| |
| |||||||
Log-Analyse und Auswertung: Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online ScannerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
16.04.2014, 10:35
| #1 |
| |  Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner Hallo, ich erhielt heute Nacht eine Email von meinem Provider (s. Anhang), dass mein Email Account kompromittiert wurde und sie davon ausgehen, dass meine Zugangsdaten wahrscheinlich von einem Trojaner auf meinem Rechner ausgelesen wurden. Ich habe anschließend mit den vom Provider empfohlenen Scannern gescannt. Begonnen habe ich mit ESET Online Scanner. Hier wurden dann folgende Bedrohungen gefunden: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[2].0 Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung C:\Program Files\CamStudio 2.7\BunndleOfferManager.exe Variante von Win32/Bunndle potenziell unsichere Anwendung gelöscht - in Quarantäne kopiert C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung gelöscht - in Quarantäne kopiert C:\Program Files (x86)\NCH Software\Debut\debut.exe Variante von Win32/Toolbar.Conduit.H evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Program Files (x86)\NCH Software\Debut\debutsetup_v1.82.exe Variante von Win32/Toolbar.Conduit.H evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\Petra Lindenmann\AppData\Local\Temp\nsc5057.tmp Win32/Somoto.M evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Windows\Installer\MSI84E5.tmp Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung gelöscht - in Quarantäne kopiert C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[2].0 Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung gelöscht - in Quarantäne kopiert Ich habe dann den Scanner beendet. Anschließend Trend Micro HouseCall und Bitdefender Quickscan durchlaufen lassen. Beide Male ohne Funde. Danach nochmal den ESET nochmal, da er mir am gründlichsten erschien. Dieses Mal ohne Funde. Aber in der Quarantäne sind nur 7 Dateien und nicht 8, die er beim ersten Durchlauf gefunden hatte. Eigentlich könnte ich ja jetzt davon ausgehen, dass ich frei von Trojanern bin, aber ich bin mir nicht zu 100% sicher und wollte nachfragen, ob ihr mir dabei helfen könntet, das zu prüfen. Es würde ja wenig Sinn machen Passwörter und Benutzerdaten zu ändern, wenn der Trojaner immer noch auf dem Rechner ist und weiterhin alles ausgelesen werden kann. Ich habe Defogger verwendet, ohne Meldung. defogger_disable.txt Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:02 on 16/04/2014 (*****)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-04-2014
Ran by ***** (administrator) on TROEDEL on 16-04-2014 10:05:35
Running from C:\Users\*****\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
() C:\Program Files (x86)\Rainlenda2\Rainlendar2.exe
(Akamai Technologies, Inc.) C:\Users\*****\AppData\Local\Akamai\netsession_win.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Dropbox, Inc.) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
(Akamai Technologies, Inc.) C:\Users\*****\AppData\Local\Akamai\netsession_win.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATITechnologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATITechnologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla\Thunderbird\thunderbird.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6629480 2011-04-14] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [HTC Sync Loader] => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [651264 2012-04-17] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATITechnologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-12-18] (Adobe Systems Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKU\S-1-5-19\...\Run: [Sidebar] => C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-20\...\Run: [Sidebar] => C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\Run: [Google Update] => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-19] (Google Inc.)
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlenda2\Rainlendar2.exe [2433024 2011-08-12] ()
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\Run: [Akamai NetSession Interface] => C:\Users\*****\AppData\Local\Akamai\netsession_win.exe [4672920 2014-03-06] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\MountPoints2: F - "F:\Adobe CS5\Set-up.exe"
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\MountPoints2: {284e5f2d-12b9-11e1-aeba-8c89a518e36d} - F:\pushinst.exe
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\MountPoints2: {4e0d16a9-12e8-11e3-a73f-8c89a518e36d} - E:\pushinst.exe
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\MountPoints2: {8130e10e-a340-11e1-ac45-00040ecf2451} - E:\pushinst.exe
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?rlz=1W4CHBA_deDE554
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3E7E5841DAA6CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP0172547A-CAC0-4CF5-8DCB-B50E78EF107E&q={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default
FF SelectedSearchEngine: Google
FF Homepage: www.spiegel.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.2.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.2.1 - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\*****\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\*****\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\searchplugins\conduit-search.xml
FF Extension: vShare Plugin - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\vshare@toolbar [2011-11-21]
FF Extension: BabelFish - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\{ca0849e8-2c76-42ae-9abe-34e14d337acf} [2011-11-21]
FF Extension: Adobe DLM (powered by getPlus(R)) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} [2011-11-21]
FF Extension: Firebug - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\firebug@software.joehewitt.com.xpi [2012-02-06]
FF Extension: Zotero - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\zotero@chnm.gmu.edu.xpi [2013-10-16]
FF Extension: NoScript - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-11-21]
FF Extension: Web Developer - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi [2012-08-24]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-08-19]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla\Firefox\firefox.exe
Chrome:
=======
CHR HomePage: hxxp://www.bvb.de/
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U29) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Google Update) - C:\Users\*****\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-16]
CHR Extension: (Firebug Lite for Google Chrome™) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmagokdooijbeehmkpknfglimnifench [2012-02-06]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-16]
CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Bitdefender QuickScan) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-04-16]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-16]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2011-12-16]
CHR StartMenuInternet: Google Chrome - C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [96768 2012-05-31] (Freemake)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [87040 2012-03-23] ()
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
R1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [279616 2011-11-20] (DT Soft Ltd)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-16 10:05 - 2014-04-16 10:05 - 00020650 _____ () C:\Users\*****\Downloads\FRST.txt
2014-04-16 10:05 - 2014-04-16 10:05 - 00000000 ____D () C:\FRST
2014-04-16 10:02 - 2014-04-16 10:02 - 00000564 _____ () C:\Users\*****\Downloads\defogger_disable.log
2014-04-16 10:02 - 2014-04-16 10:02 - 00000168 _____ () C:\Users\*****\defogger_reenable
2014-04-16 08:56 - 2014-04-16 08:56 - 00000000 ____D () C:\Users\*****\AppData\Roaming\QuickScan
2014-04-16 08:55 - 2014-04-16 08:55 - 00313720 _____ () C:\Users\*****\AppData\Local\census.cache
2014-04-16 08:55 - 2014-04-16 08:55 - 00134057 _____ () C:\Users\*****\AppData\Local\ars.cache
2014-04-16 08:41 - 2014-04-16 08:41 - 02054144 _____ (Farbar) C:\Users\*****\Downloads\FRST64.exe
2014-04-16 08:41 - 2014-04-16 08:41 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-04-16 08:40 - 2014-04-16 08:40 - 02405664 _____ (Trend Micro Inc.) C:\Users\*****\Downloads\HousecallLauncher64.exe
2014-04-16 08:40 - 2014-04-16 08:40 - 00000036 _____ () C:\Users\*****\AppData\Local\housecall.guid.cache
2014-04-16 08:36 - 2014-04-16 08:36 - 00001346 _____ () C:\Users\*****\Desktop\Funde.txt
2014-04-16 07:26 - 2014-04-16 07:26 - 02347384 _____ (ESET) C:\Users\*****\Downloads\esetsmartinstaller_deu.exe
