![]() |
|
Plagegeister aller Art und deren Bekämpfung: Habe Oxy-Virus auf dem PCWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() |
|
![]() | #1 |
| ![]() Habe Oxy-Virus auf dem PC Leider habe ich immer noch Probleme mit dem Virus ![]() Nach dem Hochfahren öffnet sich von selbst das Programm Pilefile Reminder obwohl ich es bereits mit Revo deinstalliert habe. Außerdem kommt wenn ich Chrome öffne als Startseite Qone8. Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=5be304ba45247f479ca95065cbc17722 # engine=17724 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-04-02 05:25:21 # local_time=2014-04-02 07:25:21 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776573 100 94 96052 148089371 0 0 # scanned=256057 # found=1 # cleaned=0 # scan_time=16112 sh=B70F371A8C6416FC7C9735F478FC3EEF399B1F27 ft=1 fh=d73ad9000665fbf8 vn="multiple threats" ac=I fn="C:\Windows\Temp\RegistryOptimizer.exe" Code:
ATTFilter Results of screen317's Security Check version 0.99.80 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` G Data InternetSecurity 2014 Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` JavaFX 2.1.1 Java 7 Update 51 Adobe Flash Player 12.0.0.77 Adobe Reader 10.1.9 Adobe Reader out of Date! Google Chrome 33.0.1750.154 ````````Process Check: objlist.exe by Laurent```````` G Data InternetSecurity Firewall GDFwSvcx64.exe G Data InternetSecurity Firewall GDFirewallTray.exe Symantec Norton Online Backup NOBuAgent.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Paula-chan (administrator) on PAULA-CHAN-PC on 02-04-2014 20:17:36 Running from C:\Users\Paula-chan\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe (AMD) C:\Windows\system32\atiesrxx.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe (AMD) C:\Windows\system32\atieclxx.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe (Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe (Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe (CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe (NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Intel Corporation) C:\Windows\system32\igfxext.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe () C:\Program Files\Rainmeter\Rainmeter.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe (CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe () C:\Program Files (x86)\Bamboo Dock\BambooCore.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (APN LLC.) C:\Users\Paula-chan\AppData\Local\VNT\vntldr.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe (Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe (Cherished Technololgy LIMITED) C:\ProgramData\IePluginService\PluginService.exe (VS Revo Group) C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [IntelTBRunOnce] - wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-12] (ELAN Microelectronics Corp.) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor) HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831016 2011-08-02] (Acer Incorporated) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated) HKLM\...\Run: [PLFSetL] - C:\Windows\\PLFSetL.exe HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [297280 2011-04-24] (NTI Corporation) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-13] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.) HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.) HKLM-x32\...\Run: [ArcadeMovieService] - C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [177448 2011-08-26] (CyberLink Corp.) HKLM-x32\...\Run: [GDFirewallTray] - C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1854928 2013-03-22] (G Data Software AG) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [BambooCore] - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646744 2012-12-11] () HKLM-x32\...\Run: [G Data AntiVirus Tray] - C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe [1444472 2013-08-21] (G Data Software AG) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [196048 2014-03-19] (APN LLC.) