| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Webseiten werden auf Werbung umgeleitetWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
21.04.2014, 14:23
| #1 |
 |  Windows 7: Webseiten werden auf Werbung umgeleitet Hallo liebe Helfer,  ich habe mal wieder ein Problem und denke dass ich mir mal wieder etwas eingefangen habe. Wenn ich zum Beispiel bei Facebook den Chat öffnen möchte kommt immer irgendeine meistens Avira und Java Werbung in einem neuen Tab. Ich benutzte nur Mozilla Firefox. Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:43 on 21/04/2014 (USER)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2014 02
Ran by USER (administrator) on HP-PC on 21-04-2014 14:48:28
Running from C:\Users\USER\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Corel, Inc.) C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe
() C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe
() C:\Windows\SysWOW64\PSIService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Avira Operations GmbH & Co. KG) C:\program files (x86)\avira\antivir desktop\ipmGui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-04-06] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-04] (Realtek Semiconductor)
HKLM\...\Run: [Corel Photo Downloader] => C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe [531784 2007-10-31] (Corel, Inc.)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-19] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-12-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [BtTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [371976 2012-09-19] (IVT Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Corel File Shell Monitor] => C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe [16200 2007-10-30] ()
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2239376 2013-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [180304 2014-04-15] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Startup: C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.youdagames.com?hp=1
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8D9489EB9372CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0Dzzzy0DyCyB0C0E0EtA0A0D0DyDyByDtN0D0Tzu0SyCzyzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825073042&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0Dzzzy0DyCyB0C0E0EtA0A0D0DyDyByDtN0D0Tzu0SyCzyzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825073042&ir=
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0Dzzzy0DyCyB0C0E0EtA0A0D0DyDyByDtN0D0Tzu0SyCzyzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825073042&ir=
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0Dzzzy0DyCyB0C0E0EtA0A0D0DyDyByDtN0D0Tzu0SyCzyzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825073042&ir=
SearchScopes: HKCU - {0B753EDB-35FD-4140-8205-E2C63BB686FC} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=67d4469f-6f18-4d7a-bc74-7deecda0640f&apn_sauid=4B272140-533C-4F20-A814-1E36A808F475
BHO: No Name - {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} - No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWOW64\skype4com.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default
FF DefaultSearchEngine: Amazon
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @oberon-media.com/ONCAdapter - C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-25]
FF Extension: ImageHost Grabber - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} [2013-06-29]
FF Extension: anonymoX - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\client@anonymox.net.xpi [2013-10-26]
FF Extension: Media Stealer - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\stealer@physacco.com.xpi [2013-07-11]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-08-29]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-09-13]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-09-13]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [122448 2014-04-15] (Avira Operations GmbH & Co. KG)
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1612552 2012-09-26] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [146184 2012-09-19] (IVT Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-04-06] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [279848 2007-06-27] (Nero AG)
R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe [1922600 2013-07-08] (Pandora.TV)
R2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [177704 2007-06-05] ()
==================== Drivers (Whitelisted) ====================
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2014-04-09] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-18] (Avira Operations GmbH & Co. KG)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [34912 2012-06-15] (Ralink Corporation.)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)
S3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [56904 2012-07-19] (Ralink Corporation)
S3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [48608 2012-10-02] (Ralink Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-01] (Intel Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2014-04-09] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-28] (Realtek Semiconductor Corp.)
R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [692832 2012-10-02] (Ralink Technology, Corp.)
R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2012-04-06] (Synaptics Incorporated)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [34912 2012-06-15] (Ralink Corporation.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-21 14:46 - 2014-04-21 14:48 - 00036721 _____ () C:\Users\USER\Downloads\Addition.txt
2014-04-21 14:46 - 2014-04-21 14:46 - 00380416 _____ () C:\Users\USER\Downloads\Gmer-19357.exe
2014-04-21 14:44 - 2014-04-21 14:48 - 00019560 _____ () C:\Users\USER\Downloads\FRST.txt
2014-04-21 14:44 - 2014-04-21 14:48 - 00000000 ____D () C:\FRST
2014-04-21 14:44 - 2014-04-21 14:44 - 02056704 _____ (Farbar) C:\Users\USER\Downloads\FRST64.exe
2014-04-21 14:43 - 2014-04-21 14:43 - 00000470 _____ () C:\Users\USER\Downloads\defogger_disable.log
2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 _____ () C:\Users\USER\defogger_reenable
2014-04-21 14:42 - 2014-04-21 14:42 - 00050477 _____ () C:\Users\USER\Downloads\Defogger.exe
2014-04-21 12:25 - 2014-04-21 12:25 - 00000000 _____ () C:\Windows\SysWOW64\sho5C72.tmp
2014-04-20 21:08 - 2014-04-20 22:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-20 21:08 - 2014-04-20 21:08 - 00001075 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-20 21:08 - 2014-04-20 21:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-20 21:08 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-20 21:08 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-20 21:08 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieUserList
2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieSiteList
2014-04-20 15:04 - 2014-04-20 15:04 - 00000000 _____ () C:\Windows\SysWOW64\sho8C6B.tmp
2014-04-19 19:32 - 2014-04-19 19:32 - 00000000 _____ () C:\Windows\SysWOW64\shoC8FC.tmp
2014-04-18 10:23 - 2014-04-18 10:23 - 00001106 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-04-16 19:31 - 2014-04-16 19:31 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2014-04-12 04:19 - 2014-04-12 04:19 - 00000000 _____ () C:\Windows\SysWOW64\sho2F42.tmp
2014-04-12 03:02 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-12 03:02 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-12 03:02 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-12 03:02 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-12 03:02 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-12 03:02 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-12 03:02 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-12 03:02 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-12 03:02 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-12 03:02 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-12 03:02 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-12 03:02 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-12 03:02 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-12 03:02 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-12 03:02 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-12 03:02 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-12 03:02 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-12 03:02 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-12 03:02 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-12 03:02 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-12 03:02 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-12 03:02 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-12 03:02 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-12 03:02 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-12 03:02 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-12 03:02 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-12 03:02 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-12 03:02 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-12 03:02 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-12 03:02 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-12 03:02 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-12 03:02 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-12 03:02 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-12 03:02 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-12 03:02 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-12 03:02 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-12 03:02 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-12 03:01 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-12 03:01 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-12 03:01 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-12 03:01 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-12 03:01 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-12 03:01 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-12 03:01 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-12 03:01 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-12 03:01 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-12 03:01 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-12 03:01 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-11 00:10 - 2014-04-11 00:10 - 00000000 _____ () C:\Windows\SysWOW64\shoFAD5.tmp
2014-04-09 22:22 - 2007-05-31 19:30 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-04-09 22:22 - 2007-05-31 19:30 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-04-09 22:22 - 2007-05-31 19:29 - 00021352 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_2.dll
2014-04-09 22:22 - 2007-05-31 19:29 - 00018280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_2.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-04-09 22:22 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-04-09 22:22 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-04-09 22:22 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-04-09 22:22 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-04-09 22:22 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-04-09 22:22 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-04-09 22:22 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-04-09 22:22 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-04-09 22:22 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-04-09 22:22 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-04-09 22:22 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-04-09 22:22 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-04-09 22:22 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-04-09 22:22 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-04-09 22:22 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-04-09 22:22 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-04-09 22:22 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-04-09 22:22 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-04-09 22:22 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-04-09 22:22 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-04-09 22:22 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-04-09 22:22 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-04-09 22:22 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-04-09 22:22 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-04-09 22:22 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-04-09 22:22 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-04-09 22:22 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-04-09 22:22 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-04-09 22:22 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-04-09 22:22 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-04-09 22:22 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-04-09 22:22 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-04-09 22:21 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-04-09 22:21 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-04-09 22:21 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-04-09 22:21 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-04-09 22:21 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-04-09 22:21 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-04-09 22:21 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-04-09 22:21 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-04-09 22:21 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-04-09 22:21 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-04-09 22:21 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-04-09 22:21 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-04-09 22:21 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-04-09 22:21 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-04-09 22:21 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-04-09 22:21 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-04-09 22:19 - 2014-04-09 22:23 - 00163375 _____ () C:\Windows\DirectX.log
2014-04-09 22:17 - 2014-04-09 22:27 - 00310984 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-04-09 22:17 - 2014-04-09 22:17 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-04-09 11:32 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 11:32 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 11:32 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 11:32 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 11:32 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 11:32 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 11:32 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 11:32 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 11:32 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 11:32 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 11:32 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 11:32 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 11:32 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 11:32 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 11:32 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 11:32 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 11:32 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 01:25 - 2014-04-09 01:25 - 00000000 _____ () C:\Windows\SysWOW64\shoA21D.tmp
