| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Unbekannter Schädling(blockiert Malwarebytes&Antivir&Systemwiederherstellung)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
15.05.2014, 13:18
| #31 |
 |  Unbekannter Schädling(blockiert Malwarebytes&Antivir&Systemwiederherstellung) Also einige Sachen wurden behoben, andere jedoch nicht. Als der PC voller Viren war, und ich z.B. Combofix auf den Destktop gezogen habe, wurde es gleich so grau und es kam beim klicken die Fehlermeldung (Bild Zugriffsverweigerung) Jetzt aber ist das alte Combofixsymbol nicht löschbar (Bild Admin Rechte). Wenn ich dann auf fortsetzen klicke kommt (Bild Rechte 2). Das Problem also, ein Paar Symbole lassen sich nicht verschieben oder löschen, da ich anscheinend keine Admin Rechte habe (obwohl ich der Admin bin und es nur 1 Konto auf dem PC gibt) Und Malwarebytes lässt sich nicht Installieren  (Bild Malware)Dann versuchte ich neu vom USB auf den PC OTL zu schieben, wuhuu, das ging. Also machte ich gleich ein Scan..so wie es hier beschrieben wird HTML-Code: [URL]http://www.trojaner-board.de/85104-otl-otlogfile-by-oldtimer.html[/URL] Der OTL Logfile ist zu lange, also musste ich ihn leider so hochladen. Nach dem hat es mich einfach gezuckt ob ob das gleiche mit Combofix erledigen kann..und es ging (Ich weiss, man darf des nicht benutzen ohne eine Anweisung aber ich war ziemlich wütend und das ganze regt mich langsam auf  )Also startete ich Combofix und es ging.. Code:
ATTFilter ComboFix 14-05-13.01 - zagreb 15.05.2014 13:38:35.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.41.1031.18.8174.6167 [GMT 2:00]
ausgeführt von:: c:\users\zagreb\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Free Games 111\ScRIpthost.dll
c:\users\Public\AlexaNSISPlugin.6408.dll
c:\users\zagreb\AppData\Local\Temp\_MEI39962\_ctypes.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\_elementtree.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\_hashlib.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\_multiprocessing.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\_socket.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\_ssl.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\pyexpat.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\pysqlite2._sqlite.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\python27.dll
c:\users\zagreb\AppData\Local\Temp\_MEI39962\pythoncom27.dll
c:\users\zagreb\AppData\Local\Temp\_MEI39962\PyWinTypes27.dll
c:\users\zagreb\AppData\Local\Temp\_MEI39962\select.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\unicodedata.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32api.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32com.shell.shell.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32crypt.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32event.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32file.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32gui.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32inet.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32pdh.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32pipe.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32process.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32profile.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32security.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\win32ts.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\windows._lib_cacheinvalidation.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wx._animate.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wx._controls_.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wx._core_.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wx._gdi_.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wx._html2.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wx._misc_.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wx._windows_.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wx._wizard.pyd
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wxbase294u_net_vc90.dll
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wxbase294u_vc90.dll
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wxmsw294u_adv_vc90.dll
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wxmsw294u_core_vc90.dll
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wxmsw294u_html_vc90.dll
c:\users\zagreb\AppData\Local\Temp\_MEI39962\wxmsw294u_webview_vc90.dll
c:\users\zagreb\AppData\Roaming\WindowsHelp
c:\users\zagreb\AppData\Roaming\WindowsHelp\coinutil.dll
c:\users\zagreb\AppData\Roaming\WindowsHelp\killer.bat
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\compile.bat
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part10
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part11
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part12
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part13
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part14
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part15
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part16
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part17
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part18
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part19
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part2
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part20
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part21
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part22
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part23
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part24
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part25
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part26
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part27
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part28
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part29
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part3
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part30
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part31
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part32
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part33
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part34
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part35
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part36
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part37
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part38
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part39
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part4
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part40
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part41
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part42
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part43
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part44
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part45
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part46
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part47
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part48