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe, Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid} HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid} HKU\S-1-5-21-1307518205-1141766383-1528977106-1000\...\Run: [uTorrent] - "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED HKU\S-1-5-21-1307518205-1141766383-1528977106-1000\...\Run: [Google+ Auto Backup] - "C:\Users\Paula-chan\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe" /autostart AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => "C:\PROGRA~2\SupTab\SEARCH~1.DLL" File Not Found Startup: C:\Users\Paula-chan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\Paula-chan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.qone8.com/?type=hp&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.qone8.com/?type=hp&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.qone8.com/?type=hp&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX&q={searchTerms} URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046} URLSearchHook: HKCU - (No Name) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - No File StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.qone8.com/web/?type=ds&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.qone8.com/web/?type=ds&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX&q={searchTerms} SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.qone8.com/web/?type=ds&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX&q={searchTerms} SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.qone8.com/web/?type=ds&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX&q={searchTerms} BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: ICQ Sparberater - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh) BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Paula-chan\AppData\Roaming\Mozilla\Firefox\Profiles\vrkrs3uy.default FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @logitech.com/HarmonyRemote,version=1.0.0 - C:\Program Files (x86)\Logitech\Harmony Remote Driver\NprtHarmonyPlugin.dll (Logitech Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.10 - C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.) FF Plugin-x32: @wacom.com/wtPlugin,version=2.0.0.1 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll () FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR Extension: (Ask Toolbar) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaajepeddfdaihpmdgnickofffkdlpb [2014-03-31] CHR Extension: (Theme Creator) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\akpelnjfckgfiplcikojhomllgombffc [2014-03-31] CHR Extension: (Google Docs) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-31] CHR Extension: (Google Drive) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-31] CHR Extension: (YouTube) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-31] CHR Extension: (Google-Suche) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-31] CHR Extension: (AdBlock) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-03-31] CHR Extension: (Akira Isogawa) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\igmggajponoffjmhekbonemlgidfgdao [2014-03-31] CHR Extension: (Auto Replay for YouTube™) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\kanbnempkjnhadplbfgdaagijdbdbjeb [2014-03-31] CHR Extension: (Little Alchemy) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\knkapnclbofjjgicpkfoagdjohlfjhpd [2014-03-31] CHR Extension: (Google Wallet) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-31] CHR Extension: (Google Mail) - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-31] CHR HKCU\...\Chrome\Extension: [anpiogajjmckmlehhpjnojhebaidkeod] - C:\Users\Paula-chan\AppData\Local\CRE\anpiogajjmckmlehhpjnojhebaidkeod.crx [2014-03-31] CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2014-03-31] CHR HKLM-x32\...