:23 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-02-17 19:02 - 2014-02-17 19:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-06 13:16 - 2014-02-17 22:06 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-17 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-17 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-17 22:06 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-17 22:06 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-17 22:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-17 22:06 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-17 22:06 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-17 22:06 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-17 22:06 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-17 22:06 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-17 22:06 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-17 22:06 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-17 22:06 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-17 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-17 22:06 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-17 22:06 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-17 22:06 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-17 22:06 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-17 22:06 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-17 22:06 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-17 22:06 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-17 22:06 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-17 22:06 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-17 22:06 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-17 22:06 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-17 22:06 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-17 22:06 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-17 22:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-17 22:06 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-17 22:06 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-17 22:06 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-17 22:06 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-17 22:06 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-17 22:06 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-17 22:06 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-17 22:06 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-17 22:06 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-17 22:06 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-03 09:12 - 2014-02-03 09:12 - 00274440 _____ () C:\Windows\Minidump\020314-55536-01.dmp
2014-02-03 09:12 - 2014-01-29 08:08 - 00000000 ____D () C:\Windows\Minidump
2014-02-03 09:12 - 2014-01-29 08:07 - 581896780 _____ () C:\Windows\MEMORY.DMP
2014-02-03 08:54 - 2014-02-02 15:16 - 00000000 ____D () C:\Medion
2014-02-03 08:52 - 2014-02-03 08:52 - 00274496 _____ () C:\Windows\Minidump\020314-19203-01.dmp
2014-02-03 08:48 - 2014-02-03 08:48 - 00274440 _____ () C:\Windows\Minidump\020314-49920-01.dmp
2014-02-03 08:42 - 2014-02-03 08:42 - 00315016 _____ () C:\Windows\Minidump\020314-42915-01.dmp
2014-02-02 23:47 - 2013-10-22 09:41 - 00000000 ____D () C:\Program Files (x86)\The KMPlayer
2014-02-02 23:42 - 2014-02-02 23:42 - 00119047 _____ () C:\ComboFix.txt
2014-02-02 23:42 - 2014-02-02 23:20 - 00000000 ____D () C:\Qoobox
2014-02-02 23:41 - 2014-02-02 23:20 - 00000000 ____D () C:\Windows\erdnt
2014-02-02 23:40 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-02 23:25 - 2014-02-02 23:25 - 00274496 _____ () C:\Windows\Minidump\020214-44023-01.dmp
2014-02-02 23:19 - 2014-02-02 23:14 - 05179159 ____R (Swearware) C:\Users\Master of Desaster\Downloads\ComboFix.exe
2014-02-02 23:17 - 2014-02-02 23:17 - 00274496 _____ () C:\Windows\Minidump\020214-43727-01.dmp
2014-02-02 17:05 - 2014-02-02 17:05 - 00274496 _____ () C:\Windows\Minidump\020214-47627-01.dmp
2014-02-02 16:22 - 2014-02-02 16:22 - 00274496 _____ () C:\Windows\Minidump\020214-50965-01.dmp
2014-02-02 15:16 - 2014-02-02 15:16 - 00000000 ____D () C:\Intel
2014-02-02 14:27 - 2014-02-02 14:27 - 00274496 _____ () C:\Windows\Minidump\020214-48968-01.dmp
2014-02-02 14:12 - 2014-02-02 14:12 - 00003327 _____ () C:\Users\Master of Desaster\Desktop\Gamer.txt
2014-02-02 13:54 - 2014-02-02 15:15 - 04607585 _____ (SWE Sven Ritter ) C:\Users\Master of Desaster\Desktop\chpintel_inf9x.exe
2014-02-02 13:47 - 2014-02-02 13:47 - 00035952 _____ () C:\Users\Master of Desaster\Desktop\Addition.txt
2014-02-02 13:45 - 2014-02-02 13:45 - 00000498 _____ () C:\Users\Master of Desaster\Desktop\defogger_disable.log
2014-02-02 13:45 - 2014-02-02 13:45 - 00000000 _____ () C:\Users\Master of Desaster\defogger_reenable
2014-02-02 13:44 - 2014-02-02 13:45 - 00050477 _____ () C:\Users\Master of Desaster\Desktop\Defogger.exe
2014-02-02 13:40 - 2014-02-02 13:42 - 00380416 _____ () C:\Users\Master of Desaster\Desktop\Gmer-19357.exe
2014-02-02 12:37 - 2014-02-02 12:31 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\MemTest4
2014-02-02 12:29 - 2014-02-02 12:29 - 00013507 _____ () C:\Users\Master of Desaster\Downloads\MemTest4.zip
2014-02-02 09:57 - 2014-02-02 09:57 - 00274496 _____ () C:\Windows\Minidump\020214-64412-01.dmp
2014-02-02 09:54 - 2014-02-02 09:54 - 00274496 _____ () C:\Windows\Minidump\020214-26707-01.dmp
2014-02-01 15:52 - 2014-02-01 11:45 - 00000000 ____D () C:\Program Files\Unknown Device Identifier
2014-02-01 15:52 - 2013-08-15 15:11 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Winamp
