Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
TimeServer.exe

TimeServer.exe


Plagegeister aller Art und deren Bekämpfung: TimeServer.exe

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 1 von 2 1 2
Alt 01.05.2014, 18:45   #1
Anderl's Pho
 
TimeServer.exe - Standard

TimeServer.exe


Servus beinand ,

Ich habe auch seit einiger Zeit das Problem mit diesem TimeServer.exe. Beim Taskmanager unter Prozesse taucht bei mir auch dieses Problem auf. Bei mir macht es sich über den Lüfter bemerkbar auch wenn das Laptop im Leerlauf sich befindet ist es unüberhörbar laut.

Für Hilfe wäre ich sehr dankbar.

Lg Anderl

Alt 01.05.2014, 19:24   #2
Bootsektor
Ruhe in Frieden
† 2019
 
TimeServer.exe - Standard

TimeServer.exe




Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
  • Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
  • Poste die Logfiles direkt in deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:
  • Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
  • Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
  • Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.

Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________

__________________
Alt 01.05.2014, 19:44   #3
Anderl's Pho
 
TimeServer.exe - Standard

TimeServer.exe


# FSRT.Txt
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-05-2014 01
Ran by WhiteBull (administrator) on WHITEBULL-PC on 01-05-2014 20:37:48
Running from C:\Users\WhiteBull\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Binary Fortress Software) C:\Program Files (x86)\DisplayFusion\DisplayFusionService.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Binary Fortress Software) C:\Program Files (x86)\DisplayFusion\DisplayFusion.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
() C:\Program Files\UCT\HDR Expose 3\HDRExpose3Service.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Binary Fortress Software) C:\Program Files (x86)\DisplayFusion\DisplayFusionHookAppWIN6032.exe
(Binary Fortress Software) C:\Program Files (x86)\DisplayFusion\DisplayFusionHookAppWIN6064.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\LogiAppBroker.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\Run: [DisplayFusion] => C:\Program Files (x86)\DisplayFusion\DisplayFusion.exe [7892864 2013-09-02] (Binary Fortress Software)
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\Policies\system: [EnableLUA] 0
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\MountPoints2: M - M:\start.exe
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\MountPoints2: {a8636d9b-cc68-11e3-a2db-c44619ba3bb5} - F:\start.exe
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\MountPoints2: {cb7fd5f9-5140-11e3-96fb-c44619ba3bb5} - F:\Windows\StartFreeStyle.exe
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\Winlogon: [Shell] explorer.exe,"C:\Windows\SysWOW64\NT Kernel\NTKernel.exe" <==== ATTENTION 
IFEO\AvastSvc.exe: [Debugger] nqij.exe
IFEO\AvastUI.exe: [Debugger] nqij.exe
IFEO\avcenter.exe: [Debugger] nqij.exe
IFEO\avconfig.exe: [Debugger] nqij.exe
IFEO\avgcsrvx.exe: [Debugger] nqij.exe
IFEO\avgidsagent.exe: [Debugger] nqij.exe
IFEO\avgnt.exe: [Debugger] nqij.exe
IFEO\avgrsx.exe: [Debugger] nqij.exe
IFEO\avguard.exe: [Debugger] nqij.exe
IFEO\avgui.exe: [Debugger] nqij.exe
IFEO\avgwdsvc.exe: [Debugger] nqij.exe
IFEO\avscan.exe: [Debugger] nqij.exe
IFEO\bdagent.exe: [Debugger] nqij.exe
IFEO\blindman.exe: [Debugger] nqij.exe
IFEO\ccuac.exe: [Debugger] nqij.exe
IFEO\ComboFix.exe: [Debugger] nqij.exe
IFEO\egui.exe: [Debugger] nqij.exe
IFEO\hijackthis.exe: [Debugger] nqij.exe
IFEO\instup.exe: [Debugger] nqij.exe
IFEO\iSafeScan.exe: [Debugger] nqij.exe
IFEO\keyscrambler.exe: [Debugger] nqij.exe
IFEO\mbam.exe: [Debugger] nqij.exe
IFEO\mbamgui.exe: [Debugger] nqij.exe
IFEO\mbampt.exe: [Debugger] nqij.exe
IFEO\mbamscheduler.exe: [Debugger] nqij.exe
IFEO\mbamservice.exe: [Debugger] nqij.exe
IFEO\MpCmdRun.exe: [Debugger] nqij.exe
IFEO\MSASCui.exe: [Debugger] nqij.exe
IFEO\MsMpEng.exe: [Debugger] nqij.exe
IFEO\msseces.exe: [Debugger] nqij.exe
IFEO\rstrui.exe: [Debugger] nqij.exe
IFEO\SDFiles.exe: [Debugger] nqij.exe
IFEO\SDFSSvc.exe: [Debugger] nqij.exe
IFEO\SDMain.exe: [Debugger] nqij.exe
IFEO\SDWinSec.exe: [Debugger] nqij.exe
IFEO\SDWSCSvc.exe: [Debugger] nqij.exe
IFEO\spybotsd.exe: [Debugger] nqij.exe
IFEO\TuneUpUtilitiesApp64.exe: [Debugger] nqij.exe
IFEO\TuneUpUtilitiesService64.exe: [Debugger] nqij.exe
IFEO\wireshark.exe: [Debugger] nqij.exe
IFEO\zlclient.exe: [Debugger] nqij.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF7E9F6A15FD1CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - (No Name) - {5786d022-540e-4699-b350-b4be0ae94b79} - No File
SearchScopes: HKLM - DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -  No File
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{AF6B63A0-54E4-46EE-A10B-EAF69F39B59E}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