2014-04-16 07:26 - 2014-04-16 07:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-08 10:47 - 2014-04-08 10:47 - 01522297 _____ () C:\Users\*****\Downloads\KeePass-1.27.zip
2014-04-08 10:29 - 2014-04-08 10:29 - 00249344 _____ () C:\Users\*****\Downloads\botosani_05.04.2014.xls
2014-04-07 14:39 - 2014-04-07 14:39 - 01315556 _____ () C:\Users\*****\Downloads\grey-buttons.psd
2014-04-07 12:38 - 2014-04-07 12:38 - 00187590 _____ () C:\Users\*****\Desktop\klingelschild.psd
2014-04-02 19:23 - 2014-04-02 19:23 - 00014908 _____ () C:\Users\*****\Downloads\jquery-cookie-master.zip
2014-04-01 11:57 - 2014-04-01 11:57 - 00011012 _____ () C:\Users\*****\Downloads\double_opt-in_php.zip
2014-03-28 18:48 - 2014-03-28 18:48 - 00003459 _____ () C:\Users\*****\Downloads\scroll-to-top.zip
2014-03-28 17:12 - 2014-03-28 17:12 - 00006743 _____ () C:\Users\*****\Downloads\de-pp-logos.zip
2014-03-27 16:09 - 2014-03-27 16:09 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Bejeweled2
2014-03-26 20:35 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-26 20:35 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-26 20:35 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-26 20:35 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-26 20:35 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-26 20:35 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-26 20:35 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-26 20:35 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-26 20:35 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-26 20:35 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-26 20:35 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-26 20:35 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-26 20:35 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-26 20:35 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-26 20:35 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-26 20:35 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-26 20:35 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-26 20:35 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-26 20:35 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-26 20:35 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-26 20:35 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-26 20:35 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-26 20:35 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-26 20:35 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-26 20:35 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-26 20:35 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-26 20:35 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-26 20:35 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-26 20:35 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-26 20:35 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-26 20:35 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-26 20:35 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-26 20:35 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-26 20:35 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-26 20:35 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-26 20:35 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-26 20:35 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-26 20:35 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-26 20:35 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-26 20:35 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-26 20:35 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-26 20:35 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-26 20:35 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-26 20:35 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-26 20:35 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-26 20:35 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-26 20:35 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-26 20:35 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-26 17:04 - 2014-03-26 17:04 - 00000000 ____D () C:\Program Files (x86)\ClairesGardenStudio
2014-03-26 11:08 - 2014-03-26 15:02 - 00000000 ____D () C:\Users\*****\Desktop\REALEASE STUFF
2014-03-22 14:15 - 2014-03-22 14:15 - 01141308 _____ () C:\Users\*****\Downloads\jquery-ui-themes-1.9.2.zip
2014-03-20 13:33 - 2014-03-20 13:33 - 00006673 _____ () C:\Users\*****\Downloads\configurable_product_extension.zip
2014-03-19 09:45 - 2014-03-19 09:45 - 00002361 _____ () C:\Users\*****\Downloads\Improved_one_page_checkout_H-O.zip
==================== One Month Modified Files and Folders =======
2014-04-16 10:05 - 2014-04-16 10:05 - 00020650 _____ () C:\Users\*****\Downloads\FRST.txt
2014-04-16 10:05 - 2014-04-16 10:05 - 00000000 ____D () C:\FRST
2014-04-16 10:04 - 2011-11-25 00:49 - 00000085 _____ () C:\Users\*****\mm.cfg
2014-04-16 10:02 - 2014-04-16 10:02 - 00000564 _____ () C:\Users\*****\Downloads\defogger_disable.log
2014-04-16 10:02 - 2014-04-16 10:02 - 00000168 _____ () C:\Users\*****\defogger_reenable
2014-04-16 10:02 - 2011-11-19 15:40 - 00000000 ____D () C:\Users\*****
2014-04-16 09:51 - 2011-11-20 13:13 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2014-04-16 09:44 - 2011-11-19 18:52 - 00001164 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000UA.job
2014-04-16 08:56 - 2014-04-16 08:56 - 00000000 ____D () C:\Users\*****\AppData\Roaming\QuickScan
2014-04-16 08:55 - 2014-04-16 08:55 - 00313720 _____ () C:\Users\*****\AppData\Local\census.cache
2014-04-16 08:55 - 2014-04-16 08:55 - 00134057 _____ () C:\Users\*****\AppData\Local\ars.cache
2014-04-16 08:44 - 2011-11-21 22:30 - 00000000 ____D () C:\Users\*****\AppData\Roaming\uTorrent
2014-04-16 08:41 - 2014-04-16 08:41 - 02054144 _____ (Farbar) C:\Users\*****\Downloads\FRST64.exe
2014-04-16 08:41 - 2014-04-16 08:41 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-04-16 08:40 - 2014-04-16 08:40 - 02405664 _____ (Trend Micro Inc.) C:\Users\*****\Downloads\HousecallLauncher64.exe
2014-04-16 08:40 - 2014-04-16 08:40 - 00000036 _____ () C:\Users\*****\AppData\Local\housecall.guid.cache
2014-04-16 08:36 - 2014-04-16 08:36 - 00001346 _____ () C:\Users\*****\Desktop\Funde.txt
2014-04-16 08:28 - 2014-02-10 16:04 - 00000000 ____D () C:\Program Files\CamStudio 2.7
2014-04-16 07:43 - 2011-11-19 15:40 - 01209299 _____ () C:\Windows\WindowsUpdate.log
2014-04-16 07:30 - 2011-11-21 21:42 - 00000000 ____D () C:\Users\*****\AppData\Local\Adobe
2014-04-16 07:27 - 2009-07-14 06:45 - 00013248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-16 07:27 - 2009-07-14 06:45 - 00013248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-16 07:26 - 2014-04-16 07:26 - 02347384 _____ (ESET) C:\Users\*****\Downloads\esetsmartinstaller_deu.exe
2014-04-16 07:26 - 2014-04-16 07:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-16 07:24 - 2009-07-14 19:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-04-16 07:24 - 2009-07-14 19:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-04-16 07:24 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-16 07:20 - 2013-08-19 09:37 - 00017734 _____ () C:\Windows\setupact.log
2014-04-16 07:20 - 2012-10-06 20:56 - 00000000 ____D () C:\Users\*****\AppData\Local\Htc
2014-04-16 07:20 - 2012-07-18 20:21 - 00000000 ___RD () C:\Users\*****\Dropbox
2014-04-16 07:20 - 2012-07-16 21:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-04-16 07:20 - 2012-01-09 20:04 - 00000000 ____D () C:\Users\*****\.rainlendar2
2014-04-16 07:20 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-15 13:44 - 2011-11-19 18:52 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000Core.job
2014-04-14 18:22 - 2012-09-14 19:27 - 00001456 _____ () C:\Users\*****\AppData\Local\Adobe Save for Web 13.0 Prefs
2014-04-14 14:00 - 2013-08-19 10:06 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Wuala
2014-04-14 11:19 - 2014-02-04 08:22 - 00000000 ___RD () C:\Users\*****\Desktop\ClairesGardenStudio Ordner
2014-04-14 10:48 - 2013-08-16 17:10 - 00000000 ___RD () C:\Users\*****\Desktop\KV Dreck
2014-04-10 13:35 - 2014-02-28 08:38 - 00001475 _____ () C:\Users\*****\Documents\DiffDaff.htm
2014-04-10 13:35 - 2014-02-04 09:00 - 00038563 _____ () C:\Users\*****\Documents\~diffdaff2.htm
2014-04-10 13:35 - 2014-02-04 09:00 - 00027472 _____ () C:\Users\*****\Documents\~diffdaff1.htm
2014-04-10 13:35 - 2014-02-04 09:00 - 00013298 _____ () C:\Users\*****\Documents\~diffdafftop.htm
2014-04-09 18:39 - 2012-01-10 19:06 - 00000000 ____D () C:\Users\*****\AppData\Roaming\FileZilla
2014-04-09 18:39 - 2011-11-21 22:44 - 00000600 _____ () C:\Users\*****\AppData\Roaming\winscp.rnd
2014-04-09 10:20 - 2012-05-04 10:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-08 14:20 - 2011-11-21 21:58 - 00000000 ____D () C:\Users\*****\AppData\Local\Mozilla