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part49
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part5
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part50
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part51
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part52
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part53
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part54
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part55
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part56
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part57
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part58
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part59
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part6
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part60
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part61
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part62
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part63
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part64
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part65
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part66
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part67
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part68
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part69
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part7
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part70
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part71
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part72
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part73
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part74
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part75
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part76
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part77
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part78
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part79
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part8
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part80
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part81
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part82
c:\users\zagreb\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part9
c:\users\zagreb\AppData\Roaming\WindowsHelp\macromedia.exe
c:\users\zagreb\AppData\Roaming\WindowsHelp\miner.dll
c:\users\zagreb\AppData\Roaming\WindowsHelp\openssl.dll
c:\users\zagreb\AppData\Roaming\WindowsHelp\phatk.cl
c:\users\zagreb\AppData\Roaming\WindowsHelp\phatk.ptx
c:\users\zagreb\AppData\Roaming\WindowsHelp\puts.vbs
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\compile.bat
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part10
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part11
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part12
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part13
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part14
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part15
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part16
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part17
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part18
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part19
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part2
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part20
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part21
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part22
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part23
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part24
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part25
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part26
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part27
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part28
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part29
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part3
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part30
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part31
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part32
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part33
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part34
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part35
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part36
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part37
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part38
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part39
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part4
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part40
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part41
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part42
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part43
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part44
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part45
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part46
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part47
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part48
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part49
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part5
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part50
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part51
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part52
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part53
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part54
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part55
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part56
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part57
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part58
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part59
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part6
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part60
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part61
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part62
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part63
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part64
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part65
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part66
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part67
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part68
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part69
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part7
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part70
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part71
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part72
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part73
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part74
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part75
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part76
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part77