2014-04-09 00:03 - 2014-04-09 00:03 - 00000260 _____ () C:\Users\USER\1201226.ini
2014-04-08 23:48 - 2014-04-09 00:03 - 536396984 _____ (Boonty ) C:\Users\USER\thelakehousechildrenofsilence_sv{1201226}.exe
2014-04-07 22:48 - 2014-04-07 22:48 - 00000000 ____D () C:\Users\USER\AppData\Local\AlawarWrapper
2014-04-07 22:48 - 2014-04-07 22:48 - 00000000 ____D () C:\Users\Public\Documents\AlawarWrapper
2014-04-07 22:47 - 2014-04-07 22:48 - 00000000 ____D () C:\ProgramData\AlawarWrapper
2014-04-07 09:26 - 2014-04-07 09:26 - 00000000 ____D () C:\Users\USER\AppData\Roaming\HomeMakeover
2014-04-07 00:15 - 2014-04-07 00:15 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-04-06 23:56 - 2014-04-09 13:16 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yahoo US
2014-04-06 23:54 - 2014-04-09 13:16 - 00000000 ____D () C:\Users\USER\AppData\Local\GamesManager
2014-04-06 00:43 - 2014-04-06 00:43 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Brave Giant
2014-03-30 18:23 - 2014-04-05 17:42 - 00000000 ____D () C:\Users\USER\Downloads\Textures
2014-03-29 13:04 - 2014-03-29 13:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-25 02:13 - 2014-03-25 02:13 - 00000000 _____ () C:\Windows\SysWOW64\sho292A.tmp
==================== One Month Modified Files and Folders =======
2014-04-21 14:48 - 2014-04-21 14:46 - 00036721 _____ () C:\Users\USER\Downloads\Addition.txt
2014-04-21 14:48 - 2014-04-21 14:44 - 00019560 _____ () C:\Users\USER\Downloads\FRST.txt
2014-04-21 14:48 - 2014-04-21 14:44 - 00000000 ____D () C:\FRST
2014-04-21 14:46 - 2014-04-21 14:46 - 00380416 _____ () C:\Users\USER\Downloads\Gmer-19357.exe
2014-04-21 14:44 - 2014-04-21 14:44 - 02056704 _____ (Farbar) C:\Users\USER\Downloads\FRST64.exe
2014-04-21 14:43 - 2014-04-21 14:43 - 00000470 _____ () C:\Users\USER\Downloads\defogger_disable.log
2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 _____ () C:\Users\USER\defogger_reenable
2014-04-21 14:42 - 2014-04-21 14:42 - 00050477 _____ () C:\Users\USER\Downloads\Defogger.exe
2014-04-21 14:22 - 2012-09-13 19:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-21 14:17 - 2013-06-26 19:33 - 01596864 _____ () C:\Windows\WindowsUpdate.log
2014-04-21 14:03 - 2009-07-14 06:45 - 00015616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-21 14:03 - 2009-07-14 06:45 - 00015616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-21 13:54 - 2012-09-26 09:53 - 00000967 _____ () C:\Windows\SysWOW64\bscs.ini
2014-04-21 13:53 - 2014-01-23 08:21 - 00013117 _____ () C:\Windows\setupact.log
2014-04-21 13:53 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-21 12:25 - 2014-04-21 12:25 - 00000000 _____ () C:\Windows\SysWOW64\sho5C72.tmp
2014-04-21 12:19 - 2013-12-01 22:56 - 00000000 ____D () C:\Users\USER\AppData\Roaming\XnView
2014-04-21 12:19 - 2013-06-29 17:59 - 00000000 ____D () C:\Users\USER\AppData\Roaming\FileZilla
2014-04-21 11:13 - 2013-06-29 17:35 - 00000000 ____D () C:\Users\USER\AppData\Local\Adobe
2014-04-21 11:01 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-20 23:29 - 2014-03-17 20:19 - 00000000 ____D () C:\Users\USER\Downloads\Neuer Ordner
2014-04-20 22:07 - 2014-04-20 21:08 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-20 21:56 - 2014-02-02 09:03 - 00241506 _____ () C:\Windows\PFRO.log
2014-04-20 21:56 - 2009-07-14 06:45 - 00000000 ____D () C:\Windows\Setup
2014-04-20 21:08 - 2014-04-20 21:08 - 00001075 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-20 21:08 - 2014-04-20 21:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-20 21:08 - 2013-10-09 12:48 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-20 19:44 - 2013-06-26 20:33 - 00000000 ____D () C:\Users\USER\AppData\Roaming\SoftGrid Client
2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieUserList
2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieSiteList
2014-04-20 15:04 - 2014-04-20 15:04 - 00000000 _____ () C:\Windows\SysWOW64\sho8C6B.tmp
2014-04-19 19:32 - 2014-04-19 19:32 - 00000000 _____ () C:\Windows\SysWOW64\shoC8FC.tmp
2014-04-18 22:05 - 2013-10-10 23:01 - 00000000 ____D () C:\Users\USER\Downloads\Fansites
2014-04-18 17:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-18 10:23 - 2014-04-18 10:23 - 00001106 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-04-18 10:23 - 2014-02-17 00:02 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-04-18 10:23 - 2014-02-17 00:01 - 00000000 ____D () C:\ProgramData\Package Cache
2014-04-17 15:27 - 2013-07-11 23:00 - 00000000 ____D () C:\Users\USER\AppData\Roaming\vlc
2014-04-16 19:31 - 2014-04-16 19:31 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2014-04-14 12:40 - 2011-10-01 13:18 - 00000000 ____D () C:\ProgramData\Adobe
2014-04-14 12:39 - 2014-01-11 02:48 - 00000000 ____D () C:\Program Files\Adobe
2014-04-14 12:39 - 2011-10-01 13:18 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-04-14 12:38 - 2013-09-19 22:01 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-04-13 13:26 - 2014-03-04 17:11 - 00000000 ____D () C:\Users\USER\Downloads\H50
2014-04-12 04:19 - 2014-04-12 04:19 - 00000000 _____ () C:\Windows\SysWOW64\sho2F42.tmp
2014-04-12 04:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-11 14:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 00:10 - 2014-04-11 00:10 - 00000000 _____ () C:\Windows\SysWOW64\shoFAD5.tmp
2014-04-09 22:27 - 2014-04-09 22:17 - 00310984 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-04-09 22:23 - 2014-04-09 22:19 - 00163375 _____ () C:\Windows\DirectX.log
2014-04-09 22:17 - 2014-04-09 22:17 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-04-09 22:14 - 2011-10-01 11:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-09 16:25 - 2013-08-15 08:46 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 16:23 - 2011-10-01 12:38 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 13:16 - 2014-04-06 23:56 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yahoo US
2014-04-09 13:16 - 2014-04-06 23:54 - 00000000 ____D () C:\Users\USER\AppData\Local\GamesManager
2014-04-09 13:15 - 2014-02-20 01:23 - 00000000 ____D () C:\ProgramData\Trymedia
2014-04-09 13:13 - 2013-12-22 20:59 - 00000000 ____D () C:\Users\USER\AppData\Roaming\WildTangent
2014-04-09 13:13 - 2013-12-22 20:59 - 00000000 ____D () C:\ProgramData\WildTangent
2014-04-09 13:12 - 2013-11-24 20:31 - 00000000 ____D () C:\ProgramData\Oberon Media
2014-04-09 01:25 - 2014-04-09 01:25 - 00000000 _____ () C:\Windows\SysWOW64\shoA21D.tmp
2014-04-09 00:48 - 2013-11-14 22:24 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Oberon Media
2014-04-09 00:03 - 2014-04-09 00:03 - 00000260 _____ () C:\Users\USER\1201226.ini
2014-04-09 00:03 - 2014-04-08 23:48 - 536396984 _____ (Boonty ) C:\Users\USER\thelakehousechildrenofsilence_sv{1201226}.exe
2014-04-07 22:48 - 2014-04-07 22:48 - 00000000 ____D () C:\Users\USER\AppData\Local\AlawarWrapper
2014-04-07 22:48 - 2014-04-07 22:48 - 00000000 ____D () C:\Users\Public\Documents\AlawarWrapper
2014-04-07 22:48 - 2014-04-07 22:47 - 00000000 ____D () C:\ProgramData\AlawarWrapper
2014-04-07 17:06 - 2014-02-21 14:32 - 00000000 ____D () C:\Users\USER\AppData\Roaming\AlawarEntertainment
2014-04-07 15:11 - 2009-07-14 19:58 - 00701172 _____ () C:\Windows\system32\perfh007.dat
2014-04-07 15:11 - 2009-07-14 19:58 - 00150520 _____ () C:\Windows\system32\perfc007.dat
2014-04-07 15:11 - 2009-07-14 07:13 - 01625658 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-07 15:08 - 2013-07-07 17:08 - 00000000 ____D () C:\Users\USER\AppData\Local\Corel
2014-04-07 12:55 - 2013-07-07 17:07 - 00000952 ___SH () C:\Windows\SysWOW64\KGyGaAvL.sys
2014-04-07 12:55 - 2013-07-07 17:06 - 00000000 ____D () C:\Users\USER\Documents\My PSP Files
2014-04-07 09:26 - 2014-04-07 09:26 - 00000000 ____D () C:\Users\USER\AppData\Roaming\HomeMakeover
2014-04-07 00:15 - 2014-04-07 00:15 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-04-06 00:43 - 2014-04-06 00:43 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Brave Giant
2014-04-05 17:42 - 2014-03-30 18:23 - 00000000 ____D () C:\Users\USER\Downloads\Textures
2014-04-03 15:38 - 2011-10-01 13:10 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-04-03 15:37 - 2011-10-01 13:09 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-04-03 15:37 - 2011-10-01 13:09 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-04-03 09:51 - 2014-04-20 21:08 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-20 21:08 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-20 21:08 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-02 22:37 - 2013-09-21 14:12 - 00000132 _____ () C:\Users\USER\AppData\Roaming\Adobe PNG-Format CC - Voreinstellungen
2014-04-01 07:07 - 2009-07-14 06:45 - 05101232 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-31 18:33 - 2013-06-26 19:37 - 00111496 _____ () C:\Users\USER\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-30 11:08 - 2013-06-29 17:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-29 13:04 - 2014-03-29 13:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-25 02:13 - 2014-03-25 02:13 - 00000000 _____ () C:\Windows\SysWOW64\sho292A.tmp
Files to move or delete:
====================
C:\Users\USER\thelakehousechildrenofsilence_sv{1201226}.exe
Some content of TEMP:
====================
C:\Users\USER\AppData\Local\Temp\avgnt.exe
C:\Users\USER\AppData\Local\Temp\bstrapInstall.exe
C:\Users\USER\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-11 14:27
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-04-2014 02
Ran by USER at 2014-04-21 14:48:50
Running from C:\Users\USER\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
1600 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
1600_Help (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
1600Trb (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.3.0.322 - Adobe Systems Incorporated)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Photoshop CC (HKLM-x32\...\{2D99B50E-431D-4AA8-85C1-172A6F8BCF09}) (Version: 14.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
AIO_CDB_ProductContext (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_CDB_Software (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_Scan (x32 Version: 130.0.421.000 - Hewlett-Packard) Hidden
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.35 - Atheros Communications Inc.)
Avira (HKLM-x32\...\{c13d72f9-bcdd-4c16-a942-7373a528171e}) (Version: 1.0.5218.31571 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.0.5218.31571 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
Copy (x32 Version: 130.0.428.000 - Hewlett-Packard) Hidden
Corel Paint Shop Pro Photo X2 (HKLM-x32\...\{64E72FB1-2343-4977-B4A8-262CD53D0BD3}) (Version: 12.010.0000 - Corel Corporation)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.4.5527 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.4.5527 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.44 - DivX, LLC)
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
FastStone Photo Resizer 3.1 (HKLM-x32\...\FastStone Photo Resizer) (Version: 3.1 - FastStone Soft.)
Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden
FileZilla Client 3.7.4.1 (HKLM-x32\...\FileZilla Client) (Version: 3.7.4.1 - Tim Kosse)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Free YouTube Download version 3.2.12.827 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.12.827 - DVDVideoSoft Ltd.)
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Launch Box (HKLM\...\{5A847522-375C-4D05-BD3D-88C450CC047F}) (Version: 1.1.5 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (HKLM\...\{B61ED343-0B14-4241-999C-490CB1A20DA4}) (Version: 13.0 - HP)
HP Power Manager (HKLM-x32\...\{7E799992-5DA0-4A1A-9443-B1836B063FEC}) (Version: 1.4.8 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hugo Troll Race Version 1.0 (HKLM-x32\...\{6C7A36BE-140B-42EC-A674-5DE0BFC0ADB2}_is1) (Version: 1.0 - KreaMedia)
Intel(R) C++ Redistributables for Windows* on Intel(R) 64 (HKLM-x32\...\{D2437C5C-2D8C-40D2-8059-689AD7239FA3}) (Version: 11.1.048 - Intel Corporation)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.2.1410 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
KMP Service (HKLM-x32\...\4F6D5E84-5826-4394-9F40-3A9A19165651_is1) (Version: - KMP)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (HKLM-x32\...\{299C0434-4F4E-341F-A916-4E07AEB35E79}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (HKLM-x32\...\{76DAEC83-AF7B-333C-8A53-83D7C7D39199}) (Version: 9.0.30729 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
Mozilla Thunderbird 24.0.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.0.1 (x86 de)) (Version: 24.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 7 Essentials (HKLM-x32\...\{CF097717-F174-4144-954A-FBC4BF301031}) (Version: 7.02.9753 - Nero AG)
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
picture-shark 1.0 (HKLM-x32\...\%ProgramName%) (Version: - )
Ralink Bluetooth Stack64 (HKLM\...\{95DF815D-BE2D-9118-F549-39794C5869CF}) (Version: 9.0.725.0 - Ralink Corporation)
Ralink RT3290 802.11bgn 1x1 Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.2.12.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.54.309.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6652 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.29005 - Realtek Semiconductor Corp.)
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.0.1.0 - Synaptics Incorporated)
TextPad 7 (HKLM-x32\...\{9F53AC20-2D32-4341-9DA1-29DD40E2199E}) (Version: 7.0.9 - Helios)
The KMPlayer (remove only) (HKLM-x32\...\The KMPlayer) (Version: 3.7.0.113 - KMP Media co., Ltd)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.7 (HKLM-x32\...\VLC media player) (Version: 2.0.7 - VideoLAN)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
WinRAR 4.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
XnView 2.12 (HKLM-x32\...\XnView_is1) (Version: 2.12 - Gougelet Pierre-e)
==================== Restore Points =========================
09-04-2014 14:21:51 Windows Update
09-04-2014 19:08:52 Installiert Geheimakte Tunguska
09-04-2014 20:13:56 Installiert Geheimakte Tunguska
09-04-2014 20:20:01 DirectX wurde installiert
12-04-2014 01:00:29 Windows Update