2014-04-08 14:15 - 2011-11-21 21:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla
2014-04-08 10:47 - 2014-04-08 10:47 - 01522297 _____ () C:\Users\*****\Downloads\KeePass-1.27.zip
2014-04-08 10:46 - 2013-10-15 12:12 - 00000849 _____ () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2014-04-08 10:29 - 2014-04-08 10:29 - 00249344 _____ () C:\Users\*****\Downloads\botosani_05.04.2014.xls
2014-04-07 19:45 - 2011-11-21 22:51 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc
2014-04-07 14:39 - 2014-04-07 14:39 - 01315556 _____ () C:\Users\*****\Downloads\grey-buttons.psd
2014-04-07 12:38 - 2014-04-07 12:38 - 00187590 _____ () C:\Users\*****\Desktop\klingelschild.psd
2014-04-03 19:23 - 2012-12-15 20:03 - 00000000 ____D () C:\Users\*****\AppData\Local\Akamai
2014-04-02 19:23 - 2014-04-02 19:23 - 00014908 _____ () C:\Users\*****\Downloads\jquery-cookie-master.zip
2014-04-02 13:39 - 2011-11-19 18:52 - 00004160 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000UA
2014-04-02 13:39 - 2011-11-19 18:52 - 00003764 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000Core
2014-04-01 11:57 - 2014-04-01 11:57 - 00011012 _____ () C:\Users\*****\Downloads\double_opt-in_php.zip
2014-04-01 07:39 - 2013-08-19 11:24 - 00141896 _____ () C:\Windows\PFRO.log
2014-03-31 14:24 - 2012-01-17 20:17 - 00000000 ____D () C:\Program Files (x86)\eclipse
2014-03-31 09:25 - 2011-11-21 22:04 - 00000000 ____D () C:\Program Files (x86)\FileZilla
2014-03-28 18:48 - 2014-03-28 18:48 - 00003459 _____ () C:\Users\*****\Downloads\scroll-to-top.zip
2014-03-28 17:12 - 2014-03-28 17:12 - 00006743 _____ () C:\Users\*****\Downloads\de-pp-logos.zip
2014-03-27 16:09 - 2014-03-27 16:09 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Bejeweled2
2014-03-27 13:06 - 2012-05-25 11:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Audacity
2014-03-27 08:09 - 2013-08-19 09:37 - 04985944 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-26 20:36 - 2013-08-16 16:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-26 20:35 - 2012-01-24 19:34 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-26 18:17 - 2013-08-16 17:10 - 00000000 ____D () C:\Users\*****\Desktop\Rechnungen, Quittungen etc. (DRUCK)
2014-03-26 17:04 - 2014-03-26 17:04 - 00000000 ____D () C:\Program Files (x86)\ClairesGardenStudio
2014-03-26 15:02 - 2014-03-26 11:08 - 00000000 ____D () C:\Users\*****\Desktop\REALEASE STUFF
2014-03-26 12:55 - 2013-08-16 17:12 - 00118272 ___SH () C:\Users\*****\Documents\Thumbs.db
2014-03-25 09:26 - 2011-11-21 21:45 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Notepad++
2014-03-25 09:26 - 2011-11-21 21:45 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2014-03-22 14:15 - 2014-03-22 14:15 - 01141308 _____ () C:\Users\*****\Downloads\jquery-ui-themes-1.9.2.zip
2014-03-20 13:33 - 2014-03-20 13:33 - 00006673 _____ () C:\Users\*****\Downloads\configurable_product_extension.zip
2014-03-19 09:45 - 2014-03-19 09:45 - 00002361 _____ () C:\Users\*****\Downloads\Improved_one_page_checkout_H-O.zip
Files to move or delete:
====================
C:\Users\*****\AppData\Roaming\CamLayout.ini
C:\Users\*****\AppData\Roaming\CamShapes.ini
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\avgnt.exe
C:\Users\*****\AppData\Local\Temp\npp.6.4.5.Installer.exe
C:\Users\*****\AppData\Local\Temp\npp.6.5.1.Installer.exe
C:\Users\*****\AppData\Local\Temp\npp.6.5.2.Installer.exe
C:\Users\*****\AppData\Local\Temp\npp.6.5.5.Installer.exe
C:\Users\*****\AppData\Local\Temp\npp.6.5.Installer.exe
C:\Users\*****\AppData\Local\Temp\nseB498.exe
C:\Users\*****\AppData\Local\Temp\nsjAA0C.exe
C:\Users\*****\AppData\Local\Temp\nsjB5F0.exe
C:\Users\*****\AppData\Local\Temp\nsoB748.exe
C:\Users\*****\AppData\Local\Temp\nsp395D.exe
C:\Users\*****\AppData\Local\Temp\nsuA78B.exe
C:\Users\*****\AppData\Local\Temp\nsuA8C4.exe
C:\Users\*****\AppData\Local\Temp\proxy_util_w32.dll
C:\Users\*****\AppData\Local\Temp\smd_runtime.exe
C:\Users\*****\AppData\Local\Temp\utt12E7.tmp.exe
C:\Users\*****\AppData\Local\Temp\utt954F.tmp.exe
C:\Users\*****\AppData\Local\Temp\uttA1EC.tmp.exe
C:\Users\*****\AppData\Local\Temp\vlc-2.0.8-win32.exe
C:\Users\*****\AppData\Local\Temp\vlc-2.1.1-win32.exe
C:\Users\*****\AppData\Local\Temp\xmlUpdater.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-10 11:51
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-04-2014
Ran by ***** at 2014-04-16 10:05:51
Running from C:\Users\*****\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
@icon sushi 1.21 (HKLM-x32\...\@icon sushi_is1) (Version: - towofu's SOFT)
µTorrent (HKCU\...\uTorrent) (Version: 3.4.1.30740 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.9 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Creative Suite 6 Master Collection (HKLM-x32\...\{E8AD3069-9EB7-4BA8-8BFE-83F4E69355C0}) (Version: 6 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Help Manager (x32 Version: 4.0.244 - Adobe Systems Incorporated) Hidden
Adobe Reader X (10.1.1) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.1 - Adobe Systems Incorporated)
Adobe Widget Browser (HKLM-x32\...\com.adobe.WidgetBrowser) (Version: 2.0 Build 348 - Adobe Systems Incorporated.)
Adobe Widget Browser (x32 Version: 2.0.348 - Adobe Systems Incorporated.) Hidden
Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc)
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{5E03A267-415E-5383-FA8F-3CE4145663B9}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.71219.1540 - Advanced Micro Devices, Inc.) Hidden
Android SDK Tools (HKLM-x32\...\Android SDK Tools) (Version: 1.14 - Google Inc.)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI AVIVO64 Codecs (Version: 11.6.0.51125 - ATI Technologies Inc.) Hidden
Audacity 2.0 (HKLM-x32\...\Audacity_is1) (Version: - Audacity Team)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Bejeweled3 (HKLM-x32\...\Bejeweled2) (Version: 1.0 - UNKNOWN)
Bejeweled3 (x32 Version: 1.0 - UNKNOWN) Hidden
Big Fish: Game Manager (HKLM-x32\...\BFGC) (Version: 3.2.0.7 - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CamStudio 2.7.2 (HKLM\...\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.2 - CamStudio Open Source)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Cave Quest (HKLM-x32\...\BFG-Cave Quest) (Version: - )
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.04 - Piriform)
CEP - Color Enable Package (HKLM-x32\...\CEP - Colour Enable Packages_is1) (Version: 6.0b (beta) - Numenor, for ModTheSims2)
ClairesGardenStudio (HKLM-x32\...\ClairesGardenStudio) (Version: 1.0 - UNKNOWN)
ClairesGardenStudio (HKLM-x32\...\com.degugames.clairesGardenStudio) (Version: 1.0.0 - UNKNOWN)
ClairesGardenStudio (x32 Version: 1.0 - UNKNOWN) Hidden
ClairesGardenStudio (x32 Version: 1.0.0 - UNKNOWN) Hidden
CPUID CPU-Z 1.67 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
CrystalDiskInfo 5.3.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 5.3.1 - Crystal Dew World)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.1.0236 - DT Soft Ltd)
dBpowerAMP Music Converter (HKLM-x32\...\dBpowerAMP Music Converter) (Version: - )
Debut Video Capture Software (HKLM-x32\...\Debut) (Version: 1.82 - NCH Software)
Defraggler (HKLM\...\Defraggler) (Version: 2.15 - Piriform)
Die Sims 2 (HKLM-x32\...\{6E7DD182-9FC6-4651-0095-2E666CC6AF35}) (Version: - )
Die Sims 2: Nightlife (HKLM-x32\...\{F7529650-B9DB-481B-0089-A2AC3C2821C1}) (Version: - )
Die Sims 2: Open For Business (HKLM-x32\...\{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}) (Version: - )
Die Sims 2: Wilde Campus-Jahre (HKLM-x32\...\{01521746-02A6-4A72-00BD-A285DF6B80C6}) (Version: - )
Die Sims™ 2 Gute Reise (HKLM-x32\...\{F248ADFA-64E0-4b03-8A83-059078BED6A0}) (Version: - Electronic Arts)
Die Sims™ 2 Haustiere (HKLM-x32\...\{4817189D-1785-4627-A33C-39FD90919300}) (Version: - )
Die Sims™ 2 Vier Jahreszeiten (HKLM-x32\...\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}) (Version: - )
DiffDaff Version 1.0 (HKLM-x32\...\DiffDaff_is1) (Version: - )
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FFmpeg v0.6.2 for Audacity (HKLM-x32\...\FFmpeg for Audacity_is1) (Version: - )
FIFA 13 Demo (HKLM-x32\...\{3F499657-766A-4A5F-AEE9-A1F8D295A4CE}) (Version: 1.0.0.0 - Electronic Arts)
FileZilla Client 3.8.0 (HKLM-x32\...\FileZilla Client) (Version: 3.8.0 - Tim Kosse)
FlashDevelop 4.0.4 (HKLM-x32\...\FlashDevelop) (Version: 4.0.4-RTM - FlashDevelop.org)
Flower Paradise (HKLM-x32\...\BFG-Flower Paradise) (Version: - )
Free Studio version 2014 (HKLM-x32\...\Free Studio_is1) (Version: 6.2.4.1230 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.17.1127 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.17.1127 - DVDVideoSoft Ltd.)