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part78
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part79
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part8
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part80
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part81
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part82
c:\users\zagreb\AppData\Roaming\WindowsHelp\shel\shell.exe_part9
c:\users\zagreb\AppData\Roaming\WindowsHelp\shell.exe
c:\users\zagreb\AppData\Roaming\WindowsHelp\usft_ext.dll
c:\users\zagreb\BalTax2013_installieren.exe
c:\windows\RazorDOX
c:\windows\RazorDOX\RazorDOX.dll
D:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-04-15 bis 2014-05-15 ))))))))))))))))))))))))))))))
.
.
2014-05-13 10:06 . 2014-05-13 10:22 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-05-12 11:06 . 2014-05-13 10:06 119000 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-12 11:04 . 2014-05-13 10:06 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-05-10 10:04 . 2014-04-29 14:01 23547904 ----a-w- c:\windows\system32\mshtml.dll
2014-05-10 10:04 . 2014-04-29 13:40 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-10 10:04 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-05-08 17:45 . 2014-04-14 02:24 465408 ----a-w- c:\windows\system32\aepdu.dll
2014-05-08 17:45 . 2014-04-14 02:19 424448 ----a-w- c:\windows\system32\aeinv.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-15 10:41 . 2012-04-08 18:24 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-05-15 10:41 . 2011-07-13 19:59 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-10 22:02 . 2011-02-10 20:56 90655440 ----a-w- c:\windows\system32\MRT.exe
2014-03-21 10:52 . 2014-03-19 22:26 49952 ----a-w- c:\windows\system32\drivers\avgtpx64.sys
2014-03-04 09:44 . 2014-04-10 19:07 362496 ----a-w- c:\windows\system32\wow64win.dll
2014-03-04 09:44 . 2014-04-10 19:07 243712 ----a-w- c:\windows\system32\wow64.dll
2014-03-04 09:44 . 2014-04-10 19:07 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2014-03-04 09:44 . 2014-04-10 19:07 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2014-03-04 09:44 . 2014-04-10 19:07 1163264 ----a-w- c:\windows\system32\kernel32.dll
2014-03-04 09:17 . 2014-04-10 19:07 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2014-03-04 09:17 . 2014-04-10 19:07 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-03-04 09:16 . 2014-04-10 19:07 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2014-03-04 09:16 . 2014-04-10 19:07 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2014-03-04 08:09 . 2014-04-10 19:07 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2014-03-04 08:09 . 2014-04-10 19:07 2048 ----a-w- c:\windows\SysWow64\user.exe
2014-02-17 00:32 . 2014-03-07 18:00 10536864 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1C564539-BC91-4061-8BA0-30527BE89AC7}\mpengine.dll
2012-05-11 13:16 . 2012-05-11 13:16 171520 ----a-w- c:\program files (x86)\Common Files\dsfOggDemux2.dll
2011-04-18 21:51 . 2011-04-18 21:51 653136 ----a-w- c:\program files (x86)\Common Files\MSVCR90.dll
2011-04-18 21:51 . 2011-04-18 21:51 569680 ----a-w- c:\program files (x86)\Common Files\MSVCP90.dll
2011-01-12 01:00 . 2011-01-12 01:00 30208 ----a-w- c:\program files (x86)\Common Files\wmpinfo.dll
2011-01-12 01:00 . 2011-01-12 01:00 240128 ----a-w- c:\program files (x86)\Common Files\dsfVorbisDecoder.dll
2011-01-12 01:00 . 2011-01-12 01:00 146944 ----a-w- c:\program files (x86)\Common Files\dsfFLACDecoder.dll
2011-01-12 01:00 . 2011-01-12 01:00 221184 ----a-w- c:\program files (x86)\Common Files\dsfFLACEncoder.dll
2011-01-12 01:00 . 2011-01-12 01:00 204800 ----a-w- c:\program files (x86)\Common Files\dsfNativeFLACSource.dll
2010-12-16 20:39 . 2010-12-16 20:39 302592 ----a-w- c:\program files (x86)\Common Files\webmmux.dll
2010-12-16 20:39 . 2010-12-16 20:39 701440 ----a-w- c:\program files (x86)\Common Files\vp8encoder.dll
2010-12-16 20:39 . 2010-12-16 20:39 412672 ----a-w- c:\program files (x86)\Common Files\vp8decoder.dll
2010-12-16 20:39 . 2010-12-16 20:39 292352 ----a-w- c:\program files (x86)\Common Files\webmsplit.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-03-12 18:13 1728216 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-03-12 18:13 1728216 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-03-12 18:13 1728216 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-07-05 39408]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]
"SanDiskSecureAccess_Manager.exe"="c:\users\zagreb\AppData\Roaming\SanDisk\SanDiskSecureAccess_Manager.exe" [2012-02-14 30705792]
"Akamai NetSession Interface"="c:\users\zagreb\AppData\Local\Akamai\netsession_win.exe" [2014-04-17 4672920]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2014-04-25 22415552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2010-06-10 2621440]
"WheelMouse"="c:\advanc~1\wh_exec.exe" [2007-11-10 98304]
"SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2012-02-03 103896]
"HTC Sync Loader"="c:\program files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2010-09-08 249856]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Duden Korrektor SysTray"="c:\program files (x86)\Duden\Duden-Rechtschreibprüfung\DKTray.exe" [2011-07-14 332432]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2011-9-25 1041920]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.141\SSScheduler.exe [2014-1-16 329944]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\persistentroutes]
"62.75.206.182,255.255.255.255,10.0.0.12,1"=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer6"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe [x]
R2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 vToolbarUpdater18.0.5;vToolbarUpdater18.0.5;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\ToolbarUpdater.exe [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe [x]
R3 mv91xx;mv91xx;c:\windows\system32\drivers\mv91xx.sys;c:\windows\SYSNATIVE\drivers\mv91xx.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TunngleService;TunngleService;d:\games\tunngle lan game crack\Tunngle\TnglCtrl.exe;d:\games\tunngle lan game crack\Tunngle\TnglCtrl.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x]
R3 X6va005;X6va005;c:\users\zagreb\AppData\Local\Temp\005DD1A.tmp;c:\users\zagreb\AppData\Local\Temp\005DD1A.tmp [x]
R3 XFDriver64;XFDriver64;c:\program files (x86)\Xfire2\XFDriver64.sys;c:\program files (x86)\Xfire2\XFDriver64.sys [x]
R4 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
R4 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]
S1 Avgdiska;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiska.sys;c:\windows\SYSNATIVE\DRIVERS\avgdiska.sys [x]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\6de2ed6f-0b56-4d57-b0f0-551ec8cbb27f]
2011-07-01 09:38 153232 ---ha-w- c:\programdata\Duden\DKReg.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{07e84f41-11d5-4615-aaf6-368df0762b41}]
2011-07-01 09:38 153232 ---ha-w- c:\programdata\Duden\DKReg.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-03 18:22 1078088 ----a-w- c:\program files (x86)\Google\Chrome\Application\34.0.1847.131\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 10:41]
.