14-04-2014 10:28:47 Entfernt Geheimakte Tunguska
15-04-2014 21:43:54 Windows Update
19-04-2014 14:50:09 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {9228FF24-9BE4-4CB5-8FD5-ABBC47F79F4E} - System32\Tasks\AdobeAAMUpdater-1.0-HP-PC-USER => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-12-10] (Adobe Systems Incorporated)
Task: {B5F27858-7F16-44B5-84B7-1745AA9E3E01} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-13] (Adobe Systems Incorporated)
Task: {C3DC01A7-F83C-4DCF-8E8E-5E064ED5B0F1} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
Task: {E53AA736-AAB2-4393-968F-621B81342842} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-07-27] (CyberLink)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-12-13 13:20 - 2013-12-13 13:20 - 03359600 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-09-19 18:37 - 2012-09-19 18:37 - 00029960 _____ () C:\Windows\system32\BsTrace.dll
2012-03-19 15:09 - 2012-03-19 15:09 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2007-10-30 19:52 - 2007-10-30 19:52 - 00016200 _____ () C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
2007-06-05 13:20 - 2007-06-05 13:20 - 00177704 _____ () C:\Windows\SysWOW64\PSIService.exe
2013-12-13 13:20 - 2013-12-13 13:20 - 04696432 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2012-09-19 18:37 - 2012-09-19 18:37 - 00017160 _____ () C:\Windows\system32\BsHelpCSps.dll
2014-02-17 00:09 - 2013-12-18 10:32 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-09-19 18:37 - 2012-09-19 18:37 - 00079624 _____ () C:\Windows\system32\BsProfilefunc.dll
2012-09-19 18:37 - 2012-09-19 18:37 - 00363784 _____ () C:\Windows\system32\BsExtendFunc.dll
2013-12-19 11:49 - 2013-12-19 11:49 - 32733080 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\libcef.dll
2014-02-17 00:10 - 2014-04-15 18:33 - 00049744 _____ () C:\Users\USER\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-04-15 18:34 - 2014-04-15 18:34 - 00138320 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2014-04-15 18:33 - 2014-04-15 18:33 - 00064592 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2013-11-23 19:49 - 2012-10-22 12:21 - 01277952 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\avformat-53.dll
2013-11-23 19:49 - 2012-07-09 18:57 - 02090496 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\avcodec-53.dll
2013-11-23 19:49 - 2011-12-06 17:19 - 00133632 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\avutil-51.dll
2013-11-23 19:49 - 2012-03-23 11:07 - 00224768 _____ () C:\Program Files (x86)\PANDORA.TV\PanService\libupnp.dll
2014-02-28 12:18 - 2014-02-28 12:18 - 00017920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\PSIClient\7fb509dd6887788f670fac03bb2f996d\PSIClient.ni.dll
2013-06-26 20:04 - 2012-04-06 09:17 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-03-29 13:04 - 2014-03-29 13:04 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-02-11 21:29 - 2014-02-11 21:29 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2012-09-19 18:36 - 2012-09-19 18:36 - 00026888 _____ () C:\Windows\SysWOW64\BsTrace.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\USER:gs5sys
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\Temp:00F3978A
AlternateDataStreams: C:\ProgramData\Temp:014BC3B4
AlternateDataStreams: C:\ProgramData\Temp:063CF799
AlternateDataStreams: C:\ProgramData\Temp:0C5AF2AA
AlternateDataStreams: C:\ProgramData\Temp:11C7FAE3
AlternateDataStreams: C:\ProgramData\Temp:14168AA3
AlternateDataStreams: C:\ProgramData\Temp:1798D30A
AlternateDataStreams: C:\ProgramData\Temp:214562D2
AlternateDataStreams: C:\ProgramData\Temp:273A8657
AlternateDataStreams: C:\ProgramData\Temp:2CB9631F
AlternateDataStreams: C:\ProgramData\Temp:37E54057
AlternateDataStreams: C:\ProgramData\Temp:3ADE134E
AlternateDataStreams: C:\ProgramData\Temp:404CF7EA
AlternateDataStreams: C:\ProgramData\Temp:4A448DB2
AlternateDataStreams: C:\ProgramData\Temp:4D066AD2
AlternateDataStreams: C:\ProgramData\Temp:4D551822
AlternateDataStreams: C:\ProgramData\Temp:4E79C4F8
AlternateDataStreams: C:\ProgramData\Temp:51619742
AlternateDataStreams: C:\ProgramData\Temp:52E1DB1D
AlternateDataStreams: C:\ProgramData\Temp:551C5A0C
AlternateDataStreams: C:\ProgramData\Temp:56C66609
AlternateDataStreams: C:\ProgramData\Temp:59C6C599
AlternateDataStreams: C:\ProgramData\Temp:5C42F64A
AlternateDataStreams: C:\ProgramData\Temp:61B54B15
AlternateDataStreams: C:\ProgramData\Temp:63A71C6F
AlternateDataStreams: C:\ProgramData\Temp:68B61847
AlternateDataStreams: C:\ProgramData\Temp:6C5EC3CD
AlternateDataStreams: C:\ProgramData\Temp:70EB7261
AlternateDataStreams: C:\ProgramData\Temp:82AA64F3
AlternateDataStreams: C:\ProgramData\Temp:8C885EDD
AlternateDataStreams: C:\ProgramData\Temp:98838593
AlternateDataStreams: C:\ProgramData\Temp:A724744F
AlternateDataStreams: C:\ProgramData\Temp:A9C63474
AlternateDataStreams: C:\ProgramData\Temp:ADBD2AC6
AlternateDataStreams: C:\ProgramData\Temp:B093E177
AlternateDataStreams: C:\ProgramData\Temp:C4A5EA85
AlternateDataStreams: C:\ProgramData\Temp:D410FE75
AlternateDataStreams: C:\ProgramData\Temp:D4EEFCC4
AlternateDataStreams: C:\ProgramData\Temp:D7F8D8A2
AlternateDataStreams: C:\ProgramData\Temp:DF0BC727
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\USER\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\USER\Cookies:gs5sys
AlternateDataStreams: C:\Users\USER\Lokale Einstellungen:gs5sys
AlternateDataStreams: C:\Users\USER\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\USER\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\USER\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\USER\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\USER\AppData\Local\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\USER\AppData\Local\Verlauf:gs5sys
AlternateDataStreams: C:\Users\USER\Documents\desktop.ini:gs5sys
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
MSCONFIG\startupreg: BingDesktop => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe /fromkey
MSCONFIG\startupreg: DivXMediaServer => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: SetDefault => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe
==================== Faulty Device Manager Devices =============
Name: Ralink Bluetooth 4.0 Adapter
Description: Ralink Bluetooth 4.0 Adapter
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Ralink Corporation
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/21/2014 11:04:33 AM) (Source: Application Hang) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 698
Startzeit: 01cf5d3ff96361c6
Endzeit: 1531
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: df6f9e0e-c933-11e3-b873-d89d67cee3ad
Error: (04/21/2014 11:01:50 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: HPOSD.exe, Version: 1.3.5.0, Zeitstempel: 0x4e4e0737
Name des fehlerhaften Moduls: HPOSD.exe, Version: 1.3.5.0, Zeitstempel: 0x4e4e0737
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00005ad0
ID des fehlerhaften Prozesses: 0xaa0
Startzeit der fehlerhaften Anwendung: 0xHPOSD.exe0
Pfad der fehlerhaften Anwendung: HPOSD.exe1
Pfad des fehlerhaften Moduls: HPOSD.exe2
Berichtskennung: HPOSD.exe3
Error: (04/17/2014 00:22:30 PM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
Failed to Start the CVH service 1063
Error: (04/16/2014 10:10:27 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: HPOSD.exe, Version: 1.3.5.0, Zeitstempel: 0x4e4e0737
Name des fehlerhaften Moduls: HPOSD.exe, Version: 1.3.5.0, Zeitstempel: 0x4e4e0737
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00005ad0
ID des fehlerhaften Prozesses: 0xb50
Startzeit der fehlerhaften Anwendung: 0xHPOSD.exe0
Pfad der fehlerhaften Anwendung: HPOSD.exe1
Pfad des fehlerhaften Moduls: HPOSD.exe2
Berichtskennung: HPOSD.exe3
Error: (04/16/2014 10:10:27 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: HPMSGSVC.exe, Version: 2.7.2.0, Zeitstempel: 0x4f544ff4
Name des fehlerhaften Moduls: HPMSGSVC.exe, Version: 2.7.2.0, Zeitstempel: 0x4f544ff4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000399f
ID des fehlerhaften Prozesses: 0xb70
Startzeit der fehlerhaften Anwendung: 0xHPMSGSVC.exe0
Pfad der fehlerhaften Anwendung: HPMSGSVC.exe1
Pfad des fehlerhaften Moduls: HPMSGSVC.exe2
Berichtskennung: HPMSGSVC.exe3
Error: (04/15/2014 07:09:50 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: HPMSGSVC.exe, Version: 2.7.2.0, Zeitstempel: 0x4f544ff4
Name des fehlerhaften Moduls: HPMSGSVC.exe, Version: 2.7.2.0, Zeitstempel: 0x4f544ff4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000399f
ID des fehlerhaften Prozesses: 0xbe0
Startzeit der fehlerhaften Anwendung: 0xHPMSGSVC.exe0
Pfad der fehlerhaften Anwendung: HPMSGSVC.exe1
Pfad des fehlerhaften Moduls: HPMSGSVC.exe2
Berichtskennung: HPMSGSVC.exe3
Error: (04/15/2014 07:09:50 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: HPOSD.exe, Version: 1.3.5.0, Zeitstempel: 0x4e4e0737
Name des fehlerhaften Moduls: HPOSD.exe, Version: 1.3.5.0, Zeitstempel: 0x4e4e0737
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00005445
ID des fehlerhaften Prozesses: 0xbd8
Startzeit der fehlerhaften Anwendung: 0xHPOSD.exe0
Pfad der fehlerhaften Anwendung: HPOSD.exe1
Pfad des fehlerhaften Moduls: HPOSD.exe2
Berichtskennung: HPOSD.exe3
Error: (04/13/2014 11:48:40 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Avira.OE.ServiceHost.exe, Version: 1.0.5197.30752, Zeitstempel: 0x5331a930
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00038e19
ID des fehlerhaften Prozesses: 0xbe0
Startzeit der fehlerhaften Anwendung: 0xAvira.OE.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.OE.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.OE.ServiceHost.exe2
Berichtskennung: Avira.OE.ServiceHost.exe3
Error: (04/13/2014 11:48:39 AM) (Source: .NET Runtime) (User: )
Description: Anwendung: Avira.OE.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.AccessViolationException
Stapel:
bei Avira.OE.AvConnector.Interface.ILicensePlugin.GetLicenseType()
bei Avira.OE.AvConnector.AvStatusReporter.GetLicenseType()
bei Avira.OE.ServiceHost.UpdateAvailabilityChecker.CreateDevCheckUpdatePayload()
bei Avira.OE.ServiceHost.UpdateAvailabilityChecker.CheckForUpdate()
bei Avira.OE.ServiceHost.UpdateAvailabilityChecker.OnRecurrentUpdateCheck(System.Object)
bei System.Threading.TimerQueueTimer.CallCallbackInContext(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.TimerQueueTimer.CallCallback()
bei System.Threading.TimerQueueTimer.Fire()
bei System.Threading.TimerQueue.FireNextTimers()
bei System.Threading.TimerQueue.AppDomainTimerCallback()
Error: (04/11/2014 07:12:23 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: KMPProcess.exe, Version: 1.0.1.2, Zeitstempel: 0x51d50ca2
Name des fehlerhaften Moduls: PanStreamer.dll, Version: 2.0.7.38, Zeitstempel: 0x509c8e1f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0001dc74
ID des fehlerhaften Prozesses: 0x1700
Startzeit der fehlerhaften Anwendung: 0xKMPProcess.exe0
Pfad der fehlerhaften Anwendung: KMPProcess.exe1
Pfad des fehlerhaften Moduls: KMPProcess.exe2
Berichtskennung: KMPProcess.exe3
System errors:
=============
Error: (04/21/2014 01:54:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "HPWMISVC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (04/21/2014 01:54:36 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst HPWMISVC erreicht.
Error: (04/21/2014 01:54:01 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (04/21/2014 01:54:01 PM) (Source: Application Popup) (User: )
Description: Treiber atksgt.sys konnte nicht geladen werden.
Error: (04/21/2014 11:03:54 AM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (04/21/2014 11:03:54 AM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Benutzerprofildienst" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (04/21/2014 11:02:54 AM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Server" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (04/21/2014 11:01:52 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (04/21/2014 11:01:52 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Designs" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (04/21/2014 11:01:52 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Shellhardwareerkennung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office Sessions:
=========================
Error: (04/21/2014 11:04:33 AM) (Source: Application Hang)(User: )
Description: Explorer.EXE6.1.7601.1756769801cf5d3ff96361c61531C:\Windows\Explorer.EXEdf6f9e0e-c933-11e3-b873-d89d67cee3ad
Error: (04/21/2014 11:01:50 AM) (Source: Application Error)(User: )
Description: HPOSD.exe1.3.5.04e4e0737HPOSD.exe1.3.5.04e4e0737c000000500005ad0aa001cf5d40068b9ceaC:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exeC:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe92c57691-c933-11e3-b873-d89d67cee3ad
Error: (04/17/2014 00:22:30 PM) (Source: CVHSVC)(User: )
Description: Failed to Start the CVH service 1063
Error: (04/16/2014 10:10:27 AM) (Source: Application Error)(User: )
Description: HPOSD.exe1.3.5.04e4e0737HPOSD.exe1.3.5.04e4e0737c000000500005ad0b5001cf594b1ae6f7eaC:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exeC:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe9143565c-c53e-11e3-86ca-d89d67cee3ad
Error: (04/16/2014 10:10:27 AM) (Source: Application Error)(User: )
Description: HPMSGSVC.exe2.7.2.04f544ff4HPMSGSVC.exe2.7.2.04f544ff4c00000050000399fb7001cf594b1bcddd64C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exeC:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe91437d6c-c53e-11e3-86ca-d89d67cee3ad
Error: (04/15/2014 07:09:50 AM) (Source: Application Error)(User: )
Description: HPMSGSVC.exe2.7.2.04f544ff4HPMSGSVC.exe2.7.2.04f544ff4c00000050000399fbe001cf5868971528f3C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exeC:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe2b6c8c8a-c45c-11e3-aa48-d89d67cee3ad
Error: (04/15/2014 07:09:50 AM) (Source: Application Error)(User: )
Description: HPOSD.exe1.3.5.04e4e0737HPOSD.exe1.3.5.04e4e0737c000000500005445bd801cf5868970ee74cC:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exeC:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe2b6c657a-c45c-11e3-aa48-d89d67cee3ad
Error: (04/13/2014 11:48:40 AM) (Source: Application Error)(User: )
Description: Avira.OE.ServiceHost.exe1.0.5197.307525331a930ntdll.dll6.1.7601.18247521ea8e7c000000500038e19be001cf56fcbf690c3fC:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exeC:\Windows\SysWOW64\ntdll.dllca97aa57-c2f0-11e3-954a-d89d67cee3ad
Error: (04/13/2014 11:48:39 AM) (Source: .NET Runtime)(User: )
Description: Anwendung: Avira.OE.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.AccessViolationException
Stapel:
bei Avira.OE.AvConnector.Interface.ILicensePlugin.GetLicenseType()
bei Avira.OE.AvConnector.AvStatusReporter.GetLicenseType()