2014-02-01 15:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-02-01 15:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-01-29 08:20 - 2014-01-29 08:17 - 01069512 _____ (Solid State Networks) C:\Users\Master of Desaster\Downloads\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
2014-01-29 08:08 - 2014-01-29 08:08 - 00262448 _____ () C:\Windows\Minidump\012914-38969-01.dmp
2014-01-28 20:03 - 2014-01-21 07:56 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-01-28 20:03 - 2014-01-21 07:56 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-01-28 19:40 - 2014-01-28 19:40 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MPC-HC
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iTunes
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-28 18:03 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iPod
2014-01-28 17:24 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-01-28 17:23 - 2013-08-16 07:37 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Spiele
2014-01-28 17:23 - 2013-08-15 20:53 - 00000000 ____D () C:\Program Files (x86)\WinRAR
2014-01-28 17:23 - 2013-08-15 20:51 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-01-28 17:23 - 2013-08-15 20:45 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-28 17:23 - 2013-08-15 15:03 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Audible
2014-01-28 17:23 - 2013-08-15 14:42 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-01-28 17:22 - 2013-12-13 08:20 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Two Worlds II
2014-01-28 17:22 - 2013-12-11 22:42 - 00000000 ____D () C:\Users\Master of Desaster\Documents\The Witcher
2014-01-28 17:22 - 2013-12-04 12:37 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Witcher 2
2014-01-28 17:22 - 2013-11-18 16:14 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Skype
2014-01-28 17:22 - 2013-08-17 08:43 - 00000000 ____D () C:\Users\Master of Desaster\Documents\My Games
2014-01-28 17:21 - 2014-01-07 20:27 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\NBGI
2014-01-28 17:21 - 2014-01-02 10:58 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-01-28 17:21 - 2014-01-02 08:19 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-01-28 17:21 - 2014-01-02 08:16 - 00000000 ____D () C:\Program Files\AMD
2014-01-28 17:21 - 2014-01-02 08:08 - 00000000 ____D () C:\ProgramData\Package Cache
2014-01-28 17:21 - 2014-01-02 08:07 - 00000000 ____D () C:\AMD
2014-01-28 17:21 - 2014-01-01 16:16 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-01-28 17:21 - 2013-12-16 16:32 - 00000000 ____D () C:\Program Files\QGIS Dufour
2014-01-28 17:21 - 2013-11-18 16:13 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-01-28 17:21 - 2013-11-18 16:13 - 00000000 ____D () C:\ProgramData\Skype
2014-01-28 17:21 - 2013-11-14 08:52 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Atari
2014-01-28 17:21 - 2013-08-29 11:55 - 00000000 __RHD () C:\MSOCache
2014-01-28 17:21 - 2013-08-15 19:39 - 00000000 ____D () C:\ProgramData\Apple
2014-01-27 13:34 - 2013-08-15 15:04 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Audible
2014-01-23 17:43 - 2013-08-16 14:41 - 00000108 _____ () C:\Users\Master of Desaster\AppData\default.pls
2014-01-22 10:07 - 2014-01-22 10:02 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Darksiders2
2014-01-22 07:43 - 2014-01-22 07:43 - 00000000 ____D () C:\ProgramData\McAfee
Some content of TEMP:
====================
C:\Users\Master of Desaster\AppData\Local\Temp\COMAP.EXE
C:\Users\Master of Desaster\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-18 14:28
==================== End Of Log ============================
Liebe Grüße Holger |
|
22.02.2014, 13:19
| #10 |
| /// the machine /// TB-Ausbilder | Probleme beim Hochfahren und zunehmende Anzahl der AbstürzeESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.02.2014, 13:30
| #11 |
| | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Hallo Schrauber, okay, alles durchlaufen lassen. Der ESET-Scanner hat noch was gefunden. Hier die Logfile: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=58bc88aa5ff6834ab1a7cf2cf84c33ae
# engine=17186
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-23 11:09:27
# local_time=2014-02-23 12:09:27 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 16575055 144783617 0 0
# scanned=458246
# found=1
# cleaned=0
# scan_time=8420
sh=759D415B53185628CA25492523A5B2BC7E562D4A ft=1 fh=2db2a80633ac8466 vn="probably a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll.vir"
Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` AVG AntiVirus Free Edition 2014 Antivirus out of date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 12.0.0.70 Flash Player out of Date! Adobe Reader XI Mozilla Firefox (27.0.1) ````````Process Check: objlist.exe by Laurent```````` AVG avgwdsvc.exe Emsisoft Anti-Malware a2service.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-02-2014 01
Ran by Master of Desaster (administrator) on HORT-DES-CHAOS on 23-02-2014 13:23:53
Running from C:\Users\Master of Desaster\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(AMD) C:\Windows\system32\atieclxx.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) c:\Program Files\Bonjour\mDNSResponder.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe
() C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)
HKLM\...\Run: [XFast LAN] - C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [1441152 2011-10-19] (cFos Software GmbH)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4962320 2014-01-22] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-03-12] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-11] (Intel Corporation)
HKLM-x32\...\Run: [XFastUSB] - C:\Program Files (x86)\XFastUSB\XFastUsb.exe [5021448 2014-02-17] (FNet Co., Ltd.)