\Chrome\Extension: [aaaajepeddfdaihpmdgnickofffkdlpb] - C:\ProgramData\AskPartnerNetwork\Toolbar\FF3-V7\CRX\ToolbarCR.crx [2014-03-31] CHR HKLM-x32\...\Chrome\Extension: [anpiogajjmckmlehhpjnojhebaidkeod] - C:\Users\Paula-chan\AppData\Local\CRE\anpiogajjmckmlehhpjnojhebaidkeod.crx [2014-03-31] CHR HKLM-x32\...\Chrome\Extension: [omaonpoimgkmbllpdihbnmgphjoipdhf] - C:\Program Files (x86)\Logitech\Harmony Remote Driver\harmony_chrome.crx [2012-12-24] CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Paula-chan\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-04-02] CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://start.qone8.com/?type=sc&ts=1396461871&from=mp3&uid=HitachiXHTS547550A9E384_J2150050HNW4PCHNW4PCX ==================== Services (Whitelisted) ================= R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1970296 2013-08-26] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [635000 2013-08-21] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2562208 2013-10-15] (G Data Software AG) R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2942808 2013-10-17] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [695416 2013-08-22] (G Data Software AG) R2 IePluginService; C:\ProgramData\IePluginService\PluginService.exe [688240 2014-03-31] (Cherished Technololgy LIMITED) R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation) R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation) R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [496640 2014-04-02] (Cherished Technololgy LIMITED) R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [619904 2012-12-11] (Wacom Technology, Corp.) S2 MOBKbackup; "C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe" [X] ==================== Drivers (Whitelisted) ==================== R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [60248 2014-03-18] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [130392 2014-03-18] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [63320 2014-03-18] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64856 2014-03-18] (G Data Software AG) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65368 2014-03-18] (G Data Software AG) R1 MOBKFilter; C:\Windows\System32\DRIVERS\MOBK.sys [66040 2010-04-13] (Mozy, Inc.) S3 wacommousefilter; system32\DRIVERS\wacommousefilter.sys [X] S3 wacomvhid; system32\DRIVERS\wacomvhid.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-02 20:07 - 2014-04-02 20:07 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\SupTab 2014-04-02 20:07 - 2014-04-02 20:07 - 00000000 ____D () C:\ProgramData\IePluginService 2014-04-02 20:07 - 2014-04-02 20:07 - 00000000 ____D () C:\Program Files (x86)\SupTab 2014-04-02 20:06 - 2014-04-02 20:06 - 00000000 ____D () C:\ProgramData\WPM 2014-04-02 20:04 - 2014-04-02 20:04 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\qone8 2014-04-02 19:38 - 2014-04-02 19:38 - 00000979 _____ () C:\Users\Paula-chan\Documents\checkup.txt 2014-04-02 19:32 - 2014-04-02 19:32 - 00987442 _____ () C:\Users\Paula-chan\Downloads\SecurityCheck.exe 2014-04-02 19:32 - 2014-04-02 19:32 - 00987442 _____ () C:\Users\Paula-chan\Desktop\SecurityCheck.exe 2014-04-02 14:28 - 2014-04-02 14:28 - 00000851 _____ () C:\Users\Paula-chan\.recently-used.xbel 2014-04-01 16:54 - 2014-04-01 16:54 - 00015178 _____ () C:\Users\Paula-chan\Documents\JRT.txt 2014-04-01 16:47 - 2014-04-01 16:47 - 01038974 _____ (Thisisu) C:\Users\Paula-chan\Downloads\JRT.exe 2014-04-01 16:44 - 2014-04-01 16:44 - 00000000 ____D () C:\Windows\ERUNT 2014-04-01 16:34 - 2014-04-01 16:34 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Oxy 2014-04-01 16:32 - 2014-04-01 16:32 - 00034566 _____ () C:\Users\Paula-chan\Documents\AdwCleaner[S0].txt 2014-04-01 16:31 - 2014-04-02 20:04 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\Oxy 2014-04-01 16:19 - 2014-04-01 16:21 - 00000000 ____D () C:\AdwCleaner 2014-04-01 16:18 - 2014-04-01 16:18 - 00001160 _____ () C:\Users\Paula-chan\Documents\mbam.txt 2014-04-01 14:45 - 2014-04-01 14:45 - 01426178 _____ () C:\Users\Paula-chan\Downloads\adwcleaner.exe 2014-04-01 14:09 - 2014-04-01 14:09 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-04-01 14:08 - 2014-04-01 14:08 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Paula-chan\Downloads\revosetup95.exe 2014-03-31 21:02 - 2014-03-31 21:04 - 00041599 _____ () C:\Users\Paula-chan\Downloads\Addition.txt 2014-03-31 21:01 - 2014-04-02 20:17 - 00022766 _____ () C:\Users\Paula-chan\Downloads\FRST.txt 2014-03-31 21:00 - 2014-04-02 20:17 - 00000000 ____D () C:\FRST 2014-03-31 20:59 - 2014-03-31 20:59 - 02157056 _____ (Farbar) C:\Users\Paula-chan\Downloads\FRST64.exe 2014-03-31 20:59 - 2014-03-31 20:59 - 00000482 _____ () C:\Users\Paula-chan\Downloads\defogger_disable.log 2014-03-31 20:59 - 2014-03-31 20:59 - 00000000 _____ () C:\Users\Paula-chan\defogger_reenable 2014-03-31 20:58 - 2014-03-31 20:58 - 00050477 _____ () C:\Users\Paula-chan\Downloads\Defogger.exe 2014-03-31 20:17 - 2014-04-01 20:18 - 00000000 ___RD () C:\Users\Paula-chan\Desktop\Programme 2014-03-31 19:52 - 2014-04-02 19:57 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-31 19:52 - 2014-03-31 19:52 - 00004114 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-03-31 19:52 - 2014-03-31 19:52 - 00003862 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-03-31 19:51 - 2014-04-02 19:59 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-31 19:39 - 2014-03-31 19:42 - 00000000 ____D () C:\Users\Paula-chan\Documents\Default 2014-03-31 15:54 - 2014-04-01 14:26 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-03-31 15:54 - 2014-03-31 15:54 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-31 15:54 - 2014-03-31 15:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-03-31 15:54 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-31 15:54 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-31 15:54 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-31 15:51 - 2014-03-31 15:53 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Paula-chan\Downloads\mbam-setup-2.0.0.1000.exe 2014-03-31 15:47 - 2014-03-31 15:47 - 00271720 _____ () C:\Windows\Minidump\033114-31808-01.dmp 2014-03-31 15:24 - 2014-03-31 15:24 - 00000000 ____D () C:\ProgramData\CDB 2014-03-31 15:23 - 2014-03-31 15:25 - 00000000 ____D () C:\rei 2014-03-31 15:23 - 2014-03-31 15:23 - 00000000 ____D () C:\Program Files\Reimage 2014-03-31 15:20 - 2014-03-31 15:25 - 00000155 _____ () C:\Windows\Reimage.ini 2014-03-31 15:03 - 2014-03-31 15:03 - 00003622 _____ () C:\Windows\System32\Tasks\Oxy 2014-03-31 15:02 - 2014-03-31 15:02 - 00003630 _____ () C:\Windows\System32\Tasks\PileFile reminder 2014-03-31 15:02 - 2014-03-31 15:02 - 00003240 _____ () C:\Windows\System32\Tasks\PileFile logon 2014-03-27 21:51 - 2014-03-29 17:32 - 00000000 ____D () C:\Users\Paula-chan\Documents\Movie Studio Platinum 13.0 Projects 2014-03-27 21:45 - 2014-03-27 21:45 - 00000000 ____D () C:\Program Files\Sony 2014-03-23 15:49 - 2014-03-23 15:49 - 00000000 ____D () C:\Program Files (x86)\directx 2014-03-23 15:48 - 2014-03-23 15:48 - 00000000 ____D () C:\Program Files (x86)\Rockstar Games 2014-03-20 23:18 - 2014-03-20 23:18 - 00000000 ____D () C:\Users\Paula-chan\Downloads\kage_pro_osu_skin_by_juvia_fullbuster_by_lyra_kizzle08-d6vf3in 2014-03-18 21:37 - 2014-03-18 21:37 - 02700064 _____ () C:\Users\Paula-chan\Downloads\colour_me___challenge_by_ryky-d7aop7x.psd 2014-03-17 23:22 - 2014-03-18 21:26 - 00274419 _____ () C:\Users\Paula-chan\Documents\april.odt 2014-03-16 13:46 - 2014-03-20 21:09 - 03421415 _____ () C:\Users\Paula-chan\Documents\bday.odt 2014-03-14 17:34 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-14 17:34 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-14 17:34 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-14 17:34 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-14 17:34 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-14 17:34 