2014-04-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3224943155-1584954436-3819599901-1001Core.job
- c:\users\zagreb\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-23 04:39]
.
2014-05-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3224943155-1584954436-3819599901-1001UA.job
- c:\users\zagreb\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-23 04:39]
.
2014-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-05 18:56]
.
2014-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-05 18:56]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-03-12 18:10 2333400 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-03-12 18:10 2333400 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-03-12 18:10 2333400 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-12-11 12459112]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-14 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-11-14 1064224]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\persistentroutes]
"62.75.206.182,255.255.255.255,10.0.0.12,1"=""
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com
mSearchAssistant = hxxp://www.google.com
mCustomizeSearch = hxxp://www.google.com
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/5222-72748-17534-1/4
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 10.0.0.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\users\zagreb\AppData\Roaming\Mozilla\Firefox\Profiles\l8936yk6.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.ch/
FF - prefs.js: keyword.URL -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{C45EC9F0-8333-465D-9728-074BD41985C9} - c:\program files (x86)\Free Games 111\ScriptHost.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
WebBrowser-{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - (no file)
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
AddRemove-Biet-O-Matic v2.14.12 - c:\progra~2\BIET-O~1\UNWISE.EXE
AddRemove-Cheat Engine 6.1_is1 - c:\program files (x86)\Cheat Engine 6.1\unins000.exe
AddRemove-GamersFirst War Rock - d:\games\Warrock\wr2\War Rock\uninstall.exe
AddRemove-PunkBusterSvc - d:\games\pbsvc_heroes.exe
AddRemove-FoxTab MP3 Converter - c:\program files (x86)\FoxTabMP3Converter\Uninstall\Uninstall.exe
AddRemove-FoxTab Music Converter - c:\program files (x86)\FoxTabMusicConverter\Uninstall\Uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\zagreb\AppData\Local\Temp\005DD1A.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\S-1-5-21-3224943155-1584954436-3819599901-1001\Software\SecuROM\License information*]
"datasecu"=hex:d4,29,37,e9,56,4d,2d,f4,9b,1f,c4,83,94,d2,cd,19,0d,9a,f3,e6,3b,
37,6a,a4,4b,73,04,0a,52,bb,f8,d2,b9,32,57,6c,61,55,7f,a3,e3,57,6f,56,08,ef,\
"rkeysecu"=hex:a4,22,89,a0,a3,36,58,50,80,18,84,9a,7a,dd,59,e7
.
[HKEY_USERS\S-1-5-21-3224943155-1584954436-3819599901-1001\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\d:\Programme\Games\Battlefield 3\B*a*t*t*l*e*f*i*e*l*d* *3*"!\Core\imageformats]
"qgif4.dll"=multi:"2011-10-10T17:42\00gif\00\00"
"qico4.dll"=multi:"2011-10-10T17:42\00ico\00\00"
"qjpeg4.dll"=multi:"2011-10-10T17:42\00jpeg\00jpg\00\00"
.
[HKEY_USERS\S-1-5-21-3224943155-1584954436-3819599901-1001\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QTextCodecFactoryInterface:\d:\Programme\Games\Battlefield 3\B*a*t*t*l*e*f*i*e*l*d* *3*"!\Core\codecs]
"qcncodecs4.dll"=multi:"2011-10-10T17:42\00GB18030\00GBK\00GB2312\00CP936\00MS936\00windows-936\00MIB: 114\00MIB: 113\00MIB: 2025\00\00"
"qkrcodecs4.dll"=multi:"2011-10-10T17:42\00EUC-KR\00cp949\00MIB: 38\00MIB: -949\00\00"
"qtwcodecs4.dll"=multi:"2011-10-10T17:42\00Big5\00Big5-HKSCS\00Big5-ETen\00CP950\00MIB: 2026\00MIB: 2101\00\00"
.