Freemake Video Converter Version 3.0.2 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 3.0.2 - Ellora Assets Corporation)
Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
grepWin x64 (HKLM\...\{142215C5-C416-4F34-BF3A-B28BA105BBD1}) (Version: 1.6.546 - Stefans Tools)
Guitar Pro 5.0 (HKLM-x32\...\Guitar Pro 5_is1) (Version: - Arobas Music)
HTC BMP USB Driver (HKLM-x32\...\{31A559C1-9E4D-423B-9DD3-34A6C5398752}) (Version: 1.0.5375 - HTC)
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.021 - HTC Corporation)
HTC Sync (HKLM-x32\...\{AB77DFDE-9949-4AEF-B180-BE322C3E65D0}) (Version: 3.2.20 - HTC Corporation)
HydraVision (x32 Version: 4.2.184.0 - ATI Technologies Inc.) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
iTunes (HKLM\...\{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}) (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 29 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416029FF}) (Version: 6.0.290 - Oracle)
Java(TM) 6 Update 29 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216029FF}) (Version: 6.0.290 - Oracle)
Java(TM) 7 Update 2 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417002FF}) (Version: 7.0.20 - Oracle)
Java(TM) SE Development Kit 7 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170000}) (Version: 1.7.0.0 - Oracle)
Java(TM) SE Development Kit 7 Update 2 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170020}) (Version: 1.7.0.20 - Oracle)
JavaFX 2.0.2 (64-bit) (HKLM\...\{1111706F-666A-4037-7777-202648764D10}) (Version: 2.0.2 - Oracle Corporation)
JavaFX 2.0.2 SDK (64-bit) (HKLM\...\{2222706F-666A-4037-7777-202648764D10}) (Version: 2.0.2 - Oracle Corporation)
Jewel Legends: Magical Kingdom (HKLM-x32\...\BFG-Jewel Legends - Magical Kingdom) (Version: - )
K-Lite Codec Pack 9.7.0 (Standard) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.7.0 - )
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
LS-PrePost-3.2-X64 (HKLM-x32\...\LS-PrePost) (Version: 3.2 - Livermore Software Technology Corporation)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.1.0.6 - Marvell)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}) (Version: - Microsoft)
Microsoft Office 2010 Service Pack 1 (SP1) (Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
MozBackup 1.4.9 (HKLM-x32\...\MozBackup) (Version: - Pavel Cvrcek)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
Mozilla Thunderbird 24.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.4.0 (x86 de)) (Version: 24.4.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
No23 Recorder (HKLM-x32\...\{22B0E143-2B0B-435B-9F56-136A3D16065F}) (Version: 2.1.0.3 - No23)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.5 - Notepad++ Team)
Opera 12.16 (HKLM-x32\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
posterXXL Designer 5.2 (HKLM-x32\...\posterXXL Designer)_is1) (Version: - )
Pro Evolution Soccer 2013 DEMO2 (HKLM-x32\...\{E244E649-B7FB-4644-B387-CA882AEC7577}) (Version: 1.00.0000 - KONAMI)
Rainlendar2 (remove only) (HKLM-x32\...\Rainlendar2) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.43.321.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6353 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.34.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.0 - Renesas Electronics Corporation) Hidden
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SopCast 3.4.0 (HKLM-x32\...\SopCast) (Version: 3.4.0 - www.sopcast.com)
SWF Compress 1.0 (HKLM-x32\...\{33DD67E4-734F-4E86-8A2A-8134E7579ECB}_is1) (Version: - Amayeta)
SWF Encrypt 7 (HKLM-x32\...\{BDF3D731-6D0C-4F43-87FD-110DE5253679}_is1) (Version: - Amayeta)
Testing (HKLM-x32\...\Testing) (Version: 1.0 - UNKNOWN)
Testing (x32 Version: 1.0 - UNKNOWN) Hidden
TextPad 5 (HKLM-x32\...\{B6EC7388-E277-4A5B-8C8F-71067A41BA64}) (Version: 5.4.2 - Helios)
TexturePacker (HKLM-x32\...\{DDE0309C-DC59-41B6-ACC9-0730FF335FB0}) (Version: 2.4.6 - Andreas Loew / CodeAndWeb)
VLC media player 2.0.2 (HKLM-x32\...\VLC media player) (Version: 2.0.2 - VideoLAN)
WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
WinSCP 4.3.5 (HKLM-x32\...\winscp3_is1) (Version: 4.3.5 - Martin Prikryl)
Wisdom-soft AutoScreenRecorder 3.1 Pro (HKLM-x32\...\Wisdom-soft AutoScreenRecorder 3.1 Pro) (Version: - Wisdom Software Inc.)
Wuala (HKCU\...\Wuala) (Version: 1.0.444.0 - LaCie)
Wuala CBFS (HKLM-x32\...\Wuala CBFS) (Version: 3.2.107.0 - LaCie)
Wuala OverlayIcons (HKLM-x32\...\Wuala OverlayIcons) (Version: 1.0.0.2 - LaCie)
XAMPP (HKLM-x32\...\xampp) (Version: 1.8.3-3 - Bitnami)
XnConvert 1.10 (HKLM\...\XnConvert_is1) (Version: 1.10 - Gougelet Pierre-e)
yEd Graph Editor 3.10 (HKLM-x32\...\3309-7404-0599-8908) (Version: 3.10 - yWorks GmbH)
==================== Restore Points =========================
==================== Hosts content: ==========================
2014-02-24 12:48 - 2014-02-24 12:48 - 00000883 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 magento.localhost.com www.localhost.com
==================== Scheduled Tasks (whitelisted) =============
Task: {15405762-8BC0-44C4-884A-754227A2A24D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000UA => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-19] (Google Inc.)
Task: {2EE51AE6-2833-4A8F-88E4-C0ADB8146875} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000Core => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-19] (Google Inc.)
Task: {2FE9858C-CA04-45BE-AF76-A29E46683A6C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd)
Task: {AE588CDE-AD34-4DBD-B1DB-DE81D4ECD60E} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [2012-04-17] ()
Task: {E7AEE66D-C0B2-4CA7-8DF1-D6F3FDAC731E} - System32\Tasks\AdobeAAMUpdater-1.0-TROEDEL-***** => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000Core.job => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000UA.job => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-03-23 14:25 - 2012-03-23 14:25 - 00087040 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2011-03-17 01:07 - 2011-03-17 01:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla\fzshellext_64.dll
2011-11-21 22:42 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2012-06-18 17:24 - 2012-06-18 17:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2011-08-12 07:45 - 2011-08-12 07:45 - 02433024 _____ () C:\Program Files (x86)\Rainlenda2\Rainlendar2.exe
2012-04-17 15:05 - 2012-04-17 15:05 - 00651264 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
2013-08-16 10:31 - 2013-08-16 10:13 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-02-20 21:29 - 2012-02-20 21:29 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-02-20 21:28 - 2012-02-20 21:28 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2010-05-23 20:20 - 2010-05-23 20:20 - 00126976 _____ () C:\Program Files (x86)\Rainlenda2\lua51.dll
2011-08-12 07:45 - 2011-08-12 07:45 - 00198144 _____ () C:\Program Files (x86)\Rainlenda2\plugins\iCalendarPlugin.dll
2010-05-23 20:20 - 2010-05-23 20:20 - 00012288 _____ () C:\Program Files (x86)\Rainlenda2\lfs.dll
2014-03-28 11:35 - 2014-03-28 11:35 - 00093696 _____ () C:\Program Files (x86)\FileZilla\fzshellext.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\*****\AppData\Roaming\Dropbox\bin\libcef.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00103936 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\OutputLog.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00516599 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00094208 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\fdHttpd.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00389120 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\HtcDetect.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00151552 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDisk.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00172032 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDetectLegend.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00559244 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.7.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 01515520 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\Maps\R66Api.dll
2014-04-11 18:48 - 2014-04-02 03:57 - 00065352 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\chrome_elf.dll
2014-04-11 18:48 - 2014-04-02 03:57 - 00674632 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\libglesv2.dll
2014-04-11 18:48 - 2014-04-02 03:57 - 00093000 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\libegl.dll
2014-04-11 18:48 - 2014-04-02 03:57 - 04081480 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll
2014-04-11 18:48 - 2014-04-02 03:58 - 00390472 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll
2014-04-11 18:48 - 2014-04-02 03:57 - 01647432 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\ffmpegsumo.dll
2014-04-11 18:48 - 2014-04-02 03:58 - 13691720 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll
2014-03-19 09:34 - 2014-03-19 09:34 - 03018864 _____ () C:\Program Files (x86)\Mozilla\Thunderbird\mozjs.dll
2014-03-19 09:34 - 2014-03-19 09:34 - 00158832 _____ () C:\Program Files (x86)\Mozilla\Thunderbird\NSLDAP32V60.dll
2014-03-19 09:34 - 2014-03-19 09:34 - 00023152 _____ () C:\Program Files (x86)\Mozilla\Thunderbird\NSLDAPPR32V60.dll
2011-07-18 23:07 - 2011-07-18 23:07 - 00014336 _____ () C:\Program Files (x86)\Notepad++\plugins\NppExport.dll
2011-09-21 22:46 - 2011-09-21 22:46 - 01673728 _____ () C:\Program Files (x86)\Notepad++\plugins\NppFTP.dll
2012-03-09 16:26 - 2013-04-25 03:50 - 00108128 _____ () C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\zlib1.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:16A4620C
AlternateDataStreams: C:\ProgramData\TEMP:1A8BB29B
AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F
AlternateDataStreams: C:\ProgramData\TEMP:FF747CFB
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/16/2014 08:57:35 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/16/2014 08:57:34 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/16/2014 08:57:30 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/16/2014 07:26:09 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/14/2014 07:48:25 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: httpd.exe, Version: 2.4.7.0, Zeitstempel: 0x528e59ed
Name des fehlerhaften Moduls: php5ts.dll, Version: 5.5.9.0, Zeitstempel: 0x52f2c13c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00009a27
ID des fehlerhaften Prozesses: 0x169c
Startzeit der fehlerhaften Anwendung: 0xhttpd.exe0
Pfad der fehlerhaften Anwendung: httpd.exe1
Pfad des fehlerhaften Moduls: httpd.exe2
Berichtskennung: httpd.exe3
Error: (04/11/2014 11:44:14 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: httpd.exe, Version: 2.4.7.0, Zeitstempel: 0x528e59ed
Name des fehlerhaften Moduls: php5ts.dll, Version: 5.5.9.0, Zeitstempel: 0x52f2c13c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00009a27
ID des fehlerhaften Prozesses: 0x1d90
Startzeit der fehlerhaften Anwendung: 0xhttpd.exe0
Pfad der fehlerhaften Anwendung: httpd.exe1
Pfad des fehlerhaften Moduls: httpd.exe2
Berichtskennung: httpd.exe3
Error: (04/11/2014 08:52:09 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: httpd.exe, Version: 2.4.7.0, Zeitstempel: 0x528e59ed