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-14 17:34 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-14 17:34 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-14 17:34 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-14 17:34 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-14 17:34 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-14 17:34 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-14 17:34 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-14 17:34 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-14 17:34 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-14 17:34 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-14 17:34 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-14 17:34 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-14 17:34 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-14 17:34 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-14 17:34 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-14 17:34 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-14 17:34 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-14 17:34 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-14 17:34 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-14 17:34 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-14 17:34 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-14 17:34 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-14 17:34 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-14 17:34 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-14 17:34 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-14 17:34 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-14 17:34 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-14 17:34 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-14 17:34 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-14 17:34 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-14 17:34 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-14 17:34 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-14 17:34 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-14 17:34 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-03-14 17:34 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-14 17:34 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-03-14 17:34 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2014-03-14 17:34 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-03-14 17:32 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-14 17:32 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-14 17:32 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-14 17:32 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll ==================== One Month Modified Files and Folders ======= 2014-04-02 20:18 - 2014-03-31 21:01 - 00022766 _____ () C:\Users\Paula-chan\Downloads\FRST.txt 2014-04-02 20:17 - 2014-03-31 21:00 - 00000000 ____D () C:\FRST 2014-04-02 20:17 - 2012-04-05 15:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-02 20:07 - 2014-04-02 20:07 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\SupTab 2014-04-02 20:07 - 2014-04-02 20:07 - 00000000 ____D () C:\ProgramData\IePluginService 2014-04-02 20:07 - 2014-04-02 20:07 - 00000000 ____D () C:\Program Files (x86)\SupTab 2014-04-02 20:07 - 2011-06-11 01:58 - 00773680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll 2014-04-02 20:07 - 2011-06-11 01:58 - 00420912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll 2014-04-02 20:07 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-02 20:07 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-02 20:06 - 2014-04-02 20:06 - 00000000 ____D () C:\ProgramData\WPM 2014-04-02 20:04 - 2014-04-02 20:04 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\qone8 2014-04-02 20:04 - 2014-04-01 16:31 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\Oxy 2014-04-02 20:04 - 2012-02-02 22:18 - 00001219 _____ () C:\Users\Paula-chan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-04-02 20:01 - 2012-02-03 16:03 - 00000000 ____D () C:\ProgramData\clear.fi 2014-04-02 19:59 - 2014-03-31 19:51 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-04-02 19:59 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-02 19:59 - 2009-07-14 06:51 - 00128703 _____ () C:\Windows\setupact.log 2014-04-02 19:58 - 2010-11-21 05:47 - 00678474 _____ () C:\Windows\PFRO.log 2014-04-02 19:57 - 2014-03-31 19:52 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-04-02 19:57 - 2011-12-13 11:17 - 01364399 _____ () C:\Windows\WindowsUpdate.log 2014-04-02 19:38 - 2014-04-02 19:38 - 00000979 _____ () C:\Users\Paula-chan\Documents\checkup.txt 2014-04-02 19:32 - 2014-04-02 19:32 - 00987442 _____ () C:\Users\Paula-chan\Downloads\SecurityCheck.exe 2014-04-02 19:32 - 2014-04-02 19:32 - 00987442 _____ () C:\Users\Paula-chan\Desktop\SecurityCheck.exe 2014-04-02 19:25 - 2011-12-13 20:10 - 00700134 _____ () C:\Windows\system32\perfh007.dat 2014-04-02 19:25 - 2011-12-13 20:10 - 00149984 _____ () C:\Windows\system32\perfc007.dat 2014-04-02 19:25 - 2009-07-14 07:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-02 14:50 - 2012-02-22 13:02 - 00000000 ____D () C:\Users\Paula-chan\.gimp-2.6 2014-04-02 14:28 - 2014-04-02 14:28 - 00000851 _____ () C:\Users\Paula-chan\.recently-used.xbel 2014-04-02 14:28 - 2012-02-02 22:16 - 00000000 ____D () C:\Users\Paula-chan 2014-04-01 22:26 - 2012-02-27 23:18 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\SoftGrid Client 2014-04-01 20:18 - 2014-03-31 20:17 - 00000000 ___RD () C:\Users\Paula-chan\Desktop\Programme 2014-04-01 16:54 - 2014-04-01 16:54 - 00015178 _____ () C:\Users\Paula-chan\Documents\JRT.txt 2014-04-01 16:47 - 2014-04-01 16:47 - 01038974 _____ (Thisisu) C:\Users\Paula-chan\Downloads\JRT.exe 2014-04-01 16:44 - 2014-04-01 16:44 - 00000000 ____D () C:\Windows\ERUNT 2014-04-01 16:34 - 2014-04-01 16:34 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Oxy 2014-04-01 16:32 - 2014-04-01 16:32 - 00034566 _____ () C:\Users\Paula-chan\Documents\AdwCleaner[S0].txt 2014-04-01 16:21 - 2014-04-01 16:19 - 00000000 ____D () C:\AdwCleaner 2014-04-01 16:20 - 2012-02-05 15:22 - 00000000 ____D () C:\ProgramData\ICQ 2014-04-01 16:18 - 2014-04-01 16:18 - 00001160 _____ () C:\Users\Paula-chan\Documents\mbam.txt 2014-04-01 14:45 - 2014-04-01 14:45 - 01426178 _____ () C:\Users\Paula-chan\Downloads\adwcleaner.exe 2014-04-01 14:26 - 2014-03-31 15:54 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-01 14:09 - 2014-04-01 14:09 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-04-01 14:08 - 2014-04-01 14:08 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Paula-chan\Downloads\revosetup95.exe 2014-03-31 21:04 - 2014-03-31 21:02 - 00041599 _____ () C:\Users\Paula-chan\Downloads\Addition.txt 2014-03-31 20:59 - 2014-03-31 20:59 - 02157056 _____ (Farbar) C:\Users\Paula-chan\Downloads\FRST64.exe 2014-03-31 20:59 - 2014-03-31 20:59 - 00000482 _____ () C:\Users\Paula-chan\Downloads\defogger_disable.log 2014-03-31 20:59 - 2014-03-31 20:59 - 00000000 _____ () C:\Users\Paula-chan\defogger_reenable 2014-03-31 20:58 - 2014-03-31 20:58 - 00050477 _____ () C:\Users\Paula-chan\Downloads\Defogger.exe 2014-03-31 19:57 - 2012-04-30 18:19 - 00000000 ____D () C:\Users\Paula-chan\AppData\Local\Google 2014-03-31 19:54 - 2012-08-01 17:57 - 00000000 ____D () C:\Program Files (x86)\Google 2014-03-31 19:52 - 2014-03-31 19:52 - 00004114 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-03-31 19:52 - 2014-03-31 19:52 - 00003862 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-03-31 19:42 - 2014-03-31 19:39 - 00000000 ____D () C:\Users\Paula-chan\Documents\Default 2014-03-31 18:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help 2014-03-31 15:54 - 2014-03-31 15:54 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-31 15:54 - 2014-03-31 15:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-03-31 15:53 - 