HKU\S-1-5-21-2282248442-3872130878-3282906147-1000\...\Run: [ASRock A-Tuning] - [X]
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x046AB6A1B199CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
FireFox:
========
FF ProfilePath: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default
FF Homepage: www.web.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Programme\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Master of Desaster\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\aol-suche.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-28]
FF Extension: Ghostery - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\firefox@ghostery.com.xpi [2013-08-17]
FF Extension: Adblock Plus - C:\Users\Master of Desaster\AppData\Roaming\Mozilla\Firefox\Profiles\mbvz594t.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-15]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-09-29]
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4161512 2013-12-06] (Emsisoft GmbH)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3788816 2014-01-22] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [395136 2011-10-19] (cFos Software GmbH)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-03-12] (Intel Corporation)
S3 intelsba; C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [48832 2013-01-28] (Intel Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [182248 2013-03-14] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation)
R2 Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864 2008-02-18] (Nero AG)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [529704 2008-02-28] (Nero AG)
R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe [1922600 2013-07-08] (Pandora.TV)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [167936 2005-08-07] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
==================== Drivers (Whitelisted) ====================
S3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-11-05] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-08-15] (Emsisoft GmbH)
S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-02-17] (ASRock Incorporation)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [34640 2012-08-09] (ASRock Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-11-14] ()
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-06] (Emsisoft GmbH)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [496400 2013-02-26] (Intel Corporation)
R3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2014-02-18] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2014-02-17] (FNet Co., Ltd.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-04-30] (Intel Corporation)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [21048 2013-03-14] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [21048 2013-03-14] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-03-14] ()
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-11-14] ()
S3 Ph3xIB64; C:\Windows\System32\DRIVERS\Ph3xIB64.sys [1627520 2009-06-10] (NXP Semiconductors)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2014-02-23] ()
S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [33048 2006-11-30] (X10 Wireless Technology, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-23 13:23 - 2014-02-23 13:23 - 00019896 _____ () C:\Users\Master of Desaster\Desktop\FRST.txt
2014-02-23 13:22 - 2014-02-23 13:23 - 02154496 _____ (Farbar) C:\Users\Master of Desaster\Desktop\FRST64.exe
2014-02-23 13:20 - 2014-02-23 13:20 - 00000881 _____ () C:\Users\Master of Desaster\Desktop\checkup.txt
2014-02-23 13:15 - 2014-02-23 13:15 - 00987425 _____ () C:\Users\Master of Desaster\Desktop\SecurityCheck.exe
2014-02-23 10:25 - 2014-02-23 10:28 - 00004096 _____ () C:\Users\Public\Documents\00002B49.LCS
2014-02-23 10:25 - 2014-02-23 10:28 - 00000000 ____D () C:\Users\Master of Desaster\Documents\LostChroniclesOfZerzura
2014-02-23 10:20 - 2014-02-23 10:20 - 00001736 _____ () C:\Users\Public\Desktop\Lost Chronicles of Zerzura.lnk
2014-02-23 09:41 - 2014-02-23 09:41 - 02347384 _____ (ESET) C:\Users\Master of Desaster\Desktop\esetsmartinstaller_enu.exe
2014-02-23 09:38 - 2014-02-23 09:38 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2014-02-22 11:54 - 2014-02-22 14:09 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Haunted
2014-02-22 11:53 - 2014-02-23 10:25 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\ProtectDISC
2014-02-22 11:53 - 2014-02-22 23:38 - 00004096 _____ () C:\Users\Public\Documents\00001D59.LCS
2014-02-22 11:51 - 2014-02-22 11:51 - 00001847 _____ () C:\Users\Public\Desktop\Haunted.lnk
2014-02-21 10:54 - 2014-02-21 10:55 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Befall
2014-02-21 10:34 - 2014-02-21 10:34 - 00000000 ____D () C:\Windows\ERUNT
2014-02-19 12:22 - 2014-02-21 11:18 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Arbeit
2014-02-18 19:27 - 2014-02-18 20:49 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Overlord
2014-02-18 00:21 - 2014-02-18 00:21 - 00032320 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS
2014-02-17 22:07 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-17 22:07 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-17 22:06 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-17 22:06 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-17 22:06 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-17 22:06 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-17 22:06 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-17 22:06 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-17 22:06 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-17 22:06 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-17 22:06 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-17 22:06 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-17 22:06 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-17 22:06 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-17 22:06 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-17 22:06 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-17 22:06 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-17 22:06 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-17 22:06 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-17 