bei Avira.OE.ServiceHost.UpdateAvailabilityChecker.CreateDevCheckUpdatePayload()
bei Avira.OE.ServiceHost.UpdateAvailabilityChecker.CheckForUpdate()
bei Avira.OE.ServiceHost.UpdateAvailabilityChecker.OnRecurrentUpdateCheck(System.Object)
bei System.Threading.TimerQueueTimer.CallCallbackInContext(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.TimerQueueTimer.CallCallback()
bei System.Threading.TimerQueueTimer.Fire()
bei System.Threading.TimerQueue.FireNextTimers()
bei System.Threading.TimerQueue.AppDomainTimerCallback()
Error: (04/11/2014 07:12:23 PM) (Source: Application Error)(User: )
Description: KMPProcess.exe1.0.1.251d50ca2PanStreamer.dll2.0.7.38509c8e1fc00000050001dc74170001cf555b87367a74C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exeC:\Program Files (x86)\PANDORA.TV\PanService\PanStreamer.dll72625d3c-c19c-11e3-94b9-d89d67cee3ad
==================== Memory info ===========================
Percentage of memory in use: 75%
Total physical RAM: 1943.36 MB
Available physical RAM: 476.61 MB
Total Pagefile: 3886.71 MB
Available Pagefile: 1751.44 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (Windows 7) (Fixed) (Total:298.04 GB) (Free:237.64 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: BA2EBA2E)
Partition 1: (Active) - (Size=55 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-21 15:21:48
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000067 ATA_____ rev.1C__ 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\USER\AppData\Local\Temp\pgldipoc.sys
---- Threads - GMER 2.1 ----
Thread [896:924] 000000007729aef0
Thread [896:928] 000007fefdfda808
Thread [896:932] 000000007729fbf0
Thread [896:5028] 000007fefc274af4
Thread [896:6180] 000000007729fbf0
Thread [896:6336] 000000007729fbf0
Thread [896:4320] 000000007729fbf0
Thread [896:6208] 000000007729fbf0
Thread C:\Windows\System32\svchost.exe [512:2648] 000007feed786b8c
Thread C:\Windows\System32\svchost.exe [512:2652] 000007feed781d88
Thread C:\Windows\system32\svchost.exe [760:3964] 000007fef2e1506c
Thread C:\Windows\system32\svchost.exe [760:6432] 000007fefa735124
Thread C:\Windows\system32\svchost.exe [760:2316] 000007fef2754164
Thread C:\Windows\system32\svchost.exe [760:5584] 000007fef2d11ab0
Thread C:\Windows\system32\svchost.exe [760:1364] 000007feed48cb70
Thread C:\Windows\system32\svchost.exe [760:5324] 000007feed81a978
Thread [1132:1140] 000000007729aef0
Thread [1132:1324] 000007fefa9d8274
Thread [1132:1556] 000007fefa9d8274
Thread [1132:6468] 000000007729fbf0
Thread C:\Windows\system32\svchost.exe [1228:2148] 000007fefa69bd88
Thread C:\Windows\system32\svchost.exe [1228:2904] 000007fef8155170
Thread C:\Windows\system32\svchost.exe [1228:3700] 000007fefa735124
Thread C:\Windows\System32\spoolsv.exe [1444:1632] 000007fef8b610c8
Thread C:\Windows\System32\spoolsv.exe [1444:1648] 000007fef8b26144
Thread C:\Windows\System32\spoolsv.exe [1444:1652] 000007fef88b5fd0
Thread C:\Windows\System32\spoolsv.exe [1444:1656] 000007fef88a3438
Thread C:\Windows\System32\spoolsv.exe [1444:1660] 000007fef88b63ec
Thread C:\Windows\System32\spoolsv.exe [1444:1668] 000007fef97b5e5c
Thread C:\Windows\System32\spoolsv.exe [1444:1680] 000007fef98d5074
Thread C:\Windows\system32\taskhost.exe [1548:5400] 000007fef8155170
Thread C:\Windows\SysWOW64\ntdll.dll [1492:1480] 0000000000fed1f6
Thread C:\Windows\SysWOW64\ntdll.dll [1492:2352] 0000000073088c90
Thread C:\Windows\SysWOW64\ntdll.dll [1492:4944] 0000000071568960
Thread C:\Windows\SysWOW64\ntdll.dll [1492:4948] 0000000071568960
Thread C:\Windows\SysWOW64\ntdll.dll [1492:4952] 0000000071568960
Thread C:\Windows\SysWOW64\ntdll.dll [1492:4956] 0000000071564090
Thread [2052:2068] 000000007729aef0
Thread [2052:7120] 000000007729fbf0
Thread [2052:2972] 000000007729fbf0
Thread [2060:2084] 000000007729aef0
Thread [2060:5084] 000000007729fbf0
Thread [2060:3904] 000000007729fbf0
Thread C:\Windows\SysWOW64\ntdll.dll [2200:2204] 00000000004288d4
Thread C:\Windows\SysWOW64\ntdll.dll [2200:2416] 0000000071ea786a
Thread C:\Windows\SysWOW64\ntdll.dll [2200:3484] 00000000632f7f3e
Thread C:\Windows\SysWOW64\ntdll.dll [2216:2220] 00000000004b3a37
Thread C:\Program Files\Windows Sidebar\sidebar.exe [2408:6092] 000007fef031f5a0
Thread C:\Program Files\Windows Sidebar\sidebar.exe [2408:6104] 000007feef0d9fe4
Thread C:\Program Files\Windows Sidebar\sidebar.exe [2408:6096] 000007feef0d98ac
Thread C:\Windows\SysWOW64\ntdll.dll [2664:2668] 0000000000a161d6
Thread C:\Windows\SysWOW64\ntdll.dll [2664:1176] 0000000000a151f0
Thread C:\Windows\SysWOW64\ntdll.dll [2664:1780] 0000000000a15770
Thread C:\Windows\SysWOW64\ntdll.dll [2708:2712] 000000000043c28f
Thread C:\Windows\SysWOW64\ntdll.dll [2708:2796] 000000000040dc00
Thread C:\Windows\SysWOW64\ntdll.dll [2708:3048] 0000000066dc27e1
Thread C:\Windows\SysWOW64\ntdll.dll [2708:3044] 0000000000416450
Thread C:\Windows\SysWOW64\ntdll.dll [2716:2720] 0000000000401b4b
Thread C:\Windows\SysWOW64\ntdll.dll [2744:2748] 0000000000cfb245
Thread C:\Windows\SysWOW64\ntdll.dll [2744:2960] 0000000000be59d0
Thread C:\Windows\SysWOW64\ntdll.dll [2752:2756] 0000000000a953d3
Thread C:\Windows\SysWOW64\ntdll.dll [2752:4884] 000000005c2fb89c
Thread C:\Windows\SysWOW64\ntdll.dll [2752:4888] 000000005c2fbaf3
Thread C:\Windows\SysWOW64\ntdll.dll [2752:4892] 000000005c2fb3c2
Thread C:\Windows\SysWOW64\ntdll.dll [1304:984] 0000000000589694
Thread C:\Windows\SysWOW64\ntdll.dll [1304:980] 00000000004061d8
Thread C:\Windows\SysWOW64\ntdll.dll [1304:2296] 00000000004061d8
Thread C:\Windows\SysWOW64\ntdll.dll [1304:2828] 00000000004061d8
Thread C:\Windows\SysWOW64\ntdll.dll [1304:2508] 00000000004061d8
Thread C:\Windows\SysWOW64\ntdll.dll [1304:2108] 00000000004061d8
Thread C:\Windows\SysWOW64\ntdll.dll [1304:2548] 00000000004061d8
Thread C:\Windows\SysWOW64\ntdll.dll [1304:6760] 00000000004061d8
Thread [3108:3140] 00000000774b3e85
Thread [3108:3144] 0000000074fe7587
Thread [3392:3432] 000007fefdfda808
Thread [3392:3448] 000000007729aef0
Thread [3392:3452] 000007fef9da7130
Thread [3392:3456] 000007fef9d9d5c0
Thread [3392:6608] 000000007729fbf0
Thread [3392:2092] 000000007729fbf0
Thread C:\Windows\SysWOW64\ntdll.dll [3556:3560] 00000000003e888e
Thread C:\Windows\SysWOW64\ntdll.dll [3556:4184] 00000000738932fb
Thread C:\Windows\SysWOW64\ntdll.dll [3692:3696] 00000000002f8296
Thread C:\Windows\SysWOW64\ntdll.dll [3692:2392] 00000000618c6358
Thread C:\Windows\SysWOW64\ntdll.dll [3692:3372] 00000000615cf71d
Thread C:\Windows\SysWOW64\ntdll.dll [3692:3880] 00000000615cf71d
Thread C:\Windows\SysWOW64\ntdll.dll [3692:2388] 00000000615c5b1a
Thread C:\Windows\SysWOW64\ntdll.dll [3692:3924] 0000000061870b14
Thread C:\Windows\SysWOW64\ntdll.dll [3692:4200] 00000000615cf71d
Thread C:\Windows\system32\wbem\wmiprvse.exe [4032:3720] 000007fef2b110f0
Thread C:\Windows\SysWOW64\ntdll.dll [3920:3848] 000000002dc8a4cb
Thread [5088:2328] 000007fefdfda808
Thread [5088:4636] 000000007729aef0
Thread [5088:4936] 000000007729fbf0
Thread [5088:4904] 000000007729fbf0
Thread C:\Windows\SysWOW64\ntdll.dll [5472:5476] 000000000056ea48
Thread C:\Windows\SysWOW64\ntdll.dll [5472:6356] 00000000004061d8
Thread C:\Windows\SysWOW64\ntdll.dll [5472:6364] 00000000004061d8
Thread C:\Windows\SysWOW64\ntdll.dll [5472:5492] 00000000004061d8
Thread C:\Windows\system32\svchost.exe [6036:5108] 000007feee198470
Thread C:\Windows\system32\svchost.exe [6036:5412] 000007feee1a2418
Thread C:\Windows\system32\svchost.exe [6036:6548] 000007feede6f130
Thread C:\Windows\system32\svchost.exe [6036:6556] 000007feede64734
Thread C:\Windows\system32\svchost.exe [6036:6220] 000007feede64734
Thread C:\Windows\system32\svchost.exe [6036:6216] 000007feee1a976c
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [5828:6224] 000007fefb612a7c
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [5828:6308] 000007feee334830
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [5828:6512] 000007fefa735124
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [5828:7012] 000007feee2b9d90
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [5828:7016] 000007feee334830
Thread C:\Windows\SysWOW64\ntdll.dll [6696:6700] 0000000000eac2cb
Thread C:\Windows\system32\DllHost.exe [6800:6872] 000007feedd4ae60
Thread C:\Windows\SysWOW64\ntdll.dll [4148:4144] 00000000011f314e
Thread C:\Windows\SysWOW64\ntdll.dll [4148:4012] 00000000709d0dc7
Thread C:\Windows\SysWOW64\ntdll.dll [4148:4152] 0000000070a836af
Thread C:\Windows\SysWOW64\ntdll.dll [4148:4328] 0000000070a836af
Thread C:\Windows\SysWOW64\ntdll.dll [4148:2520] 0000000070a836af
Thread [4352:3856] 00000000774b2e65
Thread [4352:4460] 0000000074fe7587
Thread [4352:1592] 00000000774b3e85
Thread C:\Windows\SysWOW64\ntdll.dll [5220:5212] 00000000013b9032
---- EOF - GMER 2.1 ----
|
|
21.04.2014, 19:09
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Webseiten werden auf Werbung umgeleitet hi,
__________________Scan mit Combofix
__________________ |
|
21.04.2014, 20:59
| #3 |
| | Windows 7: Webseiten werden auf Werbung umgeleitetCode:
ATTFilter ComboFix 14-04-20.01 - USER 21.04.2014 21:05:40.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.1943.489 [GMT 2:00]
ausgeführt von:: C:\Users\USER\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
C:\install.exe
C:\Users\USER\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
C:\Users\USER\thelakehousechildrenofsilence_sv{1201226}.exe
Infizierte Kopie von C:\Windows\system32\Services.exe wurde gefunden und desinfiziert
Kopie von - C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe wurde wiederhergestellt
((((((((((((((((((((((( Dateien erstellt von 2014-03-21 bis 2014-04-21 ))))))))))))))))))))))))))))))
2014-04-21 19:19:53 . 2014-04-21 19:19:53 -------- d-----w- C:\Users\Default\AppData\Local\temp
2014-04-21 12:44:48 . 2014-04-21 12:49:27 -------- d-----w- C:\FRST
2014-04-21 10:25:35 . 2014-04-21 10:25:35 0 ----a-w- C:\Windows\SysWow64\sho5C72.tmp
2014-04-21 09:40:57 . 2014-04-21 09:40:57 75888 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5FAE9254-42AD-4EF9-BE67-D03E020B6933}\offreg.dll
2014-04-20 19:08:29 . 2014-04-20 20:07:12 119512 ----a-w- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-04-20 19:08:02 . 2014-04-20 19:08:09 -------- d-----w- C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-20 19:08:02 . 2014-04-03 07:51:16 63192 ----a-w- C:\Windows\system32\drivers\mwac.sys
2014-04-20 19:08:02 . 2014-04-03 07:51:04 88280 ----a-w- C:\Windows\system32\drivers\mbamchameleon.sys
2014-04-20 19:08:02 . 2014-04-03 07:50:58 25816 ----a-w- C:\Windows\system32\drivers\mbam.sys
2014-04-20 17:42:50 . 2014-04-20 17:42:50 -------- d-sh--w- C:\Users\USER\AppData\Local\EmieUserList
2014-04-20 17:42:50 . 2014-04-20 17:42:50 -------- d-sh--w- C:\Users\USER\AppData\Local\EmieSiteList
2014-04-20 17:07:33 . 2014-04-16 10:22:57 10651704 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5FAE9254-42AD-4EF9-BE67-D03E020B6933}\mpengine.dll
2014-04-20 13:04:10 . 2014-04-20 13:04:10 0 ----a-w- C:\Windows\SysWow64\sho8C6B.tmp
2014-04-19 17:32:29 . 2014-04-19 17:32:29 0 ----a-w- C:\Windows\SysWow64\shoC8FC.tmp
2014-04-19 14:53:55 . 2014-02-19 22:15:41 1031560 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0C659334-AACE-43E2-88EA-BC76C7F1E317}\gapaengine.dll
2014-04-19 14:51:29 . 2014-04-16 10:22:57 10651704 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-04-12 02:19:45 . 2014-04-12 02:19:45 0 ----a-w- C:\Windows\SysWow64\sho2F42.tmp
2014-04-12 01:01:59 . 2014-03-06 06:22:40 2260480 ----a-w- C:\Windows\system32\wininet.dll
2014-04-12 01:01:59 . 2014-03-06 05:41:49 1789440 ----a-w- C:\Windows\SysWow64\wininet.dll
2014-04-12 01:01:57 . 2014-03-08 02:34:14 809680 ----a-w- C:\Program Files\Internet Explorer\iexplore.exe
2014-04-12 01:01:57 . 2014-03-06 05:58:08 1400832 ----a-w- C:\Windows\system32\urlmon.dll
2014-04-12 01:01:56 . 2014-03-08 01:59:00 811728 ----a-w- C:\Program Files (x86)\Internet Explorer\iexplore.exe
2014-04-12 01:01:54 . 2014-03-06 06:40:39 1967104 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2014-04-12 01:01:53 . 2014-03-06 07:11:15 2043904 ----a-w- C:\Windows\system32\inetcpl.cpl
2014-04-12 01:01:51 . 2014-03-06 06:53:46 13551104 ----a-w- C:\Windows\system32\ieframe.dll
2014-04-12 01:01:42 . 2014-03-06 08:11:41 5784064 ----a-w- C:\Windows\system32\jscript9.dll
2014-04-12 01:01:41 . 2014-03-06 07:46:36 4254720 ----a-w- C:\Windows\SysWow64\jscript9.dll
2014-04-10 22:10:43 . 2014-04-10 22:10:43 0 ----a-w- C:\Windows\SysWow64\shoFAD5.tmp
2014-04-09 20:21:57 . 2006-03-31 10:41:02 3927248 ----a-w- C:\Windows\system32\d3dx9_30.dll
2014-04-09 20:17:54 . 2014-04-09 20:27:10 310984 ----a-w- C:\Windows\system32\drivers\atksgt.sys
2014-04-09 20:17:52 . 2014-04-09 20:17:52 42696 ----a-w- C:\Windows\system32\drivers\lirsgt.sys
2014-04-08 23:25:54 . 2014-04-08 23:25:54 0 ----a-w- C:\Windows\SysWow64\shoA21D.tmp
2014-04-07 20:48:13 . 2014-04-07 20:48:13 -------- d-----w- C:\Users\USER\AppData\Local\AlawarWrapper
2014-04-07 20:47:33 . 2014-04-07 20:48:13 -------- d-----w- C:\ProgramData\AlawarWrapper
2014-04-07 07:26:22 . 2014-04-07 07:26:28 -------- d-----w- C:\Users\USER\AppData\Roaming\HomeMakeover
2014-04-06 22:15:34 . 2014-04-06 22:15:34 -------- d-----w- C:\ProgramData\BlueStacks
2014-04-06 21:54:06 . 2014-04-09 11:16:32 -------- d-----w- C:\Users\USER\AppData\Local\GamesManager
2014-04-05 22:43:19 . 2014-04-05 22:43:19 -------- d-----w- C:\Users\USER\AppData\Roaming\Brave Giant
2014-03-25 00:13:37 . 2014-03-25 00:13:37 0 ----a-w- C:\Windows\SysWow64\sho292A.tmp
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
2014-04-09 14:23:01 . 2011-10-01 10:38:44 90655440 ----a-w- C:\Windows\system32\MRT.exe
2014-03-12 22:22:29 . 2012-09-13 17:30:39 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-03-12 22:22:29 . 2011-10-01 11:17:51 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-11 07:52:30 . 2011-04-27 13:25:24 133928 ----a-w- C:\Windows\system32\drivers\NisDrvWFP.sys
2014-03-05 23:48:55 . 2014-03-05 23:48:55 0 ----a-w- C:\Windows\SysWow64\sho56C6.tmp
2014-03-04 09:17:05 . 2014-04-09 09:32:52 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
2014-02-25 23:08:07 . 2014-02-25 23:08:07 0 ----a-w- C:\Windows\SysWow64\shoAC5C.tmp
2014-02-19 22:15:41 . 2012-09-13 11:59:12 1031560 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-02-18 15:27:49 . 2014-02-18 15:28:04 84720 ----a-w- C:\Windows\system32\drivers\avnetflt.sys
2014-02-12 08:14:23 . 2014-02-12 08:14:23 0 ----a-w- C:\Windows\SysWow64\shoB76.tmp
2014-02-10 23:43:00 . 2014-02-10 23:43:00 0 ----a-w- C:\Windows\SysWow64\shoD4D3.tmp
2014-02-07 01:23:30 . 2014-03-12 06:51:45 3156480 ----a-w- C:\Windows\system32\win32k.sys
2014-02-04 02:32:22 . 2014-03-12 06:45:23 1424384 ----a-w- C:\Windows\system32\WindowsCodecs.dll