2014-03-31 15:51 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Paula-chan\Downloads\mbam-setup-2.0.0.1000.exe 2014-03-31 15:47 - 2014-03-31 15:47 - 00271720 _____ () C:\Windows\Minidump\033114-31808-01.dmp 2014-03-31 15:47 - 2012-06-28 20:20 - 00000000 ____D () C:\Windows\Minidump 2014-03-31 15:47 - 2012-06-28 20:19 - 401884526 _____ () C:\Windows\MEMORY.DMP 2014-03-31 15:25 - 2014-03-31 15:23 - 00000000 ____D () C:\rei 2014-03-31 15:25 - 2014-03-31 15:20 - 00000155 _____ () C:\Windows\Reimage.ini 2014-03-31 15:24 - 2014-03-31 15:24 - 00000000 ____D () C:\ProgramData\CDB 2014-03-31 15:23 - 2014-03-31 15:23 - 00000000 ____D () C:\Program Files\Reimage 2014-03-31 15:03 - 2014-03-31 15:03 - 00003622 _____ () C:\Windows\System32\Tasks\Oxy 2014-03-31 15:02 - 2014-03-31 15:02 - 00003630 _____ () C:\Windows\System32\Tasks\PileFile reminder 2014-03-31 15:02 - 2014-03-31 15:02 - 00003240 _____ () C:\Windows\System32\Tasks\PileFile logon 2014-03-29 17:32 - 2014-03-27 21:51 - 00000000 ____D () C:\Users\Paula-chan\Documents\Movie Studio Platinum 13.0 Projects 2014-03-28 17:19 - 2014-01-26 21:36 - 00000000 ____D () C:\Users\Paula-chan\AppData\Local\VNT 2014-03-27 22:30 - 2012-02-08 18:01 - 00000000 ____D () C:\ProgramData\Sony 2014-03-27 22:29 - 2012-02-08 17:02 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\Sony 2014-03-27 22:21 - 2012-02-08 17:03 - 00000000 ____D () C:\Program Files (x86)\Sony 2014-03-27 21:45 - 2014-03-27 21:45 - 00000000 ____D () C:\Program Files\Sony 2014-03-27 20:58 - 2014-01-26 21:36 - 00000000 ____D () C:\Program Files (x86)\VNT 2014-03-24 21:03 - 2013-05-16 18:18 - 00000000 ___RD () C:\Users\Paula-chan\Desktop\Games 2014-03-24 11:51 - 2012-09-27 20:38 - 00000000 ____D () C:\Users\Paula-chan\Documents\Schule 2014-03-23 21:47 - 2012-02-05 16:01 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\vlc 2014-03-23 15:49 - 2014-03-23 15:49 - 00000000 ____D () C:\Program Files (x86)\directx 2014-03-23 15:49 - 2011-10-20 11:07 - 00029527 _____ () C:\Windows\DirectX.log 2014-03-23 15:48 - 2014-03-23 15:48 - 00000000 ____D () C:\Program Files (x86)\Rockstar Games 2014-03-23 15:48 - 2011-10-20 10:18 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-03-23 15:47 - 2013-10-29 14:39 - 00000000 ____D () C:\Users\Paula-chan\Downloads\Games 2014-03-21 13:07 - 2012-06-09 12:30 - 00000000 ____D () C:\Program Files (x86)\osu! 2014-03-20 23:18 - 2014-03-20 23:18 - 00000000 ____D () C:\Users\Paula-chan\Downloads\kage_pro_osu_skin_by_juvia_fullbuster_by_lyra_kizzle08-d6vf3in 2014-03-20 21:09 - 2014-03-16 13:46 - 03421415 _____ () C:\Users\Paula-chan\Documents\bday.odt 2014-03-20 12:42 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-18 23:49 - 2013-08-14 23:58 - 00000000 ____D () C:\Windows\system32\MRT 2014-03-18 23:47 - 2012-04-24 16:26 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-03-18 21:37 - 2014-03-18 21:37 - 02700064 _____ () C:\Users\Paula-chan\Downloads\colour_me___challenge_by_ryky-d7aop7x.psd 2014-03-18 21:30 - 2013-06-01 15:09 - 00065368 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2014-03-18 21:30 - 2012-04-01 22:35 - 00130392 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-03-18 21:30 - 2012-04-01 22:35 - 00064856 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-03-18 21:30 - 2012-04-01 22:35 - 00063320 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2014-03-18 21:30 - 2012-04-01 22:35 - 00060248 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2014-03-18 21:26 - 2014-03-17 23:22 - 00274419 _____ () C:\Users\Paula-chan\Documents\april.odt 2014-03-17 23:22 - 2013-09-23 21:17 - 00000000 ____D () C:\Users\Paula-chan\Documents\Sonstiges 2014-03-16 13:29 - 2012-09-27 20:37 - 00000000 ____D () C:\Users\Paula-chan\Documents\Zeichnungen 2014-03-16 12:13 - 2009-07-14 06:45 - 00354000 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-16 12:12 - 2013-03-14 20:46 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-16 12:12 - 2013-03-14 20:46 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-15 21:33 - 2013-10-11 13:33 - 00000000 ____D () C:\Users\Paula-chan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft AppLocale 2014-03-12 19:04 - 2012-02-07 21:05 - 00000000 ____D () C:\Users\Paula-chan\AppData\Local\Adobe 2014-03-12 19:03 - 2012-04-05 15:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-12 19:03 - 2012-04-05 15:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-12 19:03 - 2011-10-20 11:22 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-05 09:26 - 2014-03-31 15:54 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-05 09:26 - 2014-03-31 15:54 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-05 09:26 - 2014-03-31 15:54 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys Some content of TEMP: ==================== C:\Users\Paula-chan\AppData\Local\Temp\ApnStub.exe C:\Users\Paula-chan\AppData\Local\Temp\AskPIP_FF_.exe C:\Users\Paula-chan\AppData\Local\Temp\AskSLib.dll C:\Users\Paula-chan\AppData\Local\Temp\contentDATs.exe C:\Users\Paula-chan\AppData\Local\Temp\dotNetFx35setup.exe C:\Users\Paula-chan\AppData\Local\Temp\drm_dialogs.dll C:\Users\Paula-chan\AppData\Local\Temp\drm_dyndata_7380007.dll C:\Users\Paula-chan\AppData\Local\Temp\GuardICQ.exe C:\Users\Paula-chan\AppData\Local\Temp\htmlayout.dll C:\Users\Paula-chan\AppData\Local\Temp\incredibar_installer.exe C:\Users\Paula-chan\AppData\Local\Temp\IZArc4.1.6.exe C:\Users\Paula-chan\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe C:\Users\Paula-chan\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe C:\Users\Paula-chan\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe C:\Users\Paula-chan\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\Paula-chan\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\Paula-chan\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\Paula-chan\AppData\Local\Temp\jre-7u5-windows-i586-iftw.exe C:\Users\Paula-chan\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Paula-chan\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe C:\Users\Paula-chan\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe C:\Users\Paula-chan\AppData\Local\Temp\Keygen.exe C:\Users\Paula-chan\AppData\Local\Temp\MyBabylonTB_I.exe C:\Users\Paula-chan\AppData\Local\Temp\Quarantine.exe C:\Users\Paula-chan\AppData\Local\Temp\ReimagePackage.exe C:\Users\Paula-chan\AppData\Local\Temp\SecurityScan_Release.exe C:\Users\Paula-chan\AppData\Local\Temp\setup.exe C:\Users\Paula-chan\AppData\Local\Temp\SIMEEIInstaller.exe C:\Users\Paula-chan\AppData\Local\Temp\tbDVDV.dll C:\Users\Paula-chan\AppData\Local\Temp\tbuTor.dll C:\Users\Paula-chan\AppData\Local\Temp\tmp360F.exe C:\Users\Paula-chan\AppData\Local\Temp\tmp4B76.exe C:\Users\Paula-chan\AppData\Local\Temp\tmp4DB5.exe C:\Users\Paula-chan\AppData\Local\Temp\tmp6327.tmp.exe C:\Users\Paula-chan\AppData\Local\Temp\tmp7916.tmp.exe C:\Users\Paula-chan\AppData\Local\Temp\tmpAB5F.tmp.exe C:\Users\Paula-chan\AppData\Local\Temp\tmpDB71.exe C:\Users\Paula-chan\AppData\Local\Temp\uninst.exe C:\Users\Paula-chan\AppData\Local\Temp\UpdateCheckerSetup.exe C:\Users\Paula-chan\AppData\Local\Temp\vlc-2.0.5-win32.exe C:\Users\Paula-chan\AppData\Local\Temp\vlc-2.0.6-win32.exe C:\Users\Paula-chan\AppData\Local\Temp\vlc-2.0.7-win32.exe C:\Users\Paula-chan\AppData\Local\Temp\vlc-2.0.8-win32.exe C:\Users\Paula-chan\AppData\Local\Temp\vpsetup.exe C:\Users\Paula-chan\AppData\Local\Temp\_is2970.exe C:\Users\Paula-chan\AppData\Local\Temp\_is5D0D.exe C:\Users\Paula-chan\AppData\Local\Temp\_is6ED9.exe C:\Users\Paula-chan\AppData\Local\Temp\_isA1DA.exe C:\Users\Paula-chan\AppData\Local\Temp\_isBFD5.exe C:\Users\Paula-chan\AppData\Local\Temp\_isD81.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-01-20 19:23 ==================== End Of Log ============================ |
![]() |
Themen zu Habe Oxy-Virus auf dem PC |
deinstallieren, oxy virus maleware, programme, schädliche |