22:06 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-17 22:06 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-17 22:06 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-17 22:06 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-17 22:06 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-17 22:06 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-17 22:06 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-17 22:06 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-17 22:06 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-17 22:06 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-17 22:06 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-17 22:06 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-17 22:06 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-17 22:06 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-17 22:06 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-17 22:06 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-17 22:06 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-17 22:06 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-17 22:06 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-17 22:06 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-17 22:06 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-17 22:06 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-17 22:00 - 2014-02-17 22:00 - 00000000 _____ () C:\Users\Master of Desaster\agent.log
2014-02-17 21:42 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-17 21:42 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-17 21:42 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-17 21:42 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-17 21:42 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-17 21:42 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-17 21:42 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-17 21:42 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-17 21:42 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-17 21:42 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-17 21:42 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-17 21:42 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-17 21:42 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-17 21:42 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-17 21:42 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-17 21:42 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-17 21:42 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-17 21:42 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-17 21:42 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-17 21:42 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-17 21:42 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-17 21:42 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-17 21:42 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-17 21:42 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-17 21:41 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-17 21:41 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-17 21:41 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-17 21:41 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-17 21:35 - 2014-02-23 09:38 - 00034752 _____ () C:\Windows\system32\Drivers\WPRO_41_2001.sys
2014-02-17 21:32 - 2014-02-17 21:32 - 00001350 _____ () C:\Users\Public\Desktop\Intel(R) Small Business Advantage.lnk
2014-02-17 21:32 - 2014-02-17 21:32 - 00000000 ____D () C:\Windows\System32\Tasks\Intel(R) Small Business Advantage
2014-02-17 21:30 - 2014-02-17 21:30 - 00001062 _____ () C:\Users\Public\Desktop\ASRock SmartConnect.lnk
2014-02-17 21:30 - 2014-02-17 21:30 - 00000000 ____D () C:\ProgramData\ASRock
2014-02-17 21:29 - 2014-02-17 21:29 - 00000003 _____ () C:\Users\Master of Desaster\AppData\Local\user_data.ini
2014-02-17 21:29 - 2014-02-17 21:29 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\cFos
2014-02-17 21:29 - 2014-02-17 21:29 - 00000000 ____D () C:\Program Files\ASRock
2014-02-17 21:29 - 2011-07-04 15:19 - 01632128 _____ (cFos Software GmbH) C:\Windows\system32\Drivers\cfosspeed6.sys
2014-02-17 21:28 - 2014-02-17 21:28 - 00022280 _____ (ASRock Incorporation) C:\Windows\SysWOW64\Drivers\AsrDrv101.sys
2014-02-17 21:28 - 2014-02-17 21:28 - 00016648 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETURPX.SYS
2014-02-17 21:28 - 2014-02-17 21:28 - 00001903 _____ () C:\Users\Public\Desktop\XFast USB.LNK
2014-02-17 21:28 - 2014-02-17 21:28 - 00001281 _____ () C:\Users\Public\Desktop\A-Tuning.lnk
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Windows\ASRock
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\ProgramData\FNET
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\ProgramData\cFos
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Program Files (x86)\XFastUSB
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Program Files (x86)\ASRock Utility
2014-02-17 21:28 - 2012-08-09 17:03 - 00034640 _____ (ASRock Inc.) C:\Windows\system32\Drivers\AsrRamDisk.sys
2014-02-17 21:27 - 2014-02-17 21:35 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\ASRSetup
2014-02-17 21:27 - 2014-02-17 21:30 - 00000000 ____D () C:\Program Files\ASRock Utility
2014-02-17 21:27 - 2013-02-08 19:37 - 00544568 ____R (Intel Corporation) C:\Windows\system32\PROUnstl.exe
2014-02-17 21:27 - 2011-05-10 16:28 - 00017192 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\AsrAppCharger.sys
2014-02-17 21:27 - 2006-01-12 08:52 - 00001904 ____N () C:\Windows\system32\SetupBD.din
2014-02-17 21:26 - 2013-02-26 10:23 - 00496400 _____ (Intel Corporation) C:\Windows\system32\Drivers\e1d62x64.sys
2014-02-17 21:26 - 2012-12-05 21:34 - 00073032 _____ (Intel Corporation) C:\Windows\system32\e1dmsg.dll
2014-02-17 21:26 - 2012-11-13 22:01 - 00101224 _____ (Intel Corporation) C:\Windows\system32\NicInstD.dll
2014-02-17 21:26 - 2012-01-06 07:03 - 00003114 _____ () C:\Windows\system32\e1d62x64.din
2014-02-17 21:26 - 2009-05-26 03:05 - 00036472 _____ (Intel Corporation) C:\Windows\system32\NicCo36.dll
2014-02-17 21:24 - 2014-02-17 21:24 - 00004614 _____ () C:\Windows\DPINST.LOG
2014-02-17 21:22 - 2014-02-17 21:22 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_iusb3hcs_01009.Wdf