FireFox:
========
FF ProfilePath: C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default
FF NewTab: about:blank
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: about:blank
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.11.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.11.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF Plugin HKCU: adobe.com/AdobeExManCCDetect32 - C:\Program Files (x86)\Adobe\Adobe Extension Manager CC\npAdobeExManCCDetect32.dll (Adobe Systems)
FF Plugin HKCU: adobe.com/AdobeExManCCDetect64 - C:\Program Files (x86)\Adobe\Adobe Extension Manager CC\npAdobeExManCCDetect64.dll (Adobe Systems)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: MEGA - C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\Extensions\firefox@mega.co.nz.xpi [2013-12-12]
FF Extension: Personas Plus - C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\Extensions\personas@christopher.beard.xpi [2012-06-20]
FF Extension: GMX MailCheck - C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\Extensions\toolbar@gmx.net.xpi [2013-09-14]
FF Extension: Facebook Photo Zoom - C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\Extensions\{7c6cdf7c-8ea8-4be7-ae5a-0b3effe14d66}.xpi [2014-04-24]
FF Extension: Adblock Plus - C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-23]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-01-13]

Chrome: 
=======
CHR HomePage: hxxp://google.de/
CHR StartupUrls: "about:blank"
CHR Extension: (Google Docs) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-29]
CHR Extension: (Google Drive) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-05]
CHR Extension: (YouTube) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-01-12]
CHR Extension: (GMX MailCheck) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\camnampocfohlcgbajligmemmabnljcm [2014-04-26]
CHR Extension: (Google-Suche) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-01-12]
CHR Extension: (Logitech Smooth Scrolling) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2014-04-26]
CHR Extension: (Photo Zoom for Facebook) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\elioihkkcdgakfbahdoddophfngopipi [2014-04-26]
CHR Extension: (Type Scout) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\fedokkaolmkkoeedicihicdeppjjeamj [2014-04-26]
CHR Extension: (Zoom For Facebook™) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngbeoiabhpolojnejkbnbflcfcchmaj [2014-04-26]
CHR Extension: (Google Wallet) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-05]
CHR Extension: (Google Mail) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-01-12]
CHR Extension: (Facebook Likes und Fans Börse) - C:\Users\WhiteBull\AppData\Local\Google\Chrome\User Data\Default\Extensions\pofmbenoongnpfnlbophjclcmdkmjmpf [2014-04-26]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [44736 2013-10-24] (ArcSoft, Inc.)
S3 DfSdkS; C:\Program Files (x86)\Ashampoo\Ashampoo UnInstaller 5\DfSdkS64.exe [544768 2009-08-24] (mst software GmbH, Germany)
R2 DisplayFusionService; C:\Program Files (x86)\DisplayFusion\DisplayFusionService.exe [1315728 2013-09-02] (Binary Fortress Software)
R2 HDRExpose3Service; C:\Program Files\UCT\HDR Expose 3\HDRExpose3Service.exe [65656 2013-10-13] ()
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
S4 Time; C:\ProgramData\Microsoft\Windows\Time\Time-svc.exe [10752 2013-07-26] (Microsoft)
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [621336 2013-12-04] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