[HKEY_USERS\S-1-5-21-3224943155-1584954436-3819599901-1001\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\d:\programme\Games\Battlefield 3\B*a*t*t*l*e*f*i*e*l*d* *3*"!\Core\codecs]
"qcncodecs4.dll"=multi:"40703\000\00Windows msvc release full-config QT_NO_DRAGANDDROP\002011-10-10T17:42\00\00"
"qjpcodecs4.dll"=multi:"40602\000\00Windows msvc release full-config\002011-10-10T17:42\00\00"
"qjpcodecsd4.dll"=multi:"40703\001\00Windows msvc debug full-config QT_NO_DRAGANDDROP\002011-10-10T17:42\00\00"
"qkrcodecs4.dll"=multi:"40703\000\00Windows msvc release full-config QT_NO_DRAGANDDROP\002011-10-10T17:42\00\00"
"qtwcodecs4.dll"=multi:"40703\000\00Windows msvc release full-config QT_NO_DRAGANDDROP\002011-10-10T17:42\00\00"
.
[HKEY_USERS\S-1-5-21-3224943155-1584954436-3819599901-1001\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\d:\programme\Games\Battlefield 3\B*a*t*t*l*e*f*i*e*l*d* *3*"!\Core\imageformats]
"Microsoft.VC80.CRT.manifest"=multi:"0\001\00unknown\002011-10-10T17:42\00\00"
"msvcr80.dll"=multi:"0\001\00unknown\002011-10-10T17:42\00\00"
"qgif4.dll"=multi:"40703\000\00Windows msvc release full-config QT_NO_DRAGANDDROP\002011-10-10T17:42\00\00"
"qico4.dll"=multi:"40703\000\00Windows msvc release full-config QT_NO_DRAGANDDROP\002011-10-10T17:42\00\00"
"qjpeg4.dll"=multi:"40703\000\00Windows msvc release full-config QT_NO_DRAGANDDROP\002011-10-10T17:42\00\00"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.13"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE
c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-05-15 13:52:01 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-05-15 11:51
.
Vor Suchlauf: 490'708'992 Bytes frei
Nach Suchlauf: 742'805'504 Bytes frei
.
- - End Of File - - BCBC67F63EC55950022F75C238A8F631
Und dann wie gewohnt ein FRST FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2014 01
Ran by zagreb (administrator) on ZAGREB-PC on 15-05-2014 13:58:21
Running from C:\Users\zagreb\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Gemalto N.V.) C:\Users\zagreb\AppData\Roaming\SanDisk\SanDiskSecureAccess_Manager.exe
(Akamai Technologies, Inc.) C:\Users\zagreb\AppData\Local\Akamai\netsession_win.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Logitech Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Akamai Technologies, Inc.) C:\Users\zagreb\AppData\Local\Akamai\netsession_win.exe
(PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
() C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech Inc.) C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12459112 2012-12-11] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1064224 2013-11-14] (NVIDIA Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [WheelMouse] => C:\Advanced Wheel Mouse\wh_exec.exe [98304 2007-11-10] ()
HKLM-x32\...\Run: [SSDMonitor] => C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [103896 2012-02-03] (PC Tools)
HKLM-x32\...\Run: [HTC Sync Loader] => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [249856 2010-09-08] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXDFXAudioPlugin.dll] - "C:\Windows\system32\rundll32.exe" "C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXDFXAudioPlugin.dll",DllRegisterServer [155648 2012-01-31] ()
HKU\.DEFAULT\...\Run: [Duden Korrektor SysTray] => C:\Program Files (x86)\Duden\Duden-Rechtschreibprüfung\DKTray.exe [332432 2011-07-14] (Expert System S.p.A.)
HKU\S-1-5-21-3224943155-1584954436-3819599901-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-07-05] (Google Inc.)
HKU\S-1-5-21-3224943155-1584954436-3819599901-1001\...\Run: [Speech Recognition] => C:\Windows\Speech\Common\sapisvr.exe [44544 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-3224943155-1584954436-3819599901-1001\...\Run: [SanDiskSecureAccess_Manager.exe] => C:\Users\zagreb\AppData\Roaming\SanDisk\SanDiskSecureAccess_Manager.exe [30705792 2012-02-15] (Gemalto N.V.)