2014-02-17 21:22 - 2013-04-11 04:10 - 00020464 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3hcs.sys
2014-02-17 21:21 - 2013-04-11 04:10 - 00785904 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3xhc.sys
2014-02-17 21:21 - 2013-04-11 04:10 - 00366576 _____ (Intel Corporation) C:\Windows\system32\Drivers\iusb3hub.sys
2014-02-17 21:18 - 2014-02-17 21:18 - 00003932 _____ () C:\Windows\System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d
2014-02-17 21:18 - 2014-02-17 21:18 - 00003684 _____ () C:\Windows\System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon
2014-02-17 21:18 - 2014-02-17 21:18 - 00000000 _____ () C:\Windows\SysWOW64\agent.log
2014-02-17 21:18 - 2013-03-12 13:19 - 00016344 _____ (Intel Corporation) C:\Windows\system32\Drivers\IntelMEFWVer.dll
2014-02-17 21:15 - 2013-03-12 13:19 - 00064624 _____ (Intel Corporation) C:\Windows\system32\Drivers\HECIx64.sys
2014-02-17 21:12 - 2014-02-17 21:35 - 00000000 ____D () C:\ProgramData\Intel
2014-02-17 21:12 - 2014-02-17 21:31 - 00000000 ____D () C:\Program Files\Intel
2014-02-17 21:12 - 2014-02-17 21:12 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Intel Corporation
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Windows\system32\SRSLabs
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Users\Master of Desaster\Intel
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Program Files\Realtek
2014-02-17 21:10 - 2014-02-17 21:10 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-02-17 21:10 - 2013-03-29 14:42 - 03379272 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2014-02-17 21:10 - 2013-03-29 10:10 - 00449481 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2014-02-17 21:10 - 2013-03-27 09:57 - 00135240 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2014-02-17 21:10 - 2013-03-26 10:06 - 02797128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2014-02-17 21:10 - 2013-03-26 10:04 - 02734624 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2014-02-17 21:10 - 2013-03-26 08:40 - 03693128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2014-02-17 21:10 - 2013-03-26 07:38 - 01659464 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2014-02-17 21:10 - 2013-03-22 20:43 - 00208072 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2014-02-17 21:10 - 2013-03-12 11:16 - 00613448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2014-02-17 21:10 - 2013-02-20 11:55 - 01284680 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2014-02-17 21:10 - 2013-02-19 11:52 - 00991816 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2014-02-17 21:10 - 2013-01-16 09:02 - 02079816 ____R (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2014-02-17 21:10 - 2012-06-20 10:26 - 00110592 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2014-02-17 21:10 - 2012-03-08 04:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2014-02-17 21:10 - 2012-01-30 04:43 - 00836544 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2014-02-17 21:10 - 2012-01-10 03:20 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2014-02-17 21:10 - 2011-12-20 08:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2014-02-17 21:10 - 2011-11-22 09:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2014-02-17 21:10 - 2011-03-17 05:17 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2014-02-17 21:10 - 2011-03-07 10:11 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2014-02-17 21:10 - 2010-11-08 00:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2014-02-17 21:10 - 2010-11-03 11:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2014-02-17 19:02 - 2014-02-17 19:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-03 09:12 - 2014-02-03 09:12 - 00274440 _____ () C:\Windows\Minidump\020314-55536-01.dmp
2014-02-03 08:52 - 2014-02-03 08:52 - 00274496 _____ () C:\Windows\Minidump\020314-19203-01.dmp
2014-02-03 08:48 - 2014-02-03 08:48 - 00274440 _____ () C:\Windows\Minidump\020314-49920-01.dmp
2014-02-03 08:46 - 2012-07-28 03:15 - 00931328 _____ () C:\Windows\SysWOW64\SET35A3.tmp
2014-02-03 08:42 - 2014-02-03 08:42 - 00315016 _____ () C:\Windows\Minidump\020314-42915-01.dmp
2014-02-02 23:42 - 2014-02-02 23:42 - 00119047 _____ () C:\ComboFix.txt
2014-02-02 23:25 - 2014-02-02 23:25 - 00274496 _____ () C:\Windows\Minidump\020214-44023-01.dmp
2014-02-02 23:20 - 2014-02-02 23:42 - 00000000 ____D () C:\Qoobox
2014-02-02 23:20 - 2014-02-02 23:41 - 00000000 ____D () C:\Windows\erdnt
2014-02-02 23:20 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-02 23:20 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-02 23:20 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-02 23:20 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-02 23:20 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-02 23:20 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-02 23:20 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-02 23:20 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-02 23:17 - 2014-02-02 23:17 - 00274496 _____ () C:\Windows\Minidump\020214-43727-01.dmp
2014-02-02 23:14 - 2014-02-02 23:19 - 05179159 ____R (Swearware) C:\Users\Master of Desaster\Downloads\ComboFix.exe
2014-02-02 17:05 - 2014-02-02 17:05 - 00274496 _____ () C:\Windows\Minidump\020214-47627-01.dmp
2014-02-02 16:22 - 2014-02-02 16:22 - 00274496 _____ () C:\Windows\Minidump\020214-50965-01.dmp
2014-02-02 15:17 - 2014-02-17 21:32 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-02-02 15:17 - 2013-08-05 11:50 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll
2014-02-02 15:16 - 2014-02-03 08:54 - 00000000 ____D () C:\Medion
2014-02-02 15:16 - 2014-02-02 15:16 - 00000000 ____D () C:\Intel
2014-02-02 15:15 - 2014-02-02 13:54 - 04607585 _____ (SWE Sven Ritter ) C:\Users\Master of Desaster\Desktop\chpintel_inf9x.exe
2014-02-02 14:27 - 2014-02-02 14:27 - 00274496 _____ () C:\Windows\Minidump\020214-48968-01.dmp
2014-02-02 13:46 - 2014-02-23 13:23 - 00000000 ____D () C:\FRST
2014-02-02 13:45 - 2014-02-02 13:45 - 00000000 _____ () C:\Users\Master of Desaster\defogger_reenable
2014-02-02 12:31 - 2014-02-02 12:37 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\MemTest4
2014-02-02 12:29 - 2014-02-02 12:29 - 00013507 _____ () C:\Users\Master of Desaster\Downloads\MemTest4.zip