Name des fehlerhaften Moduls: php5ts.dll, Version: 5.5.9.0, Zeitstempel: 0x52f2c13c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002db84
ID des fehlerhaften Prozesses: 0xd94
Startzeit der fehlerhaften Anwendung: 0xhttpd.exe0
Pfad der fehlerhaften Anwendung: httpd.exe1
Pfad des fehlerhaften Moduls: httpd.exe2
Berichtskennung: httpd.exe3
Error: (04/10/2014 02:19:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: httpd.exe, Version: 2.4.7.0, Zeitstempel: 0x528e59ed
Name des fehlerhaften Moduls: php5ts.dll, Version: 5.5.9.0, Zeitstempel: 0x52f2c13c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002db84
ID des fehlerhaften Prozesses: 0x1970
Startzeit der fehlerhaften Anwendung: 0xhttpd.exe0
Pfad der fehlerhaften Anwendung: httpd.exe1
Pfad des fehlerhaften Moduls: httpd.exe2
Berichtskennung: httpd.exe3
Error: (04/10/2014 10:16:54 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: httpd.exe, Version: 2.4.7.0, Zeitstempel: 0x528e59ed
Name des fehlerhaften Moduls: php5ts.dll, Version: 5.5.9.0, Zeitstempel: 0x52f2c13c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00009a27
ID des fehlerhaften Prozesses: 0x126c
Startzeit der fehlerhaften Anwendung: 0xhttpd.exe0
Pfad der fehlerhaften Anwendung: httpd.exe1
Pfad des fehlerhaften Moduls: httpd.exe2
Berichtskennung: httpd.exe3
Error: (04/09/2014 00:57:52 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: httpd.exe, Version: 2.4.7.0, Zeitstempel: 0x528e59ed
Name des fehlerhaften Moduls: php5ts.dll, Version: 5.5.9.0, Zeitstempel: 0x52f2c13c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00009a27
ID des fehlerhaften Prozesses: 0x1f7c
Startzeit der fehlerhaften Anwendung: 0xhttpd.exe0
Pfad der fehlerhaften Anwendung: httpd.exe1
Pfad des fehlerhaften Moduls: httpd.exe2
Berichtskennung: httpd.exe3
System errors:
=============
Error: (04/15/2014 01:02:52 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (04/04/2014 05:19:22 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (04/04/2014 05:19:22 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (04/04/2014 05:19:21 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (04/04/2014 05:19:21 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (04/04/2014 05:19:20 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (03/27/2014 09:10:11 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (03/27/2014 09:10:10 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (03/27/2014 09:10:10 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (03/27/2014 09:10:09 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Microsoft Office Sessions:
=========================
Error: (04/16/2014 08:57:35 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
Error: (04/16/2014 08:57:34 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
Error: (04/16/2014 08:57:30 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
Error: (04/16/2014 07:26:09 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
Error: (04/14/2014 07:48:25 AM) (Source: Application Error)(User: )
Description: httpd.exe2.4.7.0528e59edphp5ts.dll5.5.9.052f2c13cc000000500009a27169c01cf57a407bcfbf9C:\xampp\apache\bin\httpd.exeC:\xampp\php\php5ts.dll648f3373-c398-11e3-8e4e-8c89a518e36d
Error: (04/11/2014 11:44:14 AM) (Source: Application Error)(User: )
Description: httpd.exe2.4.7.0528e59edphp5ts.dll5.5.9.052f2c13cc000000500009a271d9001cf555290b3415eC:\xampp\apache\bin\httpd.exeC:\xampp\php\php5ts.dlld6bf16cb-c15d-11e3-bc81-8c89a518e36d
Error: (04/11/2014 08:52:09 AM) (Source: Application Error)(User: )
Description: httpd.exe2.4.7.0528e59edphp5ts.dll5.5.9.052f2c13cc00000050002db84d9401cf554c8d2c679eC:\xampp\apache\bin\httpd.exeC:\xampp\php\php5ts.dllcc95c392-c145-11e3-bc81-8c89a518e36d
Error: (04/10/2014 02:19:07 PM) (Source: Application Error)(User: )
Description: httpd.exe2.4.7.0528e59edphp5ts.dll5.5.9.052f2c13cc00000050002db84197001cf54953cf209e0C:\xampp\apache\bin\httpd.exeC:\xampp\php\php5ts.dll4f66d7c0-c0aa-11e3-9099-8c89a518e36d
Error: (04/10/2014 10:16:54 AM) (Source: Application Error)(User: )
Description: httpd.exe2.4.7.0528e59edphp5ts.dll5.5.9.052f2c13cc000000500009a27126c01cf5494e339591fC:\xampp\apache\bin\httpd.exeC:\xampp\php\php5ts.dll791e1948-c088-11e3-9099-8c89a518e36d
Error: (04/09/2014 00:57:52 PM) (Source: Application Error)(User: )
Description: httpd.exe2.4.7.0528e59edphp5ts.dll5.5.9.052f2c13cc000000500009a271f7c01cf53d64a05bd95C:\xampp\apache\bin\httpd.exeC:\xampp\php\php5ts.dllcb413144-bfd5-11e3-a4db-8c89a518e36d
==================== Memory info ===========================
Percentage of memory in use: 43%
Total physical RAM: 8159.91 MB
Available physical RAM: 4635.21 MB
Total Pagefile: 16317.99 MB
Available Pagefile: 12163.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (SYSTEM) (Fixed) (Total:111.69 GB) (Free:13.57 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:232.88 GB) (Free:141.31 GB) NTFS
Drive e: (SANDISK_PET) (Removable) (Total:14.9 GB) (Free:3.65 GB) FAT32
Drive w: (WORK) (Fixed) (Total:465.76 GB) (Free:428.09 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: BB8B7571)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 233 GB) (Disk ID: 4F014F00)
Partition 1: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 5AF0F8C5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (Size: 15 GB) (Disk ID: 95C26A86)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-16 11:26:38
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP1T0L0-1 ADATA_SSD_S511_120GB rev.320ABBF0 111,79GB
Running: Gmer-19357.exe; Driver: C:\Users\PETRAL~1\AppData\Local\Temp\pxtdipow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800031a4000 45 bytes [00, 00, 10, 02, 4D, 6D, 43, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800031a402f 16 bytes [00, 01, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe[1936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075561465 2 bytes [56, 75]
.text C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe[1936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755614bb 2 bytes [56, 75]
.text ... * 2
.text C:\Users\*****\AppData\Local\Akamai\netsession_win.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075561465 2 bytes [56, 75]
.text C:\Users\*****\AppData\Local\Akamai\netsession_win.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755614bb 2 bytes [56, 75]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [2928] entry point in ".rdata" section 0000000071b771e6
.text C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe[2972] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000075561465 2 bytes [56, 75]
.text C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe[2972] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000755614bb 2 bytes [56, 75]
.text ... * 2
.text C:\Users\*****\AppData\Local\Akamai\netsession_win.exe[1356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075561465 2 bytes [56, 75]
.text C:\Users\*****\AppData\Local\Akamai\netsession_win.exe[1356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755614bb 2 bytes [56, 75]
.text ... * 2
---- Processes - GMER 2.1 ----
Process C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (*** suspicious ***) @ C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [1848] (FreemakeUtilsService/Freemake)(2012-06-03 19:41:22) 0000000000b80000
Library C:\Users\*****\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe [2972](2014-01-03 00:45:04) 0000000004060000
Library C:\Users\*****\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe [2972](2013-10-18 23:55:02) 0000000062de0000
Library C:\Users\*****\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe [2972] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00) 0000000062150000
---- EOF - GMER 2.1 ----
|
|
16.04.2014, 10:54
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner Hallo und
__________________ Zitat:
__________________ |
|
16.04.2014, 12:32
| #3 |
| | Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner Ich nutze den Rechner privat bin aber im Web/Design/Medienbereich unterwegs, weswegen ich die Adobe Programme auch gerne auf meinem eigenen Rechner nutze. Es ergab sich eine günstige Gelegenheit an eine CS6 Collection ranzukommen, die habe ich dann ergriffen. Windows und Office gabs damals zu Studentenzeiten als Download von denen zehre ich heute noch.
__________________ |
|
16.04.2014, 12:44
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner Adware/Junkware/Toolbars entfernen 1. Schritt: Malwarebytes Downloade Dir bitte  Malwarebytes Anti-Malware
2. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
3. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
4. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
16.04.2014, 13:44
| #5 |
| | Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner mbam.txt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 16.04.2014 Suchlauf-Zeit: 14:17:04 Logdatei: mbam.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.04.16.05 Rootkit Datenbank: v2014.03.27.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: ***** Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 281943 Verstrichene Zeit: 11 Min, 21 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 1 PUP.Optional.Softonic.A, HKU\S-1-5-21-2513141986-3019820137-1642034223-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, Löschen bei Neustart, [748c7b85ad53b84819c52346e2206997], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 8 PUP.Optional.SearchProtect.A, C:\Users\*****\AppData\Local\Temp\nsoB748.exe, In Quarantäne, [43bd33cdf30dd62a9e50dc47ee13738d], PUP.Optional.SearchProtect.A, C:\Users\*****\AppData\Local\Temp\nsp395D.exe, In Quarantäne, [936dfe02c33d22decb2350d30cf56e92], PUP.Optional.SearchProtect.A, C:\Users\*****\AppData\Local\Temp\nsuA78B.exe, In Quarantäne, [0df37888cc347789f0fe35ee39c835cb], PUP.Optional.SearchProtect.A, C:\Users\*****\AppData\Local\Temp\nsuA8C4.exe, In Quarantäne, [e0204cb4f50bba46fcf2889bf110a55b], PUP.Optional.SearchProtect.A, C:\Users\*****\AppData\Local\Temp\nseB498.exe, In Quarantäne, [1ce46799e21e31cf717d8f9435cc9a66], PUP.Optional.SearchProtect.A, C:\Users\*****\AppData\Local\Temp\nsjAA0C.exe, In Quarantäne, [c23e2fd1bd435ea246a8fc277e838c74], PUP.Optional.SearchProtect.A, C:\Users\*****\AppData\Local\Temp\nsjB5F0.exe, In Quarantäne, [30d09a66936de11f27c779aa758c16ea], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\searchplugins\conduit-search.xml, In Quarantäne, [4eb28e728b7533cd94ff046cff03738d], Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.023 - Bericht erstellt am 16/04/2014 um 14:28:08
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : ***** - TROEDEL
# Gestartet von : C:\Users\*****\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Conduit
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\vshare@toolbar
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_rainlendar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_rainlendar_RASMANCS
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\Conduit
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
-\\ Mozilla Firefox v27.0.1 (de)
[ Datei : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.enabledItems", "{E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1,6,2,49,{ca0849e8-2c76-42ae-9abe-34e14d337acf}:1.94,{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,{CAFEEFAC-0016-0000-0019[...]