2014-02-04 02:32:12 . 2014-03-12 06:45:29 624128 ----a-w- C:\Windows\system32\qedit.dll
2014-02-04 02:04:22 . 2014-03-12 06:45:23 1230336 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll
2014-02-04 02:04:11 . 2014-03-12 06:45:29 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
2014-02-01 03:06:29 . 2014-02-01 03:06:29 0 ----a-w- C:\Windows\SysWow64\sho1E0D.tmp
2014-01-29 02:32:18 . 2014-03-12 06:51:47 484864 ----a-w- C:\Windows\system32\wer.dll
2014-01-29 02:06:47 . 2014-03-12 06:51:47 381440 ----a-w- C:\Windows\SysWow64\wer.dll
2014-01-29 00:08:33 . 2014-01-29 00:08:33 0 ----a-w- C:\Windows\SysWow64\sho7BBC.tmp
2014-01-28 02:32:46 . 2014-03-12 06:51:50 228864 ----a-w- C:\Windows\system32\wwansvc.dll
2014-01-27 08:11:36 . 2014-01-27 08:11:36 0 ----a-w- C:\Windows\SysWow64\shoD6A.tmp
2014-01-26 00:34:49 . 2014-01-26 00:34:49 0 ----a-w- C:\Windows\SysWow64\sho2CB5.tmp
2014-01-24 23:19:42 . 2014-01-24 23:19:42 268512 ----a-w- C:\Windows\system32\drivers\MpFilter.sys
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-10-10 21:01:20 222832 ----a-w- C:\Users\USER\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-10-10 21:01:20 222832 ----a-w- C:\Users\USER\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-10-10 21:01:20 222832 ----a-w- C:\Users\USER\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2010-11-20 03:25:18 1475584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HPOSD"="C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 12:48:44 379960]
"HP Quick Launch"="C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 11:38:38 578944]
"IAStorIcon"="C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-09-12 12:18:50 56128]
"BtTray"="C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe" [2012-09-19 16:36:42 371976]
"Corel File Shell Monitor"="C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2007-10-30 17:52:34 16200]
"HP Software Update"="C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 14:24:20 54840]
"Adobe Creative Cloud"="C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" [2013-12-19 02:35:02 2239376]
"avgnt"="C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-20 10:39:12 689744]
"Avira Systray"="C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-04-15 16:34:02 180304]
C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe [2014-1-16 329944]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 BthL2caScoIfSrv;Bluetooth Profile Interface Driver Service;C:\Windows\system32\Drivers\BtL2caScoIf.sys;C:\Windows\SYSNATIVE\Drivers\BtL2caScoIf.sys [x]
R3 btUrbFilterDrv;IVT URB Bluetooth Filter Driver Service;C:\Windows\system32\Drivers\IvtUrbBtFlt.sys;C:\Windows\SYSNATIVE\Drivers\IvtUrbBtFlt.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\system32\IEEtwCollector.exe;C:\Windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys;C:\Windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe;C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys;C:\Windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys;C:\Windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys;C:\Windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys;C:\Windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S0 iaStorA;iaStorA;C:\Windows\system32\DRIVERS\iaStorA.sys;C:\Windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;C:\Windows\system32\DRIVERS\iaStorF.sys;C:\Windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S1 avkmgr;avkmgr;C:\Windows\system32\DRIVERS\avkmgr.sys;C:\Windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe;C:\Windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage-Technologie;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\Program Files\Intel\iCLS Client\HeciServer.exe;c:\Program Files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys;C:\Windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 PanService;PandoraService;C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe;C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe [x]
S2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 BtAudioBusSrv;Ralink Bluetooth Audio Bus Service;C:\Windows\system32\Drivers\BtAudioBus.sys;C:\Windows\SYSNATIVE\Drivers\BtAudioBus.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys;C:\Windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys;C:\Windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\Program Files\Microsoft Security Client\NisSrv.exe;c:\Program Files\Microsoft Security Client\NisSrv.exe [x]
S3 RSP2STOR;Realtek PCIE CardReader Driver - P2;C:\Windows\system32\DRIVERS\RtsP2Stor.sys;C:\Windows\SYSNATIVE\DRIVERS\RtsP2Stor.sys [x]
S3 rtbth;RTBTH Bluetooth Device Driver;C:\Windows\system32\DRIVERS\rtbth.sys;C:\Windows\SYSNATIVE\DRIVERS\rtbth.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys;C:\Windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys;C:\Windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys;C:\Windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys;C:\Windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys;C:\Windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 SmbDrv;SmbDrv;C:\Windows\system32\DRIVERS\Smb_driver.sys;C:\Windows\SYSNATIVE\DRIVERS\Smb_driver.sys [x]
--- Andere Dienste/Treiber im Speicher ---
*NewlyCreated* - WS2IFSL
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
Inhalt des "geplante Tasks" Ordners
2014-04-21 C:\Windows\Tasks\Adobe Flash Player Updater.job
- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-13 17:30:39 . 2014-03-12 22:22:30]
--------- X64 Entries -----------
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1]
@="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}"
[HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}]
2013-12-13 11:20:56 3359600 ----a-w- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2]
@="{853B7E05-C47D-4985-909A-D0DC5C6D7303}"
[HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}]
2013-12-13 11:20:56 3359600 ----a-w- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3]
@="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}"
[HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}]
2013-12-13 11:20:56 3359600 ----a-w- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-10-10 21:01:27 261744 ----a-w- C:\Users\USER\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-10-10 21:01:27 261744 ----a-w- C:\Users\USER\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-10-10 21:01:27 261744 ----a-w- C:\Users\USER\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-06-04 12:21:52 6548112]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2012-12-14 00:42:14 172144]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2012-12-14 00:42:10 399984]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2012-12-14 00:42:14 441968]
"Corel Photo Downloader"="C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-10-31 00:52:32 531784]
"SetDefault"="C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe" [2011-12-19 21:34:06 44880]
"MSC"="c:\Program Files\Microsoft Security Client\msseces.exe" [2014-03-11 10:34:12 1271072]
"AdobeAAMUpdater-1.0"="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-12-10 17:18:42 472984]
------- Zusätzlicher Suchlauf -------
uLocal Page = C:\Windows\system32\blank.htm
uStart Page = hxxp://www.youdagames.com?hp=1
mStart Page = hxxp://www.google.com
mLocal Page = C:\Windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - ExtSQL: !HIDDEN! 2013-09-13 13:16; smartwebprinting@hp.com; C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
- - - - Entfernte verwaiste Registrierungseinträge - - - -
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
|
|
22.04.2014, 13:50
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Webseiten werden auf Werbung umgeleitet Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.04.2014, 22:59
| #5 |
| | Windows 7: Webseiten werden auf Werbung umgeleitet Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 22.04.2014 Scan Time: 23:03:50 Logfile: malware.txt Administrator: Yes Version: 2.00.1.1004 Malware Database: v2014.04.22.06 Rootkit Database: v2014.03.27.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Chameleon: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: USER Scan Type: Threat Scan Result: Completed Objects Scanned: 263236 Time Elapsed: 23 min, 19 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Shuriken: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.201 - Bericht erstellt am 22/04/2014 um 23:19:39
# Aktualisiert 22/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : USER - HP-PC
# Gestartet von : C:\Users\USER\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\AlawarWrapper
Ordner Gelöscht : C:\USERs\USER\AppData\Local\Mobogenie
Ordner Gelöscht : C:\USERs\USER\AppData\Local\AlawarWrapper
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{26B19FA4-E8A1-4A1B-A163-1A1E46F830DD}
Schlüssel Gelöscht : HKLM\Software\Trymedia Systems
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17041
-\\ Mozilla Firefox v28.0 (de)
[ Datei : C:\USERs\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\prefs.js ]
*************************
AdwCleaner[R1].txt - [1562 octets] - [22/04/2014 23:12:55]
AdwCleaner[R2].txt - [1640 octets] - [22/04/2014 23:17:31]
AdwCleaner[S1].txt - [391 octets] - [22/04/2014 23:15:56]
AdwCleaner[S2].txt - [1559 octets] - [22/04/2014 23:19:39]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1619 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by USER on 22.04.2014 at 23:33:23,03
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0B753EDB-35FD-4140-8205-E2C63BB686FC}
~~~ Files
Successfully deleted: [File] C:\Windows\syswow64\sho1180.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho1324.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho1643.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho1E0D.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho24FE.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho292A.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho2AEF.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho2CB5.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho2F42.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho3C5D.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho426C.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho4BFA.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho56C6.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho5A17.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho5C1A.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho5C72.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho6025.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho646E.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho6651.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho757F.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho77D6.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho79DC.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho7BBC.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho7D4D.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho7E80.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho8C6B.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho8EAC.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho965.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho97EB.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho99B2.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho9AA9.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho9D7A.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoA21D.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoA60D.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoA6D1.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoA762.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoABC1.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoAC5C.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoACBB.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoAD6E.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoB1E9.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoB76.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoC258.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoC586.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoC67E.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoC8FC.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoCCC5.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoD2CC.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoD4D3.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoD6A.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoD7CC.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoE04A.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoE2A4.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoE480.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoEC2B.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoFAD5.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoFC0.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoFD31.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoFDC6.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoFFC3.tmp
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\ProgramData\big fish"
Successfully deleted: [Folder] "C:\ProgramData\big fish games"
Successfully deleted: [Folder] "C:\Users\USER\AppData\Roaming\big fish games"
~~~ FireFox
Emptied folder: C:\Users\USER\AppData\Roaming\mozilla\firefox\profiles\pn4y3dsu.default\minidumps [109 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.04.2014 at 23:41:31,24