HKU\S-1-5-21-3224943155-1584954436-3819599901-1001\...\Run: [Akamai NetSession Interface] => C:\Users\zagreb\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-3224943155-1584954436-3819599901-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22415552 2014-04-25] (Google)
HKU\S-1-5-21-3224943155-1584954436-3819599901-1003\...\Run: [Duden Korrektor SysTray] => C:\Program Files (x86)\Duden\Duden-Rechtschreibprüfung\DKTray.exe [332432 2011-07-14] (Expert System S.p.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - Plasmoo URL = hxxp://plasmoo.com/index.htm?SearchMashine=true&q={searchTerms}
SearchScopes: HKCU - ÛŸÆîZ§’2¹Þpv¨IÍá*X(Ž2s(ÛÎÀJºÔÓµ± vË°!×—(ä¼48иpatm6êo^Mp`Ëõ÷_i£w˜¾!„Áû†x¢8€ÙjÀÿþ*´Ñ;áa´[¦†8*º~RÙxœòÜ8'£-)x*ä* URL =
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Free Games 111 - {C45EC9F0-8333-465D-9728-074BD41985C9} - C:\Program Files (x86)\Free Games 111\ScriptHost.dll No File
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.1
FireFox:
========
FF ProfilePath: C:\Users\zagreb\AppData\Roaming\Mozilla\Firefox\Profiles\l8936yk6.default
FF Homepage: https://www.google.ch/
FF Keyword.URL: user_pref("keyword.URL", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\zagreb\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\zagreb\AppData\Roaming\Mozilla\Firefox\Profiles\l8936yk6.default\searchplugins\amazon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweet-page.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Webmail Ad Blocker - C:\Users\zagreb\AppData\Roaming\Mozilla\Firefox\Profiles\l8936yk6.default\Extensions\gmailnoads@mywebber.com.xpi [2013-11-24]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-02-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-02-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-02-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-02-15]
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-04-23]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
Chrome:
=======
CHR Extension: (Google Docs) - C:\Users\zagreb\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-01]
CHR Extension: (Google Drive) - C:\Users\zagreb\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-30]
CHR Extension: (YouTube) - C:\Users\zagreb\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-01]
CHR Extension: (McAfee Security Scan+) - C:\Users\zagreb\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh [2014-02-22]
CHR Extension: (Google-Suche) - C:\Users\zagreb\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-01]
CHR Extension: (DVDVideoSoft) - C:\Users\zagreb\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2014-04-01]
CHR Extension: (Google Wallet) - C:\Users\zagreb\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\zagreb\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-08-13]
CHR Extension: (Google Mail) - C:\Users\zagreb\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-01]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\zagreb\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-03-30]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-08-10]
CHR HKLM-x32\...\Chrome\Extension: [ngnjhfpfhadncgafgbneeljaginimmmk] - C:\Users\zagreb\AppData\Local\Temp\tbch.crx [2013-08-10]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12]
==================== Services (Whitelisted) =================
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-02-10] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-14] (NVIDIA Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [79872 2010-09-07] ()
R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [793048 2012-02-03] (PC Tools)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-22] ()
S3 TunngleService; D:\Games\tunngle lan game crack\Tunngle\TnglCtrl.exe [759192 2013-09-03] (Tunngle.net GmbH)
S2 AVGIDSAgent; "C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe" [X]
S2 avgwd; "C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe" [X]
S2 vToolbarUpdater18.0.5; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\ToolbarUpdater.exe [X]
==================== Drivers (Whitelisted) ====================
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-11-01] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [49952 2014-03-21] (AVG Technologies)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-05-08] (DT Soft Ltd)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-11-14] (NVIDIA Corporation)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 XFDriver64; C:\Program Files (x86)\Xfire2\XFDriver64.sys [17160 2013-03-14] (XFire)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U3 DfSdkS;
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 X6va005; \??\C:\Users\zagreb\AppData\Local\Temp\005DD1A.tmp [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-15 13:52 - 2014-05-15 13:52 - 00046984 _____ () C:\ComboFix.txt
2014-05-15 13:37 - 2014-05-15 13:52 - 00000000 ____D () C:\Qoobox
2014-05-15 13:37 - 2014-05-15 13:50 - 00000000 ____D () C:\Windows\erdnt