Zeile gelöscht : user_pref("vshare.install.date", "1285113600000");
Zeile gelöscht : user_pref("vshare.install.finished", "1.0.0");
Zeile gelöscht : user_pref("vshare.install.guid", "{5b372468-4a7d-4073-acb4-c7f6387351d2}");
Zeile gelöscht : user_pref("vshare.install.isHidden", true);
Zeile gelöscht : user_pref("vshare.install.laststatreq", "1304985600000");
Zeile gelöscht : user_pref("vshare.install.newtab", false);
-\\ Google Chrome v
[ Datei : C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [2975 octets] - [16/04/2014 14:24:22]
AdwCleaner[S0].txt - [2673 octets] - [16/04/2014 14:28:08]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2733 octets] ##########
JRT.txt Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by ***** on 16.04.2014 at 14:31:33,53
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\ProgramData\big fish"
Successfully deleted: [Folder] "C:\bigfishcache"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 16.04.2014 at 14:34:41,82
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST.txt FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-04-2014
Ran by ***** (administrator) on TROEDEL on 16-04-2014 14:41:23
Running from C:\Users\*****\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
() C:\Program Files (x86)\Rainlenda2\Rainlendar2.exe
(Akamai Technologies, Inc.) C:\Users\*****\AppData\Local\Akamai\netsession_win.exe
(Dropbox, Inc.) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
(Akamai Technologies, Inc.) C:\Users\*****\AppData\Local\Akamai\netsession_win.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATITechnologies\ATI.ACE\Core-Static\MOM.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATITechnologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6629480 2011-04-14] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [HTC Sync Loader] => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [651264 2012-04-17] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATITechnologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-12-18] (Adobe Systems Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKU\S-1-5-19\...\Run: [Sidebar] => C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-20\...\Run: [Sidebar] => C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\Run: [Google Update] => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-19] (Google Inc.)
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlenda2\Rainlendar2.exe [2433024 2011-08-12] ()
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\Run: [Akamai NetSession Interface] => C:\Users\*****\AppData\Local\Akamai\netsession_win.exe [4672920 2014-03-06] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\MountPoints2: F - "F:\Adobe CS5\Set-up.exe"
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\MountPoints2: {284e5f2d-12b9-11e1-aeba-8c89a518e36d} - F:\pushinst.exe
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\MountPoints2: {4e0d16a9-12e8-11e3-a73f-8c89a518e36d} - E:\pushinst.exe
HKU\S-1-5-21-2513141986-3019820137-1642034223-1000\...\MountPoints2: {8130e10e-a340-11e1-ac45-00040ecf2451} - E:\pushinst.exe
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?rlz=1W4CHBA_deDE554
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3E7E5841DAA6CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default
FF SelectedSearchEngine: Google
FF Homepage: www.spiegel.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.2.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.2.1 - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\*****\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\*****\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF Extension: BabelFish - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\{ca0849e8-2c76-42ae-9abe-34e14d337acf} [2011-11-21]
FF Extension: Adobe DLM (powered by getPlus(R)) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} [2011-11-21]
FF Extension: Firebug - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\firebug@software.joehewitt.com.xpi [2012-02-06]
FF Extension: Zotero - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\zotero@chnm.gmu.edu.xpi [2013-10-16]
FF Extension: NoScript - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-11-21]
FF Extension: Web Developer - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\i2ego8d1.default\Extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi [2012-08-24]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-08-19]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla\Firefox\firefox.exe
Chrome:
=======
CHR HomePage: hxxp://www.bvb.de/
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\*****\AppData\Local\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U29) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Google Update) - C:\Users\*****\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-16]
CHR Extension: (Firebug Lite for Google Chrome™) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmagokdooijbeehmkpknfglimnifench [2012-02-06]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-16]
CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Bitdefender QuickScan) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-04-16]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-16]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2011-12-16]
CHR StartMenuInternet: Google Chrome - C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [96768 2012-05-31] (Freemake)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [87040 2012-03-23] ()
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
R1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [279616 2011-11-20] (DT Soft Ltd)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-16 14:34 - 2014-04-16 14:34 - 00000799 _____ () C:\Users\*****\Desktop\JRT.txt
2014-04-16 14:31 - 2014-04-16 14:31 - 00000000 ____D () C:\Windows\ERUNT
2014-04-16 14:24 - 2014-04-16 14:28 - 00000000 ____D () C:\AdwCleaner
2014-04-16 14:22 - 2014-04-16 14:23 - 00002398 _____ () C:\Users\*****\Downloads\mbam.txt
2014-04-16 14:03 - 2014-04-16 14:21 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-16 14:03 - 2014-04-16 14:03 - 00001105 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-16 14:03 - 2014-04-16 14:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-16 14:03 - 2014-04-16 14:03 - 00000000 ____D () C:\Program Files (x86)\MalwarebytesAnti-Malware
2014-04-16 14:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-16 14:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-16 14:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-16 14:00 - 2014-04-16 14:00 - 01016261 _____ (Thisisu) C:\Users\*****\Downloads\JRT.exe
2014-04-16 13:59 - 2014-04-16 13:59 - 01426178 _____ () C:\Users\*****\Downloads\adwcleaner.exe
2014-04-16 13:57 - 2014-04-16 13:58 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-16 11:26 - 2014-04-16 11:31 - 00005273 _____ () C:\Users\*****\Downloads\Gmer.txt
2014-04-16 10:24 - 2014-04-16 10:24 - 00380416 _____ () C:\Users\*****\Downloads\Gmer-19357.exe
2014-04-16 10:05 - 2014-04-16 14:41 - 00019882 _____ () C:\Users\*****\Downloads\FRST.txt
2014-04-16 10:05 - 2014-04-16 14:41 - 00000000 ____D () C:\FRST
2014-04-16 10:05 - 2014-04-16 11:30 - 00040403 _____ () C:\Users\*****\Downloads\Addition.txt
2014-04-16 10:02 - 2014-04-16 11:31 - 00000542 _____ () C:\Users\*****\Downloads\defogger_disable.txt
2014-04-16 10:02 - 2014-04-16 10:02 - 00000168 _____ () C:\Users\*****\defogger_reenable
2014-04-16 08:56 - 2014-04-16 08:56 - 00000000 ____D () C:\Users\*****\AppData\Roaming\QuickScan
2014-04-16 08:55 - 2014-04-16 08:55 - 00313720 _____ () C:\Users\*****\AppData\Local\census.cache
2014-04-16 08:55 - 2014-04-16 08:55 - 00134057 _____ () C:\Users\*****\AppData\Local\ars.cache
2014-04-16 08:41 - 2014-04-16 08:41 - 02054144 _____ (Farbar) C:\Users\*****\Downloads\FRST64.exe
2014-04-16 08:41 - 2014-04-16 08:41 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-04-16 08:40 - 2014-04-16 08:40 - 02405664 _____ (Trend Micro Inc.) C:\Users\*****\Downloads\HousecallLauncher64.exe
2014-04-16 08:40 - 2014-04-16 08:40 - 00000036 _____ () C:\Users\*****\AppData\Local\housecall.guid.cache
2014-04-16 08:36 - 2014-04-16 08:36 - 00001346 _____ () C:\Users\*****\Desktop\Funde.txt
2014-04-16 07:26 - 2014-04-16 07:26 - 02347384 _____ (ESET) C:\Users\*****\Downloads\esetsmartinstaller_deu.exe
2014-04-16 07:26 - 2014-04-16 07:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-08 10:47 - 2014-04-08 10:47 - 01522297 _____ () C:\Users\*****\Downloads\KeePass-1.27.zip
2014-04-08 10:29 - 2014-04-08 10:29 - 00249344 _____ () C:\Users\*****\Downloads\botosani_05.04.2014.xls
2014-04-07 14:39 - 2014-04-07 14:39 - 01315556 _____ () C:\Users\*****\Downloads\grey-buttons.psd
2014-04-07 12:38 - 2014-04-07 12:38 - 00187590 _____ () C:\Users\*****\Desktop\klingelschild.psd
2014-04-02 19:23 - 2014-04-02 19:23 - 00014908 _____ () C:\Users\*****\Downloads\jquery-cookie-master.zip
2014-04-01 11:57 - 2014-04-01 11:57 - 00011012 _____ () C:\Users\*****\Downloads\double_opt-in_php.zip
2014-03-28 18:48 - 2014-03-28 18:48 - 00003459 _____ () C:\Users\*****\Downloads\scroll-to-top.zip