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2014 Ran by USER (administrator) on HP-PC on 22-04-2014 23:53:43 Running from C:\Users\USER\Downloads Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Corel, Inc.) C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe () C:\Windows\SysWOW64\PSIService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe () C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe (PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe (IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-04-06] (Synaptics Incorporated) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-04] (Realtek Semiconductor) HKLM\...\Run: [Corel Photo Downloader] => C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe [531784 2007-10-31] (Corel, Inc.) HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-19] (Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-12-10] (Adobe Systems Incorporated) HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation) HKLM-x32\...\Run: [BtTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [371976 2012-09-19] (IVT Corporation) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Corel File Shell Monitor] => C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe [16200 2007-10-30] () HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard) HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2239376 2013-12-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [180304 2014-04-15] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Startup: C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.youdagames.com?hp=1 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8D9489EB9372CE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0Dzzzy0DyCyB0C0E0EtA0A0D0DyDyByDtN0D0Tzu0SyCzyzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825073042&ir= SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0Dzzzy0DyCyB0C0E0EtA0A0D0DyDyByDtN0D0Tzu0SyCzyzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825073042&ir= SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWOW64\skype4com.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default FF DefaultSearchEngine: Amazon FF Homepage: about:home FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect_x86_64 - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @oberon-media.com/ONCAdapter - C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll No File FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: DownloadHelper - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-25] FF Extension: ImageHost Grabber - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} [2013-06-29] FF Extension: anonymoX - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\client@anonymox.net.xpi [2013-10-26] FF Extension: Media Stealer - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\stealer@physacco.com.xpi [2013-07-11] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-08-29] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-09-13] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-09-13] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [122448 2014-04-15] (Avira Operations GmbH & Co. KG) R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1612552 2012-09-26] (IVT Corporation) R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [146184 2012-09-19] (IVT Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-04-06] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation) S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [279848 2007-06-27] (Nero AG) R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe [1922600 2013-07-08] (Pandora.TV) R2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [177704 2007-06-05] () ==================== Drivers (Whitelisted) ==================== S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2014-04-09] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-18] (Avira Operations GmbH & Co. KG) U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [34912 2012-06-15] (Ralink Corporation.) R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation) S3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [56904 2012-07-19] (Ralink Corporation) S3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [48608 2012-10-02] (Ralink Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-01] (Intel Corporation) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2014-04-09] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-22] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation) R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-28] (Realtek Semiconductor Corp.) R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [692832 2012-10-02] (Ralink Technology, Corp.) R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2012-04-06] (Synaptics Incorporated) U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [34912 2012-06-15] (Ralink Corporation.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-22 23:53 - 2014-04-22 23:53 - 00019974 _____ () C:\Users\USER\Downloads\FRST.txt 2014-04-22 23:51 - 2014-04-22 23:52 - 02061312 _____ (Farbar) C:\Users\USER\Downloads\FRST64.exe 2014-04-22 23:41 - 2014-04-22 23:41 - 00005323 _____ () C:\Users\USER\Desktop\JRT.txt 2014-04-22 23:33 - 2014-04-22 23:33 - 00000000 ____D () C:\Windows\ERUNT 2014-04-22 23:30 - 2014-04-22 23:30 - 01016261 _____ (Thisisu) C:\Users\USER\Downloads\JRT.exe 2014-04-22 23:24 - 2014-04-22 23:24 - 00001707 _____ () C:\Users\USER\Downloads\AdwCleaner.txt 2014-04-22 23:12 - 2014-04-22 23:20 - 00000000 ____D () C:\AdwCleaner 2014-04-22 23:12 - 2014-04-22 23:12 - 01345435 _____ () C:\Users\USER\Downloads\adwcleaner.exe 2014-04-22 23:11 - 2014-04-22 23:11 - 00001049 _____ () C:\Users\USER\Downloads\malware.txt 2014-04-22 22:37 - 2014-04-22 22:37 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\USER\Downloads\mbam-setup-2.0.1.1004.exe 2014-04-22 07:47 - 2014-04-22 07:48 - 00000000 ____D () C:\Users\USER\Downloads\422 2014-04-21 21:02 - 2014-04-21 21:32 - 00000000 ____D () C:\ComboFix 2014-04-21 21:02 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-04-21 21:02 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-04-21 21:02 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-04-21 21:02 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-04-21 21:02 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-04-21 21:02 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-04-21 21:02 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-04-21 21:02 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-04-21 20:59 - 2014-04-21 21:29 - 00000000 ____D () C:\Qoobox 2014-04-21 20:58 - 2014-04-21 21:28 - 00000000 ____D () C:\Windows\erdnt 2014-04-21 20:55 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\USER\Downloads\ComboFix.exe 2014-04-21 14:44 - 2014-04-22 23:53 - 00000000 ____D () C:\FRST 2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 _____ () C:\Users\USER\defogger_reenable 2014-04-20 21:08 - 2014-04-22 23:29 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-20 21:08 - 2014-04-22 22:38 - 00001075 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-20 21:08 - 2014-04-22 22:38 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-04-20 21:08 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-20 21:08 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-20 21:08 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieUserList 2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieSiteList 2014-04-18 10:23 - 2014-04-18 10:23 - 00001106 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-04-16 19:31 - 2014-04-16 19:31 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat 2014-04-12 03:02 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-04-12 03:02 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-04-12 03:02 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-04-12 03:02 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-04-12 03:02 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-04-12 03:02 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-04-12 03:02 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-04-12 03:02 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-04-12 03:02 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-04-12 03:02 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-04-12 03:02 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-04-12 03:02 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-04-12 03:02 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-04-12 03:02 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-04-12 03:02 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-04-12 03:02 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-04-12 03:02 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-04-12 03:02 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-04-12 03:02 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-04-12 03:02 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-04-12 03:02 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-04-12 03:02 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-04-12 03:02 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-04-12 03:02 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-04-12 03:02 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-04-12 03:02 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-04-12 03:02 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-04-12 03:02 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-04-12 03:02 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-04-12 03:02 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-04-12 03:02 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-04-12 03:02 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-04-12 03:02 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-04-12 03:02 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-04-12 03:02 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-04-12 03:02 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-04-12 03:02 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-04-12 03:01 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-04-12 03:01 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-04-12 03:01 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-04-12 03:01 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-04-12 03:01 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-04-12 03:01 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-04-12 03:01 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-04-12 03:01 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-04-12 03:01 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-04-12 03:01 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-04-12 03:01 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-04-09 22:22 - 2007-05-31 19:30 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll 2014-04-09 22:22 - 2007-05-31 19:30 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll 2014-04-09 22:22 - 2007-05-31 19:29 - 00021352 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_2.dll 2014-04-09 22:22 - 2007-05-31 19:29 - 00018280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_2.dll 2014-04-09 22:22 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll 2014-04-09 22:22 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll 2014-04-09 22:22 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll 2014-04-09 22:22 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll 2014-04-09 22:22 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll 2014-04-09 22:22 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll 2014-04-09 22:22 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll 2014-04-09 22:22 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll 2014-04-09 22:22 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll 2014-04-09 22:22 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll 2014-04-09 22:22 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll 2014-04-09 22:22 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll 2014-04-09 22:22 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll 2014-04-09 22:22 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll 2014-04-09 22:22 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll 2014-04-09 22:22 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll 2014-04-09 22:22 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll 2014-04-09 22:22 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll 2014-04-09 22:22 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll 2014-04-09 22:22 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll 2014-04-09 22:22 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll 2014-04-09 22:22 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll 2014-04-09 22:22 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll 2014-04-09 22:22 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll 2014-04-09 22:22 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll 2014-04-09 22:22 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll 2014-04-09 22:22 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll 2014-04-09 22:22 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll 2014-04-09 22:22 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll 2014-04-09 22:22 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll 2014-04-09 22:22 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll 2014-04-09 22:22 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll 2014-04-09 22:22 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll 2014-04-09 22:22 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll 2014-04-09 22:22 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll 2014-04-09 22:22 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll 2014-04-09 22:22 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll 2014-04-09 22:22 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll 2014-04-09 22:21 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll 2014-04-09 22:21 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll 2014-04-09 22:21 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll 2014-04-09 22:21 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll 2014-04-09 22:21 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll 2014-04-09 22:21 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll 2014-04-09 22:21 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll 2014-04-09 22:21 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll 2014-04-09 22:21 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll 2014-04-09 22:21 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll 2014-04-09 22:21 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll 2014-04-09 22:21 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll 2014-04-09 22:21 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll 2014-04-09 22:21 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll 2014-04-09 22:21 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll 2014-04-09 22:21 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll 2014-04-09 22:19 - 2014-04-09 22:23 - 00163375 _____ () C:\Windows\DirectX.log 2014-04-09 22:17 - 2014-04-09 22:27 - 00310984 _____ () C:\Windows\system32\Drivers\atksgt.sys 2014-04-09 22:17 - 2014-04-09 22:17 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys 2014-04-09 11:32 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-04-09 11:32 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2014-04-09 11:32 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2014-04-09 11:32 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2014-04-09 11:32 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2014-04-09 11:32 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2014-04-09 11:32 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2014-04-09 11:32 