2014-05-15 13:37 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-15 13:37 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-15 13:37 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-15 13:37 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-15 13:37 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-15 13:37 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-15 13:37 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-15 13:37 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-15 13:36 - 2014-05-15 13:36 - 05200050 ____R (Swearware) C:\Users\zagreb\Desktop\ComboFix.exe
2014-05-15 13:34 - 2014-05-15 13:34 - 00136882 _____ () C:\Users\zagreb\Desktop\Extras.Txt
2014-05-15 13:34 - 2014-05-15 13:34 - 00136048 _____ () C:\Users\zagreb\Desktop\OTL.Txt
2014-05-15 13:14 - 2014-05-15 13:58 - 00025567 _____ () C:\Users\zagreb\Desktop\FRST.txt
2014-05-15 13:05 - 2014-05-15 13:07 - 00000000 ____D () C:\Users\zagreb\Desktop\maö
2014-05-13 12:06 - 2014-05-13 12:22 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-05-12 13:24 - 2014-05-15 13:46 - 00005752 _____ () C:\Windows\PFRO.log
2014-05-12 13:06 - 2014-05-13 12:06 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-12 13:04 - 2014-05-13 12:06 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 13:04 - 2014-05-12 13:04 - 00000000 ____D () C:\Users\zagreb\Desktop\RootKit
2014-05-10 12:04 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-10 12:04 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-10 12:04 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-10 12:04 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-08 19:47 - 2014-05-08 19:47 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-08 19:47 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-08 19:47 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-08 19:47 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-08 19:47 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-08 19:47 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-08 19:47 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-08 19:47 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-08 19:47 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-08 19:47 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-08 19:47 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-08 19:47 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-08 19:47 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-08 19:47 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-08 19:47 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-08 19:47 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-08 19:47 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-08 19:47 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-08 19:47 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-08 19:47 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-08 19:47 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-08 19:47 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-08 19:47 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-08 19:47 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-08 19:47 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-08 19:47 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-08 19:47 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-08 19:47 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-08 19:47 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-08 19:47 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-08 19:47 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-08 19:47 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-08 19:47 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-08 19:47 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-08 19:47 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-08 19:47 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-08 19:47 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-08 19:47 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-08 19:47 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-08 19:47 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-08 19:47 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-08 19:47 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-08 19:47 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-08 19:47 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-08 19:47 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-08 19:45 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-08 19:45 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
==================== One Month Modified Files and Folders =======
2014-05-15 13:58 - 2014-05-15 13:14 - 00025567 _____ () C:\Users\zagreb\Desktop\FRST.txt
2014-05-15 13:58 - 2014-04-01 17:03 - 00000000 ____D () C:\FRST
2014-05-15 13:55 - 2013-01-14 14:50 - 00002060 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-05-15 13:55 - 2012-08-18 11:42 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-15 13:54 - 2014-04-10 20:53 - 00003024 _____ () C:\Windows\setupact.log