2014-02-02 09:57 - 2014-02-02 09:57 - 00274496 _____ () C:\Windows\Minidump\020214-64412-01.dmp
2014-02-02 09:54 - 2014-02-02 09:54 - 00274496 _____ () C:\Windows\Minidump\020214-26707-01.dmp
2014-02-01 11:45 - 2014-02-01 15:52 - 00000000 ____D () C:\Program Files\Unknown Device Identifier
2014-01-29 08:17 - 2014-01-29 08:20 - 01069512 _____ (Solid State Networks) C:\Users\Master of Desaster\Downloads\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
2014-01-29 08:08 - 2014-02-03 09:12 - 00000000 ____D () C:\Windows\Minidump
2014-01-29 08:08 - 2014-01-29 08:08 - 00262448 _____ () C:\Windows\Minidump\012914-38969-01.dmp
2014-01-29 08:07 - 2014-02-03 09:12 - 581896780 _____ () C:\Windows\MEMORY.DMP
2014-01-28 19:40 - 2014-01-28 19:40 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MPC-HC
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\Program Files\iTunes
2014-01-28 18:03 - 2014-01-28 18:04 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-28 18:03 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iPod
==================== One Month Modified Files and Folders =======
2014-02-23 13:24 - 2014-02-23 13:23 - 00019896 _____ () C:\Users\Master of Desaster\Desktop\FRST.txt
2014-02-23 13:23 - 2014-02-23 13:22 - 02154496 _____ (Farbar) C:\Users\Master of Desaster\Desktop\FRST64.exe
2014-02-23 13:23 - 2014-02-02 13:46 - 00000000 ____D () C:\FRST
2014-02-23 13:20 - 2014-02-23 13:20 - 00000881 _____ () C:\Users\Master of Desaster\Desktop\checkup.txt
2014-02-23 13:15 - 2014-02-23 13:15 - 00987425 _____ () C:\Users\Master of Desaster\Desktop\SecurityCheck.exe
2014-02-23 12:56 - 2013-08-15 14:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-23 10:28 - 2014-02-23 10:25 - 00004096 _____ () C:\Users\Public\Documents\00002B49.LCS
2014-02-23 10:28 - 2014-02-23 10:25 - 00000000 ____D () C:\Users\Master of Desaster\Documents\LostChroniclesOfZerzura
2014-02-23 10:25 - 2014-02-22 11:53 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\ProtectDISC
2014-02-23 10:20 - 2014-02-23 10:20 - 00001736 _____ () C:\Users\Public\Desktop\Lost Chronicles of Zerzura.lnk
2014-02-23 10:15 - 2013-08-16 21:32 - 00000000 ____D () C:\Spiele
2014-02-23 09:45 - 2009-07-14 05:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-23 09:45 - 2009-07-14 05:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-23 09:42 - 2013-08-15 13:02 - 01917918 _____ () C:\Windows\WindowsUpdate.log
2014-02-23 09:41 - 2014-02-23 09:41 - 02347384 _____ (ESET) C:\Users\Master of Desaster\Desktop\esetsmartinstaller_enu.exe
2014-02-23 09:38 - 2014-02-23 09:38 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2014-02-23 09:38 - 2014-02-17 21:35 - 00034752 _____ () C:\Windows\system32\Drivers\WPRO_41_2001.sys
2014-02-23 09:38 - 2010-11-21 04:47 - 00088440 _____ () C:\Windows\PFRO.log
2014-02-23 09:38 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-23 09:38 - 2009-07-14 05:51 - 00079517 _____ () C:\Windows\setupact.log
2014-02-23 00:12 - 2013-08-15 15:05 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-02-22 23:38 - 2014-02-22 11:53 - 00004096 _____ () C:\Users\Public\Documents\00001D59.LCS
2014-02-22 17:29 - 2013-08-15 13:57 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-22 14:09 - 2014-02-22 11:54 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Haunted
2014-02-22 11:53 - 2013-08-15 14:23 - 00466682 _____ () C:\Windows\DirectX.log
2014-02-22 11:51 - 2014-02-22 11:51 - 00001847 _____ () C:\Users\Public\Desktop\Haunted.lnk
2014-02-21 18:44 - 2013-08-15 15:16 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-21 11:18 - 2014-02-19 12:22 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Arbeit
2014-02-21 11:16 - 2013-08-18 17:52 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Outlook-Dateien
2014-02-21 11:12 - 2013-08-15 20:37 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MySQL
2014-02-21 10:55 - 2014-02-21 10:54 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Befall
2014-02-21 10:55 - 2013-08-16 07:37 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Spiele
2014-02-21 10:34 - 2014-02-21 10:34 - 00000000 ____D () C:\Windows\ERUNT
2014-02-21 09:00 - 2013-08-15 21:32 - 00000000 ____D () C:\AdwCleaner
2014-02-21 00:04 - 2013-08-15 14:30 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-21 00:04 - 2013-08-15 14:30 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-21 00:04 - 2013-08-15 14:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-20 22:26 - 2010-11-21 07:50 - 00703754 _____ () C:\Windows\system32\perfh007.dat
2014-02-20 22:26 - 2010-11-21 07:50 - 00150892 _____ () C:\Windows\system32\perfc007.dat
2014-02-20 22:26 - 2009-07-14 06:13 - 01631858 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-20 12:46 - 2013-08-16 07:25 - 00035328 _____ () C:\Users\Master of Desaster\Desktop\Abrechnung.xls
2014-02-20 11:34 - 2013-08-15 15:32 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Rezepte
2014-02-18 20:49 - 2014-02-18 19:27 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Overlord
2014-02-18 14:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-18 00:21 - 2014-02-18 00:21 - 00032320 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS
2014-02-17 22:14 - 2013-08-15 15:36 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-17 22:13 - 2013-08-15 14:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-17 22:12 - 2013-08-15 14:52 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-17 22:09 - 2014-01-02 08:12 - 01605202 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-17 22:07 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2014-02-17 22:00 - 2014-02-17 22:00 - 00000000 _____ () C:\Users\Master of Desaster\agent.log
2014-02-17 22:00 - 2013-08-15 13:06 - 00000000 ____D () C:\Users\Master of Desaster
2014-02-17 21:35 - 2014-02-17 21:27 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\ASRSetup
2014-02-17 21:35 - 2014-02-17 21:12 - 00000000 ____D () C:\ProgramData\Intel
2014-02-17 21:35 - 2009-07-14 05:45 - 00418472 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-17 21:32 - 2014-02-17 21:32 - 00001350 _____ () C:\Users\Public\Desktop\Intel(R) Small Business Advantage.lnk
2014-02-17 21:32 - 2014-02-17 21:32 - 00000000 ____D () C:\Windows\System32\Tasks\Intel(R) Small Business Advantage