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2014-04-09 11:32 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2014-04-09 11:32 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2014-04-09 11:32 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2014-04-09 11:32 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys 2014-04-09 11:32 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys 2014-04-09 11:32 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys 2014-04-09 11:32 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll 2014-04-09 11:32 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll 2014-04-09 11:32 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2014-04-09 00:03 - 2014-04-09 00:03 - 00000260 _____ () C:\Users\USER\1201226.ini 2014-04-07 22:48 - 2014-04-07 22:48 - 00000000 ____D () C:\Users\Public\Documents\AlawarWrapper 2014-04-07 09:26 - 2014-04-07 09:26 - 00000000 ____D () C:\Users\USER\AppData\Roaming\HomeMakeover 2014-04-07 00:15 - 2014-04-07 00:15 - 00000000 ____D () C:\ProgramData\BlueStacks 2014-04-06 23:56 - 2014-04-09 13:16 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yahoo US 2014-04-06 23:54 - 2014-04-09 13:16 - 00000000 ____D () C:\Users\USER\AppData\Local\GamesManager 2014-04-06 00:43 - 2014-04-06 00:43 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Brave Giant 2014-03-30 18:23 - 2014-04-05 17:42 - 00000000 ____D () C:\Users\USER\Downloads\Textures 2014-03-29 13:04 - 2014-03-29 13:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox ==================== One Month Modified Files and Folders ======= 2014-04-22 23:54 - 2014-04-22 23:53 - 00019974 _____ () C:\Users\USER\Downloads\FRST.txt 2014-04-22 23:53 - 2014-04-21 14:44 - 00000000 ____D () C:\FRST 2014-04-22 23:52 - 2014-04-22 23:51 - 02061312 _____ (Farbar) C:\Users\USER\Downloads\FRST64.exe 2014-04-22 23:41 - 2014-04-22 23:41 - 00005323 _____ () C:\Users\USER\Desktop\JRT.txt 2014-04-22 23:35 - 2013-06-26 19:33 - 01688900 _____ () C:\Windows\WindowsUpdate.log 2014-04-22 23:34 - 2009-07-14 06:45 - 00015616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-22 23:34 - 2009-07-14 06:45 - 00015616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-22 23:33 - 2014-04-22 23:33 - 00000000 ____D () C:\Windows\ERUNT 2014-04-22 23:30 - 2014-04-22 23:30 - 01016261 _____ (Thisisu) C:\Users\USER\Downloads\JRT.exe 2014-04-22 23:29 - 2014-04-20 21:08 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-22 23:24 - 2014-04-22 23:24 - 00001707 _____ () C:\Users\USER\Downloads\AdwCleaner.txt 2014-04-22 23:23 - 2014-01-23 08:21 - 00013621 _____ () C:\Windows\setupact.log 2014-04-22 23:23 - 2012-09-26 09:53 - 00000967 _____ () C:\Windows\SysWOW64\bscs.ini 2014-04-22 23:23 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-22 23:22 - 2012-09-13 19:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-22 23:20 - 2014-04-22 23:12 - 00000000 ____D () C:\AdwCleaner 2014-04-22 23:12 - 2014-04-22 23:12 - 01345435 _____ () C:\Users\USER\Downloads\adwcleaner.exe 2014-04-22 23:11 - 2014-04-22 23:11 - 00001049 _____ () C:\Users\USER\Downloads\malware.txt 2014-04-22 23:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-04-22 22:38 - 2014-04-20 21:08 - 00001075 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-22 22:38 - 2014-04-20 21:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-04-22 22:37 - 2014-04-22 22:37 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\USER\Downloads\mbam-setup-2.0.1.1004.exe 2014-04-22 18:14 - 2013-06-29 17:35 - 00000000 ____D () C:\Users\USER\AppData\Local\Adobe 2014-04-22 11:49 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-22 08:56 - 2013-06-29 17:59 - 00000000 ____D () C:\Users\USER\AppData\Roaming\FileZilla 2014-04-22 07:48 - 2014-04-22 07:47 - 00000000 ____D () C:\Users\USER\Downloads\422 2014-04-22 00:08 - 2013-12-01 22:56 - 00000000 ____D () C:\Users\USER\AppData\Roaming\XnView 2014-04-21 21:32 - 2014-04-21 21:02 - 00000000 ____D () C:\ComboFix 2014-04-21 21:29 - 2014-04-21 20:59 - 00000000 ____D () C:\Qoobox 2014-04-21 21:28 - 2014-04-21 20:58 - 00000000 ____D () C:\Windows\erdnt 2014-04-21 21:23 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-04-21 21:21 - 2014-02-02 09:03 - 00242238 _____ () C:\Windows\PFRO.log 2014-04-21 20:56 - 2014-04-21 20:55 - 05196870 ____R (Swearware) C:\Users\USER\Downloads\ComboFix.exe 2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 _____ () C:\Users\USER\defogger_reenable 2014-04-20 23:29 - 2014-03-17 20:19 - 00000000 ____D () C:\Users\USER\Downloads\Neuer Ordner 2014-04-20 21:56 - 2009-07-14 06:45 - 00000000 ____D () C:\Windows\Setup 2014-04-20 21:08 - 2013-10-09 12:48 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-20 19:44 - 2013-06-26 20:33 - 00000000 ____D () C:\Users\USER\AppData\Roaming\SoftGrid Client 2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieUserList 2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieSiteList 2014-04-18 22:05 - 2013-10-10 23:01 - 00000000 ____D () C:\Users\USER\Downloads\Fansites 2014-04-18 10:23 - 2014-04-18 10:23 - 00001106 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-04-18 10:23 - 2014-02-17 00:02 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-04-18 10:23 - 2014-02-17 00:01 - 00000000 ____D () C:\ProgramData\Package Cache 2014-04-17 15:27 - 2013-07-11 23:00 - 00000000 ____D () C:\Users\USER\AppData\Roaming\vlc 2014-04-16 19:31 - 2014-04-16 19:31 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat 2014-04-14 12:40 - 2011-10-01 13:18 - 00000000 ____D () C:\ProgramData\Adobe 2014-04-14 12:39 - 2014-01-11 02:48 - 00000000 ____D () C:\Program Files\Adobe 2014-04-14 12:39 - 2011-10-01 13:18 - 00000000 ____D () C:\Program Files (x86)\Adobe 2014-04-14 12:38 - 2013-09-19 22:01 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2014-04-13 13:26 - 2014-03-04 17:11 - 00000000 ____D () C:\Users\USER\Downloads\H50 2014-04-12 04:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-04-11 14:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-04-09 22:27 - 2014-04-09 22:17 - 00310984 _____ () C:\Windows\system32\Drivers\atksgt.sys 2014-04-09 22:23 - 2014-04-09 22:19 - 00163375 _____ () C:\Windows\DirectX.log 2014-04-09 22:17 - 2014-04-09 22:17 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys 2014-04-09 22:14 - 2011-10-01 11:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-04-09 16:25 - 2013-08-15 08:46 - 00000000 ____D () C:\Windows\system32\MRT 2014-04-09 16:23 - 2011-10-01 12:38 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-04-09 13:16 - 2014-04-06 23:56 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yahoo US 2014-04-09 13:16 - 2014-04-06 23:54 - 00000000 ____D () C:\Users\USER\AppData\Local\GamesManager 2014-04-09 13:13 - 2013-12-22 20:59 - 00000000 ____D () C:\Users\USER\AppData\Roaming\WildTangent 2014-04-09 13:13 - 2013-12-22 20:59 - 00000000 ____D () C:\ProgramData\WildTangent 2014-04-09 13:12 - 2013-11-24 20:31 - 00000000 ____D () C:\ProgramData\Oberon Media 2014-04-09 00:48 - 2013-11-14 22:24 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Oberon Media 2014-04-09 00:03 - 2014-04-09 00:03 - 00000260 _____ () C:\Users\USER\1201226.ini 2014-04-07 22:48 - 2014-04-07 22:48 - 00000000 ____D () C:\Users\Public\Documents\AlawarWrapper 2014-04-07 17:06 - 2014-02-21 14:32 - 00000000 ____D () C:\Users\USER\AppData\Roaming\AlawarEntertainment 2014-04-07 15:11 - 2009-07-14 19:58 - 00701172 _____ () C:\Windows\system32\perfh007.dat 2014-04-07 15:11 - 2009-07-14 19:58 - 00150520 _____ () C:\Windows\system32\perfc007.dat 2014-04-07 15:11 - 2009-07-14 07:13 - 01625658 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-07 15:08 - 2013-07-07 17:08 - 00000000 ____D () C:\Users\USER\AppData\Local\Corel 2014-04-07 12:55 - 2013-07-07 17:07 - 00000952 ___SH () C:\Windows\SysWOW64\KGyGaAvL.sys 2014-04-07 12:55 - 2013-07-07 17:06 - 00000000 ____D () C:\Users\USER\Documents\My PSP Files 2014-04-07 09:26 - 2014-04-07 09:26 - 00000000 ____D () C:\Users\USER\AppData\Roaming\HomeMakeover 2014-04-07 00:15 - 2014-04-07 00:15 - 00000000 ____D () C:\ProgramData\BlueStacks 2014-04-06 00:43 - 2014-04-06 00:43 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Brave Giant 2014-04-05 17:42 - 2014-03-30 18:23 - 00000000 ____D () C:\Users\USER\Downloads\Textures 2014-04-03 15:38 - 2011-10-01 13:10 - 00001912 _____ () C:\Windows\epplauncher.mif 2014-04-03 15:37 - 2011-10-01 13:09 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-04-03 15:37 - 2011-10-01 13:09 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client 2014-04-03 09:51 - 2014-04-20 21:08 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-03 09:51 - 2014-04-20 21:08 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-03 09:50 - 2014-04-20 21:08 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-02 22:37 - 2013-09-21 14:12 - 00000132 _____ () C:\Users\USER\AppData\Roaming\Adobe PNG-Format CC - Voreinstellungen 2014-04-01 07:07 - 2009-07-14 06:45 - 05101232 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-31 18:33 - 2013-06-26 19:37 - 00111496 _____ () C:\Users\USER\AppData\Local\GDIPFONTCACHEV1.DAT 2014-03-30 11:08 - 2013-06-29 17:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-03-29 13:04 - 2014-03-29 13:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox Some content of TEMP: ==================== C:\Users\USER\AppData\Local\Temp\avgnt.exe C:\Users\USER\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-11 14:27 ==================== End Of Log ============================ |
|
23.04.2014, 14:12
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Webseiten werden auf Werbung umgeleitetESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Windows 7: Webseiten werden auf Werbung umgeleitet |
|
24.04.2014, 18:13
| #7 |
| | Windows 7: Webseiten werden auf Werbung umgeleitet Esets Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=d7a8915e0a95b54895cdc01a3d9c9c6a
# engine=18015
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-24 04:05:58
# local_time=2014-04-24 06:05:58 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 30082 11003583 22719 0
# compatibility_mode=5893 16776574 100 94 24824582 149985408 0 0
# scanned=209444
# found=0
# cleaned=0
# scan_time=8179
Code:
ATTFilter Results of screen317's Security Check version 0.99.82
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 51
Java version out of Date!
Adobe Flash Player 12.0.0.77 Flash Player out of Date!
Adobe Reader 10.1.4 Adobe Reader out of Date!
Mozilla Firefox (28.0)
Mozilla Thunderbird (24.0.1)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials msseces.exe
Windows Defender MSMpEng.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014
Ran by USER (administrator) on HP-PC on 24-04-2014 18:56:39
Running from C:\Users\USER\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Corel, Inc.) C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe
() C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe
() C:\Windows\SysWOW64\PSIService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE
() C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(FileZilla Project) C:\Program Files (x86)\FileZilla FTP Client\filezilla.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-04-06] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-04] (Realtek Semiconductor)
HKLM\...\Run: [Corel Photo Downloader] => C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe [531784 2007-10-31] (Corel, Inc.)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-19] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-12-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [BtTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [371976 2012-09-19] (IVT Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Corel File Shell Monitor] => C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe [16200 2007-10-30] ()
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2239376 2013-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [180304 2014-04-15] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.youdagames.com?hp=1
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8D9489EB9372CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0Dzzzy0DyCyB0C0E0EtA0A0D0DyDyByDtN0D0Tzu0SyCzyzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825073042&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0Dzzzy0DyCyB0C0E0EtA0A0D0DyDyByDtN0D0Tzu0SyCzyzytN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825073042&ir=
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWOW64\skype4com.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default
FF DefaultSearchEngine: Amazon
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @oberon-media.com/ONCAdapter - C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-25]
FF Extension: ImageHost Grabber - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} [2013-06-29]
FF Extension: anonymoX - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\client@anonymox.net.xpi [2013-10-26]
FF Extension: Media Stealer - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\pn4y3dsu.default\Extensions\stealer@physacco.com.xpi [2013-07-11]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-08-29]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-09-13]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-09-13]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [122448 2014-04-15] (Avira Operations GmbH & Co. KG)
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1612552 2012-09-26] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [146184 2012-09-19] (IVT Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-04-06] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [279848 2007-06-27] (Nero AG)
R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe [1922600 2013-07-08] (Pandora.TV)
R2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [177704 2007-06-05] ()
==================== Drivers (Whitelisted) ====================
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2014-04-09] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-18] (Avira Operations GmbH & Co. KG)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [34912 2012-06-15] (Ralink Corporation.)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)
S3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [56904 2012-07-19] (Ralink Corporation)
S3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [48608 2012-10-02] (Ralink Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-01] (Intel Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2014-04-09] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-22] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-28] (Realtek Semiconductor Corp.)
R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [692832 2012-10-02] (Ralink Technology, Corp.)