2014-05-15 13:54 - 2014-03-30 21:59 - 00000000 ___RD () C:\Users\zagreb\Google Drive
2014-05-15 13:54 - 2013-05-24 21:06 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-05-15 13:54 - 2011-07-05 20:56 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-15 13:54 - 2011-03-22 21:00 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-15 13:54 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-15 13:53 - 2014-04-10 20:55 - 01170038 _____ () C:\Windows\WindowsUpdate.log
2014-05-15 13:53 - 2009-07-14 06:45 - 00021296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-15 13:53 - 2009-07-14 06:45 - 00021296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-15 13:52 - 2014-05-15 13:52 - 00046984 _____ () C:\ComboFix.txt
2014-05-15 13:52 - 2014-05-15 13:37 - 00000000 ____D () C:\Qoobox
2014-05-15 13:50 - 2014-05-15 13:37 - 00000000 ____D () C:\Windows\erdnt
2014-05-15 13:50 - 2011-02-10 21:25 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2014-05-15 13:50 - 2011-02-10 21:25 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2014-05-15 13:50 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-15 13:46 - 2014-05-12 13:24 - 00005752 _____ () C:\Windows\PFRO.log
2014-05-15 13:46 - 2011-10-23 12:33 - 00001142 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3224943155-1584954436-3819599901-1001UA.job
2014-05-15 13:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
2014-05-15 13:46 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-15 13:42 - 2014-02-17 00:14 - 00000000 ____D () C:\Program Files (x86)\Free Games 111
2014-05-15 13:42 - 2011-07-05 20:59 - 00000000 ____D () C:\Users\zagreb
2014-05-15 13:41 - 2012-04-08 20:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-15 13:36 - 2014-05-15 13:36 - 05200050 ____R (Swearware) C:\Users\zagreb\Desktop\ComboFix.exe
2014-05-15 13:34 - 2014-05-15 13:34 - 00136882 _____ () C:\Users\zagreb\Desktop\Extras.Txt
2014-05-15 13:34 - 2014-05-15 13:34 - 00136048 _____ () C:\Users\zagreb\Desktop\OTL.Txt
2014-05-15 13:28 - 2011-07-05 20:56 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-15 13:07 - 2014-05-15 13:05 - 00000000 ____D () C:\Users\zagreb\Desktop\maö
2014-05-15 13:05 - 2011-12-13 22:28 - 00000000 ____D () C:\Users\zagreb\Desktop\Brunc
2014-05-15 12:41 - 2013-09-24 18:52 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-15 12:41 - 2012-04-08 20:24 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-15 12:41 - 2011-07-13 21:59 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-15 12:32 - 2012-12-09 01:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-05-15 12:32 - 2011-08-29 16:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 12:32 - 2009-07-14 04:34 - 00000478 _____ () C:\Windows\win.ini
2014-05-15 12:29 - 2011-07-06 20:45 - 00000000 ____D () C:\Users\zagreb\AppData\Local\Adobe
2014-05-13 12:22 - 2014-05-13 12:06 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-05-13 12:06 - 2014-05-12 13:06 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-13 12:06 - 2014-05-12 13:04 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 13:29 - 2013-06-01 14:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-05-12 13:24 - 2014-04-01 22:25 - 00000000 ____D () C:\Users\zagreb\Documents\MSDCSC
2014-05-12 13:24 - 2014-03-31 18:46 - 00000000 __SHD () C:\ProgramData\Windows Manager
2014-05-12 13:24 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-05-12 13:23 - 2013-10-11 21:57 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-12 13:23 - 2013-10-11 21:57 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-12 13:04 - 2014-05-12 13:04 - 00000000 ____D () C:\Users\zagreb\Desktop\RootKit
2014-05-12 13:01 - 2014-04-01 17:02 - 02066944 _____ (Farbar) C:\Users\zagreb\Desktop\FRST64.exe
2014-05-10 11:49 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-08 19:47 - 2014-05-08 19:47 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-03 20:11 - 2014-03-29 13:07 - 00000000 ____D () C:\Users\zagreb\AppData\Local\Akamai
2014-04-29 16:01 - 2014-05-10 12:04 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-10 12:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-10 12:04 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-10 12:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-24 10:16 - 2011-09-25 19:04 - 00000000 ____D () C:\ProgramData\CanonIJPLM
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-10 21:36
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Ich hoffe du regst dich nicht auf, da ich das ganze auf eigene Hand gemacht hab. Naja eigentlich musst du dich nicht aufregen, habe höchstens mir Schaden angerichtet lG Geändert von Crohero (15.05.2014 um 13:28 Uhr) |
|
16.05.2014, 11:11
| #32 |
| /// the machine /// TB-Ausbilder    | Unbekannter Schädling(blockiert Malwarebytes&Antivir&Systemwiederherstellung) Bitte mal das machen:
__________________http://www.trojaner-board.de/126216-...epair-aio.html
__________________ |
|
Linear-Darstellung