2014-03-28 17:12 - 2014-03-28 17:12 - 00006743 _____ () C:\Users\*****\Downloads\de-pp-logos.zip
2014-03-27 16:09 - 2014-03-27 16:09 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Bejeweled2
2014-03-26 20:35 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-26 20:35 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-26 20:35 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-26 20:35 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-26 20:35 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-26 20:35 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-26 20:35 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-26 20:35 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-26 20:35 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-26 20:35 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-26 20:35 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-26 20:35 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-26 20:35 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-26 20:35 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-26 20:35 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-26 20:35 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-26 20:35 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-26 20:35 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-26 20:35 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-26 20:35 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-26 20:35 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-26 20:35 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-26 20:35 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-26 20:35 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-26 20:35 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-26 20:35 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-26 20:35 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-26 20:35 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-26 20:35 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-26 20:35 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-26 20:35 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-26 20:35 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-26 20:35 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-26 20:35 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-26 20:35 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-26 20:35 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-26 20:35 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-26 20:35 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-26 20:35 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-26 20:35 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-26 20:35 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-26 20:35 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-26 20:35 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-26 20:35 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-26 20:35 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-26 20:35 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-26 20:35 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-26 20:35 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-26 17:04 - 2014-03-26 17:04 - 00000000 ____D () C:\Program Files (x86)\ClairesGardenStudio
2014-03-26 11:08 - 2014-03-26 15:02 - 00000000 ____D () C:\Users\*****\Desktop\REALEASE STUFF
2014-03-22 14:15 - 2014-03-22 14:15 - 01141308 _____ () C:\Users\*****\Downloads\jquery-ui-themes-1.9.2.zip
2014-03-20 13:33 - 2014-03-20 13:33 - 00006673 _____ () C:\Users\*****\Downloads\configurable_product_extension.zip
2014-03-19 09:45 - 2014-03-19 09:45 - 00002361 _____ () C:\Users\*****\Downloads\Improved_one_page_checkout_H-O.zip
==================== One Month Modified Files and Folders =======
2014-04-16 14:41 - 2014-04-16 10:05 - 00019882 _____ () C:\Users\*****\Downloads\FRST.txt
2014-04-16 14:41 - 2014-04-16 10:05 - 00000000 ____D () C:\FRST
2014-04-16 14:36 - 2009-07-14 06:45 - 00013248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-16 14:36 - 2009-07-14 06:45 - 00013248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-16 14:34 - 2014-04-16 14:34 - 00000799 _____ () C:\Users\*****\Desktop\JRT.txt
2014-04-16 14:34 - 2009-07-14 19:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-04-16 14:34 - 2009-07-14 19:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-04-16 14:34 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-16 14:32 - 2011-11-19 15:40 - 01224340 _____ () C:\Windows\WindowsUpdate.log
2014-04-16 14:31 - 2014-04-16 14:31 - 00000000 ____D () C:\Windows\ERUNT
2014-04-16 14:29 - 2013-08-19 09:37 - 00017846 _____ () C:\Windows\setupact.log
2014-04-16 14:29 - 2012-10-06 20:56 - 00000000 ____D () C:\Users\*****\AppData\Local\Htc
2014-04-16 14:29 - 2012-07-18 20:21 - 00000000 ___RD () C:\Users\*****\Dropbox
2014-04-16 14:29 - 2012-07-16 21:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-04-16 14:29 - 2012-01-09 20:04 - 00000000 ____D () C:\Users\*****\.rainlendar2
2014-04-16 14:29 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-16 14:28 - 2014-04-16 14:24 - 00000000 ____D () C:\AdwCleaner
2014-04-16 14:23 - 2014-04-16 14:22 - 00002398 _____ () C:\Users\*****\Downloads\mbam.txt
2014-04-16 14:21 - 2014-04-16 14:03 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-16 14:20 - 2013-08-19 11:24 - 00144154 _____ () C:\Windows\PFRO.log
2014-04-16 14:19 - 2011-11-20 13:13 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2014-04-16 14:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-04-16 14:03 - 2014-04-16 14:03 - 00001105 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-16 14:03 - 2014-04-16 14:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-16 14:03 - 2014-04-16 14:03 - 00000000 ____D () C:\Program Files (x86)\MalwarebytesAnti-Malware
2014-04-16 14:00 - 2014-04-16 14:00 - 01016261 _____ (Thisisu) C:\Users\*****\Downloads\JRT.exe
2014-04-16 13:59 - 2014-04-16 13:59 - 01426178 _____ () C:\Users\*****\Downloads\adwcleaner.exe
2014-04-16 13:58 - 2014-04-16 13:57 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-16 13:44 - 2011-11-19 18:52 - 00001164 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000UA.job
2014-04-16 13:44 - 2011-11-19 18:52 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000Core.job
2014-04-16 13:18 - 2012-01-17 20:17 - 00000000 ____D () C:\Program Files (x86)\eclipse
2014-04-16 11:31 - 2014-04-16 11:26 - 00005273 _____ () C:\Users\*****\Downloads\Gmer.txt
2014-04-16 11:31 - 2014-04-16 10:02 - 00000542 _____ () C:\Users\*****\Downloads\defogger_disable.txt
2014-04-16 11:30 - 2014-04-16 10:05 - 00040403 _____ () C:\Users\*****\Downloads\Addition.txt
2014-04-16 10:24 - 2014-04-16 10:24 - 00380416 _____ () C:\Users\*****\Downloads\Gmer-19357.exe
2014-04-16 10:13 - 2012-09-14 19:27 - 00001456 _____ () C:\Users\*****\AppData\Local\Adobe Save for Web 13.0 Prefs
2014-04-16 10:04 - 2011-11-25 00:49 - 00000085 _____ () C:\Users\*****\mm.cfg
2014-04-16 10:02 - 2014-04-16 10:02 - 00000168 _____ () C:\Users\*****\defogger_reenable
2014-04-16 10:02 - 2011-11-19 15:40 - 00000000 ____D () C:\Users\*****
2014-04-16 08:56 - 2014-04-16 08:56 - 00000000 ____D () C:\Users\*****\AppData\Roaming\QuickScan
2014-04-16 08:55 - 2014-04-16 08:55 - 00313720 _____ () C:\Users\*****\AppData\Local\census.cache
2014-04-16 08:55 - 2014-04-16 08:55 - 00134057 _____ () C:\Users\*****\AppData\Local\ars.cache
2014-04-16 08:44 - 2011-11-21 22:30 - 00000000 ____D () C:\Users\*****\AppData\Roaming\uTorrent
2014-04-16 08:41 - 2014-04-16 08:41 - 02054144 _____ (Farbar) C:\Users\*****\Downloads\FRST64.exe
2014-04-16 08:41 - 2014-04-16 08:41 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-04-16 08:40 - 2014-04-16 08:40 - 02405664 _____ (Trend Micro Inc.) C:\Users\*****\Downloads\HousecallLauncher64.exe
2014-04-16 08:40 - 2014-04-16 08:40 - 00000036 _____ () C:\Users\*****\AppData\Local\housecall.guid.cache
2014-04-16 08:36 - 2014-04-16 08:36 - 00001346 _____ () C:\Users\*****\Desktop\Funde.txt
2014-04-16 08:28 - 2014-02-10 16:04 - 00000000 ____D () C:\Program Files\CamStudio 2.7
2014-04-16 07:30 - 2011-11-21 21:42 - 00000000 ____D () C:\Users\*****\AppData\Local\Adobe
2014-04-16 07:26 - 2014-04-16 07:26 - 02347384 _____ (ESET) C:\Users\*****\Downloads\esetsmartinstaller_deu.exe
2014-04-16 07:26 - 2014-04-16 07:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-14 14:00 - 2013-08-19 10:06 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Wuala
2014-04-14 11:19 - 2014-02-04 08:22 - 00000000 ___RD () C:\Users\*****\Desktop\ClairesGardenStudio Ordner
2014-04-14 10:48 - 2013-08-16 17:10 - 00000000 ___RD () C:\Users\*****\Desktop\KV Dreck
2014-04-10 13:35 - 2014-02-28 08:38 - 00001475 _____ () C:\Users\*****\Documents\DiffDaff.htm
2014-04-10 13:35 - 2014-02-04 09:00 - 00038563 _____ () C:\Users\*****\Documents\~diffdaff2.htm
2014-04-10 13:35 - 2014-02-04 09:00 - 00027472 _____ () C:\Users\*****\Documents\~diffdaff1.htm
2014-04-10 13:35 - 2014-02-04 09:00 - 00013298 _____ () C:\Users\*****\Documents\~diffdafftop.htm