R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2012-04-06] (Synaptics Incorporated)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [34912 2012-06-15] (Ralink Corporation.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-24 18:56 - 2014-04-24 18:56 - 02061824 _____ (Farbar) C:\Users\USER\Downloads\FRST64.exe
2014-04-24 18:56 - 2014-04-24 18:56 - 00019647 _____ () C:\Users\USER\Downloads\FRST.txt
2014-04-24 18:53 - 2014-04-24 18:53 - 00001043 _____ () C:\Users\USER\Downloads\checkup.txt
2014-04-24 18:51 - 2014-04-24 18:51 - 00855379 _____ () C:\Users\USER\Downloads\SecurityCheck.exe
2014-04-24 15:42 - 2014-04-24 15:42 - 02347384 _____ (ESET) C:\Users\USER\Downloads\esetsmartinstaller_enu.exe
2014-04-24 09:48 - 2014-04-24 09:48 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-23 09:09 - 2014-04-23 09:09 - 00000000 _____ () C:\Windows\SysWOW64\sho79A4.tmp
2014-04-23 07:23 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-23 07:23 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-22 23:41 - 2014-04-22 23:41 - 00005323 _____ () C:\Users\USER\Desktop\JRT.txt
2014-04-22 23:33 - 2014-04-22 23:33 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 23:12 - 2014-04-22 23:20 - 00000000 ____D () C:\AdwCleaner
2014-04-21 21:02 - 2014-04-21 21:32 - 00000000 ____D () C:\ComboFix
2014-04-21 21:02 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-21 21:02 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-21 21:02 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-21 21:02 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-21 21:02 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-21 21:02 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-21 21:02 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-21 21:02 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-21 20:59 - 2014-04-21 21:29 - 00000000 ____D () C:\Qoobox
2014-04-21 20:58 - 2014-04-21 21:28 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 14:44 - 2014-04-24 18:56 - 00000000 ____D () C:\FRST
2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 _____ () C:\Users\USER\defogger_reenable
2014-04-20 21:08 - 2014-04-22 23:29 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieUserList
2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieSiteList
2014-04-18 10:23 - 2014-04-18 10:23 - 00001106 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-04-16 19:31 - 2014-04-16 19:31 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2014-04-12 03:02 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-12 03:02 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-12 03:02 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-12 03:02 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-12 03:02 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-12 03:02 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-12 03:02 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-12 03:02 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-12 03:02 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-12 03:02 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-12 03:02 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-12 03:02 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-12 03:02 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-12 03:02 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-12 03:02 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-12 03:02 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-12 03:02 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-12 03:02 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-12 03:02 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-12 03:02 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-12 03:02 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-12 03:02 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-12 03:02 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-12 03:02 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-12 03:02 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-12 03:02 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-12 03:02 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-12 03:02 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-12 03:02 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-12 03:02 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-12 03:02 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-12 03:02 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-12 03:02 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-12 03:02 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-12 03:02 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-12 03:02 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-12 03:02 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-12 03:01 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-12 03:01 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-12 03:01 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-12 03:01 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-12 03:01 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-12 03:01 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-12 03:01 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-12 03:01 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-12 03:01 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-12 03:01 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-12 03:01 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 22:22 - 2007-05-31 19:30 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-04-09 22:22 - 2007-05-31 19:30 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-04-09 22:22 - 2007-05-31 19:29 - 00021352 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_2.dll
2014-04-09 22:22 - 2007-05-31 19:29 - 00018280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_2.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-04-09 22:22 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-04-09 22:22 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-04-09 22:22 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-04-09 22:22 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-04-09 22:22 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-04-09 22:22 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-04-09 22:22 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-04-09 22:22 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-04-09 22:22 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-04-09 22:22 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-04-09 22:22 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-04-09 22:22 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-04-09 22:22 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-04-09 22:22 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-04-09 22:22 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-04-09 22:22 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-04-09 22:22 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-04-09 22:22 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-04-09 22:22 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-04-09 22:22 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-04-09 22:22 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-04-09 22:22 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-04-09 22:22 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-04-09 22:22 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-04-09 22:22 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-04-09 22:22 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-04-09 22:22 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-04-09 22:22 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-04-09 22:22 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-04-09 22:22 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-04-09 22:22 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-04-09 22:22 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-04-09 22:22 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-04-09 22:21 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-04-09 22:21 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-04-09 22:21 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-04-09 22:21 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-04-09 22:21 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-04-09 22:21 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-04-09 22:21 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-04-09 22:21 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-04-09 22:21 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-04-09 22:21 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-04-09 22:21 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-04-09 22:21 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-04-09 22:21 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-04-09 22:21 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-04-09 22:21 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-04-09 22:21 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-04-09 22:19 - 2014-04-09 22:23 - 00163375 _____ () C:\Windows\DirectX.log
2014-04-09 22:17 - 2014-04-09 22:27 - 00310984 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-04-09 22:17 - 2014-04-09 22:17 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-04-09 11:32 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 11:32 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 11:32 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 11:32 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 11:32 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 11:32 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 11:32 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 11:32 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 11:32 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 11:32 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 11:32 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 11:32 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 11:32 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 11:32 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 11:32 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 11:32 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 11:32 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 01:13 - 2014-04-09 13:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Legacy Interactive
2014-04-09 00:07 - 2014-04-09 13:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BoontyGames
2014-04-09 00:03 - 2014-04-09 00:03 - 00000260 _____ () C:\Users\USER\1201226.ini
2014-04-07 22:48 - 2014-04-07 22:48 - 00000000 ____D () C:\Users\Public\Documents\AlawarWrapper
2014-04-07 09:26 - 2014-04-07 09:26 - 00000000 ____D () C:\Users\USER\AppData\Roaming\HomeMakeover
2014-04-07 00:15 - 2014-04-07 00:15 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-04-06 23:56 - 2014-04-09 13:16 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yahoo US
2014-04-06 23:54 - 2014-04-09 13:16 - 00000000 ____D () C:\Users\USER\AppData\Local\GamesManager
2014-04-06 00:43 - 2014-04-06 00:43 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Brave Giant
2014-04-06 00:13 - 2014-04-09 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameHouse
2014-03-30 18:23 - 2014-04-05 17:42 - 00000000 ____D () C:\Users\USER\Downloads\Textures
2014-03-29 13:04 - 2014-03-29 13:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2014-04-24 18:57 - 2014-04-24 18:56 - 00019647 _____ () C:\Users\USER\Downloads\FRST.txt
2014-04-24 18:56 - 2014-04-24 18:56 - 02061824 _____ (Farbar) C:\Users\USER\Downloads\FRST64.exe
2014-04-24 18:56 - 2014-04-21 14:44 - 00000000 ____D () C:\FRST
2014-04-24 18:53 - 2014-04-24 18:53 - 00001043 _____ () C:\Users\USER\Downloads\checkup.txt
2014-04-24 18:51 - 2014-04-24 18:51 - 00855379 _____ () C:\Users\USER\Downloads\SecurityCheck.exe
2014-04-24 18:26 - 2013-06-26 19:33 - 01790641 _____ () C:\Windows\WindowsUpdate.log
2014-04-24 18:22 - 2012-09-13 19:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-24 15:42 - 2014-04-24 15:42 - 02347384 _____ (ESET) C:\Users\USER\Downloads\esetsmartinstaller_enu.exe
2014-04-24 14:47 - 2013-06-29 17:59 - 00000000 ____D () C:\Users\USER\AppData\Roaming\FileZilla
2014-04-24 12:19 - 2013-07-08 00:44 - 00000000 ____D () C:\Users\USER\Documents\Bewerbung Vorlagen
2014-04-24 09:48 - 2014-04-24 09:48 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-24 09:48 - 2009-07-14 06:45 - 00015616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-24 09:48 - 2009-07-14 06:45 - 00015616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-24 09:39 - 2012-09-26 09:53 - 00000967 _____ () C:\Windows\SysWOW64\bscs.ini
2014-04-24 09:38 - 2014-01-23 08:21 - 00013845 _____ () C:\Windows\setupact.log
2014-04-24 09:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-23 23:21 - 2013-12-01 22:56 - 00000000 ____D () C:\Users\USER\AppData\Roaming\XnView
2014-04-23 18:23 - 2013-06-29 17:35 - 00000000 ____D () C:\Users\USER\AppData\Local\Adobe
2014-04-23 09:09 - 2014-04-23 09:09 - 00000000 _____ () C:\Windows\SysWOW64\sho79A4.tmp
2014-04-23 01:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-22 23:41 - 2014-04-22 23:41 - 00005323 _____ () C:\Users\USER\Desktop\JRT.txt
2014-04-22 23:33 - 2014-04-22 23:33 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 23:29 - 2014-04-20 21:08 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 23:20 - 2014-04-22 23:12 - 00000000 ____D () C:\AdwCleaner
2014-04-22 11:49 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-21 21:32 - 2014-04-21 21:02 - 00000000 ____D () C:\ComboFix
2014-04-21 21:29 - 2014-04-21 20:59 - 00000000 ____D () C:\Qoobox
2014-04-21 21:28 - 2014-04-21 20:58 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 21:23 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-21 21:21 - 2014-02-02 09:03 - 00242238 _____ () C:\Windows\PFRO.log
2014-04-21 14:43 - 2014-04-21 14:43 - 00000000 _____ () C:\Users\USER\defogger_reenable
2014-04-20 23:29 - 2014-03-17 20:19 - 00000000 ____D () C:\Users\USER\Downloads\Neuer Ordner
2014-04-20 21:56 - 2009-07-14 06:45 - 00000000 ____D () C:\Windows\Setup
2014-04-20 21:08 - 2013-10-09 12:48 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-20 19:44 - 2013-06-26 20:33 - 00000000 ____D () C:\Users\USER\AppData\Roaming\SoftGrid Client
2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieUserList
2014-04-20 19:42 - 2014-04-20 19:42 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieSiteList
2014-04-18 22:05 - 2013-10-10 23:01 - 00000000 ____D () C:\Users\USER\Downloads\Fansites
2014-04-18 10:23 - 2014-04-18 10:23 - 00001106 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-04-18 10:23 - 2014-02-17 00:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-04-18 10:23 - 2014-02-17 00:02 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-04-18 10:23 - 2014-02-17 00:01 - 00000000 ____D () C:\ProgramData\Package Cache
2014-04-17 15:27 - 2013-07-11 23:00 - 00000000 ____D () C:\Users\USER\AppData\Roaming\vlc
2014-04-16 19:31 - 2014-04-16 19:31 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2014-04-14 12:40 - 2011-10-01 13:18 - 00000000 ____D () C:\ProgramData\Adobe
2014-04-14 12:39 - 2014-01-11 02:48 - 00000000 ____D () C:\Program Files\Adobe
2014-04-14 12:39 - 2011-10-01 13:18 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-04-14 12:38 - 2013-09-19 22:01 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-04-14 04:24 - 2014-04-23 07:23 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-04-23 07:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-13 13:26 - 2014-03-04 17:11 - 00000000 ____D () C:\Users\USER\Downloads\H50
2014-04-12 04:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-11 14:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-09 22:27 - 2014-04-09 22:17 - 00310984 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-04-09 22:23 - 2014-04-09 22:19 - 00163375 _____ () C:\Windows\DirectX.log
2014-04-09 22:17 - 2014-04-09 22:17 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-04-09 22:14 - 2011-10-01 11:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-09 16:25 - 2013-08-15 08:46 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 16:23 - 2011-10-01 12:38 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 13:16 - 2014-04-06 23:56 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yahoo US
2014-04-09 13:16 - 2014-04-06 23:54 - 00000000 ____D () C:\Users\USER\AppData\Local\GamesManager
2014-04-09 13:15 - 2014-04-06 00:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameHouse
2014-04-09 13:13 - 2013-12-22 20:59 - 00000000 ____D () C:\Users\USER\AppData\Roaming\WildTangent
2014-04-09 13:13 - 2013-12-22 20:59 - 00000000 ____D () C:\ProgramData\WildTangent
2014-04-09 13:13 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-04-09 13:12 - 2014-04-09 01:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Legacy Interactive
2014-04-09 13:12 - 2014-04-09 00:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BoontyGames
2014-04-09 13:12 - 2013-11-24 20:31 - 00000000 ____D () C:\ProgramData\Oberon Media
2014-04-09 00:48 - 2013-11-14 22:24 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Oberon Media
2014-04-09 00:03 - 2014-04-09 00:03 - 00000260 _____ () C:\Users\USER\1201226.ini
2014-04-07 22:48 - 2014-04-07 22:48 - 00000000 ____D () C:\Users\Public\Documents\AlawarWrapper
2014-04-07 17:06 - 2014-02-21 14:32 - 00000000 ____D () C:\Users\USER\AppData\Roaming\AlawarEntertainment
2014-04-07 15:11 - 2009-07-14 19:58 - 00701172 _____ () C:\Windows\system32\perfh007.dat
2014-04-07 15:11 - 2009-07-14 19:58 - 00150520 _____ () C:\Windows\system32\perfc007.dat
2014-04-07 15:11 - 2009-07-14 07:13 - 01625658 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-07 15:08 - 2013-07-07 17:08 - 00000000 ____D () C:\Users\USER\AppData\Local\Corel
2014-04-07 12:55 - 2013-07-07 17:07 - 00000952 ___SH () C:\Windows\SysWOW64\KGyGaAvL.sys
2014-04-07 12:55 - 2013-07-07 17:06 - 00000000 ____D () C:\Users\USER\Documents\My PSP Files
2014-04-07 09:26 - 2014-04-07 09:26 - 00000000 ____D () C:\Users\USER\AppData\Roaming\HomeMakeover
2014-04-07 00:15 - 2014-04-07 00:15 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-04-06 00:43 - 2014-04-06 00:43 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Brave Giant
2014-04-05 17:42 - 2014-03-30 18:23 - 00000000 ____D () C:\Users\USER\Downloads\Textures
2014-04-03 15:38 - 2011-10-01 13:10 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-04-03 15:38 - 2011-10-01 13:09 - 00002126 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-04-03 15:37 - 2011-10-01 13:09 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-04-03 15:37 - 2011-10-01 13:09 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-04-02 22:37 - 2013-09-21 14:12 - 00000132 _____ () C:\Users\USER\AppData\Roaming\Adobe PNG-Format CC - Voreinstellungen
2014-04-01 07:07 - 2009-07-14 06:45 - 05101232 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-31 18:33 - 2013-06-26 19:37 - 00111496 _____ () C:\Users\USER\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-30 11:08 - 2013-06-29 17:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-29 13:04 - 2014-03-29 13:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
Some content of TEMP:
====================
C:\Users\USER\AppData\Local\Temp\avgnt.exe
C:\Users\USER\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-11 14:27
==================== End Of Log ============================
Keine Probleme mehr, läuft wieder wunderbar! Vielen, vielen Dank für die tolle und schnelle hilfe! |
|
25.04.2014, 18:27
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Webseiten werden auf Werbung umgeleitet Java und Adobe updaten. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.04.2014, 12:43
| #9 |
| | Windows 7: Webseiten werden auf Werbung umgeleitet Keine Probleme mehr, noch mal vielen Dank für die Hilfe! |
|
28.04.2014, 08:36
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Webseiten werden auf Werbung umgeleitet Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: Webseiten werden auf Werbung umgeleitet |
| adobe, antivir, antivirus, auf werbung umgeleitet, avira, browser, defender, desktop, device driver, dllhost.exe, dvdvideosoft ltd., error, flash player, ftp, homepage, installation, launch, mozilla, officejet, photoshop, popup, problem, realtek, registry, scan, security, services.exe, software, system, werbung, windows |
WARNUNG an die MITLESER: 
Linear-Darstellung