2014-02-17 21:32 - 2014-02-02 15:17 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-02-17 21:31 - 2014-02-17 21:12 - 00000000 ____D () C:\Program Files\Intel
2014-02-17 21:30 - 2014-02-17 21:30 - 00001062 _____ () C:\Users\Public\Desktop\ASRock SmartConnect.lnk
2014-02-17 21:30 - 2014-02-17 21:30 - 00000000 ____D () C:\ProgramData\ASRock
2014-02-17 21:30 - 2014-02-17 21:27 - 00000000 ____D () C:\Program Files\ASRock Utility
2014-02-17 21:29 - 2014-02-17 21:29 - 00000003 _____ () C:\Users\Master of Desaster\AppData\Local\user_data.ini
2014-02-17 21:29 - 2014-02-17 21:29 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\cFos
2014-02-17 21:29 - 2014-02-17 21:29 - 00000000 ____D () C:\Program Files\ASRock
2014-02-17 21:28 - 2014-02-17 21:28 - 00022280 _____ (ASRock Incorporation) C:\Windows\SysWOW64\Drivers\AsrDrv101.sys
2014-02-17 21:28 - 2014-02-17 21:28 - 00016648 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETURPX.SYS
2014-02-17 21:28 - 2014-02-17 21:28 - 00001903 _____ () C:\Users\Public\Desktop\XFast USB.LNK
2014-02-17 21:28 - 2014-02-17 21:28 - 00001281 _____ () C:\Users\Public\Desktop\A-Tuning.lnk
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Windows\ASRock
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\ProgramData\FNET
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\ProgramData\cFos
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Program Files (x86)\XFastUSB
2014-02-17 21:28 - 2014-02-17 21:28 - 00000000 ____D () C:\Program Files (x86)\ASRock Utility
2014-02-17 21:28 - 2013-08-15 19:09 - 00110064 _____ () C:\Users\Master of Desaster\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-17 21:24 - 2014-02-17 21:24 - 00004614 _____ () C:\Windows\DPINST.LOG
2014-02-17 21:22 - 2014-02-17 21:22 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_iusb3hcs_01009.Wdf
2014-02-17 21:18 - 2014-02-17 21:18 - 00003932 _____ () C:\Windows\System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d
2014-02-17 21:18 - 2014-02-17 21:18 - 00003684 _____ () C:\Windows\System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon
2014-02-17 21:18 - 2014-02-17 21:18 - 00000000 _____ () C:\Windows\SysWOW64\agent.log
2014-02-17 21:15 - 2013-08-15 14:12 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-17 21:12 - 2014-02-17 21:12 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Intel Corporation
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Windows\system32\SRSLabs
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Users\Master of Desaster\Intel
2014-02-17 21:11 - 2014-02-17 21:11 - 00000000 ____D () C:\Program Files\Realtek
2014-02-17 21:10 - 2014-02-17 21:10 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-02-17 20:28 - 2013-08-15 14:51 - 00000000 ____D () C:\Users\Master of Desaster\Desktop\Programme
2014-02-17 20:28 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-02-17 20:27 - 2013-08-15 13:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-17 20:23 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-02-17 19:02 - 2014-02-17 19:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-06 13:16 - 2014-02-17 22:06 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-17 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-17 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-17 22:06 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-17 22:06 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-17 22:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-17 22:06 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-17 22:06 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-17 22:06 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-17 22:06 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-17 22:06 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-17 22:06 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-17 22:06 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-17 22:06 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-17 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-17 22:06 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-17 22:06 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-17 22:06 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-17 22:06 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-17 22:06 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-17 22:06 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-17 22:06 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-17 22:06 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-17 22:06 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-17 22:06 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-17 22:06 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-17 22:06 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-17 22:06 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-17 22:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-17 22:06 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-17 22:06 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-17 22:06 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-17 22:06 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-17 22:06 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-17 22:06 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-17 22:06 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-17 22:06 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-17 22:06 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-17 22:06 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-03 09:12 - 2014-02-03 09:12 - 00274440 _____ () C:\Windows\Minidump\020314-55536-01.dmp
2014-02-03 09:12 - 2014-01-29 08:08 - 00000000 ____D () C:\Windows\Minidump
2014-02-03 09:12 - 2014-01-29 08:07 - 581896780 _____ () C:\Windows\MEMORY.DMP
2014-02-03 08:54 - 2014-02-02 15:16 - 00000000 ____D () C:\Medion
2014-02-03 08:52 - 2014-02-03 08:52 - 00274496 _____ () C:\Windows\Minidump\020314-19203-01.dmp
2014-02-03 08:48 - 2014-02-03 08:48 - 00274440 _____ () C:\Windows\Minidump\020314-49920-01.dmp
2014-02-03 08:42 - 2014-02-03 08:42 - 00315016 _____ () C:\Windows\Minidump\020314-42915-01.dmp
2014-02-02 23:47 - 2013-10-22 09:41 - 00000000 ____D () C:\Program Files (x86)\The KMPlayer