2014-04-09 18:39 - 2012-01-10 19:06 - 00000000 ____D () C:\Users\*****\AppData\Roaming\FileZilla
2014-04-09 18:39 - 2011-11-21 22:44 - 00000600 _____ () C:\Users\*****\AppData\Roaming\winscp.rnd
2014-04-09 10:20 - 2012-05-04 10:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-08 14:20 - 2011-11-21 21:58 - 00000000 ____D () C:\Users\*****\AppData\Local\Mozilla
2014-04-08 14:15 - 2011-11-21 21:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla
2014-04-08 10:47 - 2014-04-08 10:47 - 01522297 _____ () C:\Users\*****\Downloads\KeePass-1.27.zip
2014-04-08 10:46 - 2013-10-15 12:12 - 00000849 _____ () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2014-04-08 10:29 - 2014-04-08 10:29 - 00249344 _____ () C:\Users\*****\Downloads\botosani_05.04.2014.xls
2014-04-07 19:45 - 2011-11-21 22:51 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc
2014-04-07 14:39 - 2014-04-07 14:39 - 01315556 _____ () C:\Users\*****\Downloads\grey-buttons.psd
2014-04-07 12:38 - 2014-04-07 12:38 - 00187590 _____ () C:\Users\*****\Desktop\klingelschild.psd
2014-04-03 19:23 - 2012-12-15 20:03 - 00000000 ____D () C:\Users\*****\AppData\Local\Akamai
2014-04-03 09:51 - 2014-04-16 14:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-16 14:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-16 14:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-02 19:23 - 2014-04-02 19:23 - 00014908 _____ () C:\Users\*****\Downloads\jquery-cookie-master.zip
2014-04-02 13:39 - 2011-11-19 18:52 - 00004160 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000UA
2014-04-02 13:39 - 2011-11-19 18:52 - 00003764 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2513141986-3019820137-1642034223-1000Core
2014-04-01 11:57 - 2014-04-01 11:57 - 00011012 _____ () C:\Users\*****\Downloads\double_opt-in_php.zip
2014-03-31 09:25 - 2011-11-21 22:04 - 00000000 ____D () C:\Program Files (x86)\FileZilla
2014-03-28 18:48 - 2014-03-28 18:48 - 00003459 _____ () C:\Users\*****\Downloads\scroll-to-top.zip
2014-03-28 17:12 - 2014-03-28 17:12 - 00006743 _____ () C:\Users\*****\Downloads\de-pp-logos.zip
2014-03-27 16:09 - 2014-03-27 16:09 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Bejeweled2
2014-03-27 13:06 - 2012-05-25 11:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Audacity
2014-03-27 08:09 - 2013-08-19 09:37 - 04985944 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-26 20:36 - 2013-08-16 16:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-26 20:35 - 2012-01-24 19:34 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-26 18:17 - 2013-08-16 17:10 - 00000000 ____D () C:\Users\*****\Desktop\Rechnungen, Quittungen etc. (DRUCK)
2014-03-26 17:04 - 2014-03-26 17:04 - 00000000 ____D () C:\Program Files (x86)\ClairesGardenStudio
2014-03-26 15:02 - 2014-03-26 11:08 - 00000000 ____D () C:\Users\*****\Desktop\REALEASE STUFF
2014-03-26 12:55 - 2013-08-16 17:12 - 00118272 ___SH () C:\Users\*****\Documents\Thumbs.db
2014-03-25 09:26 - 2011-11-21 21:45 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Notepad++
2014-03-25 09:26 - 2011-11-21 21:45 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2014-03-22 14:15 - 2014-03-22 14:15 - 01141308 _____ () C:\Users\*****\Downloads\jquery-ui-themes-1.9.2.zip
2014-03-20 13:33 - 2014-03-20 13:33 - 00006673 _____ () C:\Users\*****\Downloads\configurable_product_extension.zip
2014-03-19 09:45 - 2014-03-19 09:45 - 00002361 _____ () C:\Users\*****\Downloads\Improved_one_page_checkout_H-O.zip
Files to move or delete:
====================
C:\Users\*****\AppData\Roaming\CamLayout.ini
C:\Users\*****\AppData\Roaming\CamShapes.ini
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\avgnt.exe
C:\Users\*****\AppData\Local\Temp\npp.6.4.5.Installer.exe
C:\Users\*****\AppData\Local\Temp\npp.6.5.1.Installer.exe
C:\Users\*****\AppData\Local\Temp\npp.6.5.2.Installer.exe
C:\Users\*****\AppData\Local\Temp\npp.6.5.5.Installer.exe
C:\Users\*****\AppData\Local\Temp\npp.6.5.Installer.exe
C:\Users\*****\AppData\Local\Temp\proxy_util_w32.dll
C:\Users\*****\AppData\Local\Temp\Quarantine.exe
C:\Users\*****\AppData\Local\Temp\smd_runtime.exe
C:\Users\*****\AppData\Local\Temp\utt12E7.tmp.exe
C:\Users\*****\AppData\Local\Temp\utt954F.tmp.exe
C:\Users\*****\AppData\Local\Temp\uttA1EC.tmp.exe
C:\Users\*****\AppData\Local\Temp\vlc-2.0.8-win32.exe
C:\Users\*****\AppData\Local\Temp\vlc-2.1.1-win32.exe
C:\Users\*****\AppData\Local\Temp\xmlUpdater.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-10 11:51
==================== End Of Log ============================
|
|
16.04.2014, 14:08
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner Okay, dann bitte Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte Malwarebytes Anti-Malware
ESET Online Scanner
__________________ --> Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner |
|
16.04.2014, 15:44
| #7 |
| | Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner mbam.txt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 16.04.2014 Suchlauf-Zeit: 15:35:10 Logdatei: mbam2.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.04.16.05 Rootkit Datenbank: v2014.03.27.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: ***** Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 281802 Verstrichene Zeit: 10 Min, 7 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) ESET logfile Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f6c6b6d8eaa74f46b9694c6ec5ad3494
# engine=17904
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-16 06:28:59
# local_time=2014-04-16 08:28:59 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 3802 168297444 0 0
# compatibility_mode=5893 16776574 100 94 20962341 149259589 0 0
# scanned=613107
# found=8
# cleaned=7
# scan_time=3641
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[2].0"
sh=638DA8DBB171564FA4F31D42E77EBB71A33E2A91 ft=1 fh=37f8f0712c5ccad4 vn="Variante von Win32/Bunndle potenziell unsichere Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files\CamStudio 2.7\BunndleOfferManager.exe"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe"
sh=74736C9A54C385AF16A42795E231B4C3425D9338 ft=1 fh=f92a8b260b274c8c vn="Variante von Win32/Toolbar.Conduit.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\NCH Software\Debut\debut.exe"
sh=B3F76FB12066DC4F51780F3F9DABA5A9018F359F ft=1 fh=70d549a263d539ed vn="Variante von Win32/Toolbar.Conduit.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\NCH Software\Debut\debutsetup_v1.82.exe"
sh=A5EECED5D0A893334F8B79F5A6FD7BFA01005860 ft=1 fh=16ed0088e5a650a1 vn="Win32/Somoto.M evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\*****\AppData\Local\Temp\nsc5057.tmp"
sh=9B229D45DAF8E42A9E5AB80B8A8F3C1DA28BE5D9 ft=1 fh=fc29e722f48e28ff vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows\Installer\MSI84E5.tmp"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ApnIC[2].0"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f6c6b6d8eaa74f46b9694c6ec5ad3494
# engine=17904
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-16 07:59:11
# local_time=2014-04-16 09:59:11 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 5431 168302856 1996 0
# compatibility_mode=5893 16776574 100 94 20967753 149265001 0 0
# scanned=613599
# found=0
# cleaned=0
# scan_time=3645
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f6c6b6d8eaa74f46b9694c6ec5ad3494
# engine=17910
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-16 02:37:46
# local_time=2014-04-16 04:37:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 11521 168326771 4309 0
# compatibility_mode=5893 16776574 100 94 20991668 149288916 0 0
# scanned=613498
# found=0
# cleaned=0
# scan_time=3600
|
|
16.04.2014, 21:17
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner TFC - Temp File Cleaner Lade dir  TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
17.04.2014, 06:09
| #9 |
| | Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner Ok dann mache ich das. Vielen vielen Dank für die schnelle Hilfe  Nur so zum Verständnis, hatte ich jetzt einen Trojaner oder wovon genau war mein System befallen? Und denkst du, dass jetzt nichts mehr von meinem Rechner ausgelesen werden kann? Könnte ich die Schritte, die wir jetzt vorgenommen haben, immer mal wieder wiederholen, um mein System zu reinigen? Danke und Gruß |
|
17.04.2014, 11:13
| #10 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online ScannerZitat:
Du solltest zusehen, dass du nicht ständig Müll in deinen Rechner holst!  Lesestoff:Goldene Sicherheitsregeln Halte Dich am besten grob an diese Regeln:
Alles noch genauer erklärt steht hier => Kompromittierung unvermeidbar?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Win7 64Bit - Email Account wurde kompromittiert, vermutlich durch Virus, Trojaner, Malware oder Hijacker. Nach Scan mit ESET Online Scanner |
| antivirus, benutzerdaten, branding, browser, cpu-z, dvdvideosoft ltd., email, encrypt, google, homepage, lightning, mozilla, pup.optional.conduit.a, pup.optional.searchprotect.a, pup.optional.softonic.a, scan, svchost.exe, virus, win32/bundled.toolbar.ask, win32/bundled.toolbar.ask.d, win32/bundled.toolbar.ask.f, win32/somoto.m, win32/toolbar.conduit.h, ändern |
Linear-Darstellung