2014-02-02 23:42 - 2014-02-02 23:42 - 00119047 _____ () C:\ComboFix.txt
2014-02-02 23:42 - 2014-02-02 23:20 - 00000000 ____D () C:\Qoobox
2014-02-02 23:41 - 2014-02-02 23:20 - 00000000 ____D () C:\Windows\erdnt
2014-02-02 23:40 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-02 23:25 - 2014-02-02 23:25 - 00274496 _____ () C:\Windows\Minidump\020214-44023-01.dmp
2014-02-02 23:19 - 2014-02-02 23:14 - 05179159 ____R (Swearware) C:\Users\Master of Desaster\Downloads\ComboFix.exe
2014-02-02 23:17 - 2014-02-02 23:17 - 00274496 _____ () C:\Windows\Minidump\020214-43727-01.dmp
2014-02-02 17:05 - 2014-02-02 17:05 - 00274496 _____ () C:\Windows\Minidump\020214-47627-01.dmp
2014-02-02 16:22 - 2014-02-02 16:22 - 00274496 _____ () C:\Windows\Minidump\020214-50965-01.dmp
2014-02-02 15:16 - 2014-02-02 15:16 - 00000000 ____D () C:\Intel
2014-02-02 14:27 - 2014-02-02 14:27 - 00274496 _____ () C:\Windows\Minidump\020214-48968-01.dmp
2014-02-02 13:54 - 2014-02-02 15:15 - 04607585 _____ (SWE Sven Ritter ) C:\Users\Master of Desaster\Desktop\chpintel_inf9x.exe
2014-02-02 13:45 - 2014-02-02 13:45 - 00000000 _____ () C:\Users\Master of Desaster\defogger_reenable
2014-02-02 12:37 - 2014-02-02 12:31 - 00000000 ____D () C:\Users\Master of Desaster\Downloads\MemTest4
2014-02-02 12:29 - 2014-02-02 12:29 - 00013507 _____ () C:\Users\Master of Desaster\Downloads\MemTest4.zip
2014-02-02 09:57 - 2014-02-02 09:57 - 00274496 _____ () C:\Windows\Minidump\020214-64412-01.dmp
2014-02-02 09:54 - 2014-02-02 09:54 - 00274496 _____ () C:\Windows\Minidump\020214-26707-01.dmp
2014-02-01 15:52 - 2014-02-01 11:45 - 00000000 ____D () C:\Program Files\Unknown Device Identifier
2014-02-01 15:52 - 2013-08-15 15:11 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Winamp
2014-02-01 15:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-02-01 15:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-01-29 08:20 - 2014-01-29 08:17 - 01069512 _____ (Solid State Networks) C:\Users\Master of Desaster\Downloads\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
2014-01-29 08:08 - 2014-01-29 08:08 - 00262448 _____ () C:\Windows\Minidump\012914-38969-01.dmp
2014-01-28 20:03 - 2014-01-21 07:56 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-01-28 20:03 - 2014-01-21 07:56 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-01-28 19:40 - 2014-01-28 19:40 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\MPC-HC
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iTunes
2014-01-28 18:04 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-28 18:03 - 2014-01-28 18:03 - 00000000 ____D () C:\Program Files\iPod
2014-01-28 17:24 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-01-28 17:23 - 2013-08-15 20:53 - 00000000 ____D () C:\Program Files (x86)\WinRAR
2014-01-28 17:23 - 2013-08-15 20:51 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-01-28 17:23 - 2013-08-15 20:45 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-28 17:23 - 2013-08-15 15:03 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Audible
2014-01-28 17:23 - 2013-08-15 14:42 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-01-28 17:22 - 2013-12-13 08:20 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Two Worlds II
2014-01-28 17:22 - 2013-12-11 22:42 - 00000000 ____D () C:\Users\Master of Desaster\Documents\The Witcher
2014-01-28 17:22 - 2013-12-04 12:37 - 00000000 ____D () C:\Users\Master of Desaster\Documents\Witcher 2
2014-01-28 17:22 - 2013-11-18 16:14 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Roaming\Skype
2014-01-28 17:22 - 2013-08-17 08:43 - 00000000 ____D () C:\Users\Master of Desaster\Documents\My Games
2014-01-28 17:21 - 2014-01-07 20:27 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\NBGI
2014-01-28 17:21 - 2014-01-02 10:58 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-01-28 17:21 - 2014-01-02 08:19 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-01-28 17:21 - 2014-01-02 08:16 - 00000000 ____D () C:\Program Files\AMD
2014-01-28 17:21 - 2014-01-02 08:08 - 00000000 ____D () C:\ProgramData\Package Cache
2014-01-28 17:21 - 2014-01-02 08:07 - 00000000 ____D () C:\AMD
2014-01-28 17:21 - 2014-01-01 16:16 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-01-28 17:21 - 2013-12-16 16:32 - 00000000 ____D () C:\Program Files\QGIS Dufour
2014-01-28 17:21 - 2013-11-18 16:13 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-01-28 17:21 - 2013-11-18 16:13 - 00000000 ____D () C:\ProgramData\Skype
2014-01-28 17:21 - 2013-11-14 08:52 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Atari
2014-01-28 17:21 - 2013-08-29 11:55 - 00000000 __RHD () C:\MSOCache
2014-01-28 17:21 - 2013-08-15 19:39 - 00000000 ____D () C:\ProgramData\Apple
2014-01-27 13:34 - 2013-08-15 15:04 - 00000000 ____D () C:\Users\Master of Desaster\AppData\Local\Audible
Some content of TEMP:
====================
C:\Users\Master of Desaster\AppData\Local\Temp\COMAP.EXE
C:\Users\Master of Desaster\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-18 14:28
==================== End Of Log ============================
Seitdem die neue Teile im Rechner sind hab ich keine Probleme mehr mit dem Hochfahren, zumindest das wird wohl das durchgeschmorte Mainboard gewesen sein. Und andere Probleme sind seitdem auch nicht mehr aufgetreten. Was macht die Infektion? Liebe Grüße Holger |
|
24.02.2014, 16:33
| #12 |
| /// the machine /// TB-Ausbilder | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.02.2014, 17:59
| #13 |
| | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Hallo Schrauber, vielen Dank für die Hilfe. Alles erledigt und momentan auch keine weiteren Probleme. Liebe Grüße Holger |
|
25.02.2014, 17:17
| #14 |
| /// the machine /// TB-Ausbilder | Probleme beim Hochfahren und zunehmende Anzahl der Abstürze Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Probleme beim Hochfahren und zunehmende Anzahl der Abstürze |
| adblock, antivirus, avg antivirus, blackhole, bonjour, bootschleife, branding, browser, continue, converter, cpu-z, dvdvideosoft ltd., einstellungen, emsisoft, entfernen, excel, failed, firefox, flash player, homepage, icreinstall, iexplore.exe, logfile, minidump, mipony, mozilla, registry, robot, scan, security, services.exe, shark, software, starten, svchost.exe, system, windows, windows xp |
Linear-Darstellung