S3 AiCharger; C:\Windows\SysWow64\drivers\AiCharger.sys [14848 2012-03-22] (ASUSTek Computer Inc.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-25] (Disc Soft Ltd)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104560 2012-04-25] (Qualcomm Atheros Co., Ltd.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-04-25] (Duplex Secure Ltd.)
R2 UI5IFS; C:\Program Files (x86)\Ashampoo\Ashampoo UnInstaller 5\IFS64.sys [30120 2012-09-18] ()
U3 avi8r048; C:\Windows\System32\Drivers\avi8r048.sys [0 ] (Microsoft Corporation)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-01 20:37 - 2014-05-01 20:38 - 00020780 _____ () C:\Users\WhiteBull\Downloads\FRST.txt
2014-05-01 20:37 - 2014-05-01 20:37 - 00000000 ____D () C:\FRST
2014-05-01 20:36 - 2014-05-01 20:36 - 02061824 _____ (Farbar) C:\Users\WhiteBull\Downloads\FRST64.exe
2014-05-01 19:50 - 2014-05-01 19:53 - 00052608 _____ () C:\Users\WhiteBull\Adobe Creative Suite Cleaner Tool.log
2014-05-01 19:49 - 2014-05-01 19:49 - 08098376 _____ () C:\Users\WhiteBull\Downloads\adobe_creative_suite_6cleaner_tool.zip
2014-05-01 19:49 - 2011-05-27 17:05 - 07767944 _____ (Adobe System Incorporated.) C:\Users\WhiteBull\Downloads\AdobeCreativeSuiteCleanerTool.exe
2014-05-01 11:08 - 2014-05-01 11:09 - 00000000 ____D () C:\Windows\system32\config\RCCBakup
2014-05-01 11:00 - 2014-05-01 15:01 - 00000284 _____ () C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2014-05-01 11:00 - 2014-05-01 11:00 - 00002894 _____ () C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2014-05-01 10:59 - 2014-05-01 11:11 - 00000292 _____ () C:\Windows\Tasks\RegClean Pro_UPDATES.job
2014-05-01 10:59 - 2014-05-01 11:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro
2014-05-01 10:59 - 2014-05-01 11:05 - 00000000 ____D () C:\Program Files (x86)\RegClean Pro
2014-05-01 10:59 - 2014-05-01 10:59 - 04853880 _____ (Systweak Inc ) C:\Users\WhiteBull\Downloads\rcpsetup_2005.exe
2014-05-01 10:59 - 2014-05-01 10:59 - 00003050 _____ () C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2014-05-01 10:59 - 2014-05-01 10:59 - 00001014 _____ () C:\Users\Public\Desktop\RegClean Pro.lnk
2014-05-01 10:59 - 2014-05-01 10:59 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\systweak
2014-05-01 10:59 - 2014-01-03 13:16 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2014-05-01 08:37 - 2014-05-01 08:37 - 00000000 ____D () C:\Users\WhiteBull\Documents\HDR Expose 3
2014-05-01 08:37 - 2014-05-01 08:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HDR Expose 3
2014-05-01 08:37 - 2014-05-01 08:37 - 00000000 ____D () C:\Program Files\Common Files\UCT
2014-05-01 08:36 - 2014-05-01 08:36 - 00000000 ____D () C:\Program Files\UCT
2014-05-01 08:33 - 2014-05-01 08:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photomatix Pro 4.1
2014-04-29 19:06 - 2014-04-29 19:06 - 00000000 ____D () C:\Program Files (x86)\GreenTree Applications
2014-04-28 21:47 - 2014-04-28 21:47 - 00000122 ___RH () C:\Users\WhiteBull\Downloads\Stinger.opt
2014-04-28 19:50 - 2014-04-28 21:47 - 00001160 _____ () C:\Users\WhiteBull\Downloads\Stinger_28042014_195034.html
2014-04-28 19:49 - 2014-04-28 21:47 - 00000000 ____D () C:\Program Files (x86)\stinger
2014-04-28 19:49 - 2014-04-28 19:49 - 10642280 _____ (McAfee Inc) C:\Users\WhiteBull\Downloads\stinger32.exe
2014-04-28 19:42 - 2014-04-28 19:42 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\WhiteBull\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-28 19:30 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-28 19:29 - 2014-04-28 19:29 - 01310283 _____ () C:\Users\WhiteBull\Downloads\adwcleaner.exe
2014-04-28 19:08 - 2014-04-28 19:48 - 00000118 ___RH () C:\Users\WhiteBull\Desktop\Stinger.opt
2014-04-28 18:02 - 2014-04-28 18:02 - 11825832 _____ (Elex do Brasil Participações Ltda) C:\Users\WhiteBull\Downloads\yet_another_cleaner_sk.exe
2014-04-26 13:40 - 2014-05-01 20:26 - 00008746 _____ () C:\Windows\PFRO.log
2014-04-26 13:27 - 2014-04-26 13:27 - 00000302 _____ () C:\Windows\Tasks\Systweak Support Dock.job
2014-04-26 13:27 - 2014-04-26 13:27 - 00000000 ____D () C:\Program Files (x86)\Amazon
2014-04-26 13:18 - 2014-04-26 13:18 - 00000366 _____ () C:\Windows\Tasks\VStart{A37B472A-8335-449F-9568-43ECC2907F06}.job
2014-04-26 12:53 - 2014-04-26 12:53 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-26 12:53 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-26 12:53 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-26 12:28 - 2014-04-28 18:19 - 00010798 _____ () C:\Users\WhiteBull\Desktop\hijackthis.log
2014-04-26 12:28 - 2014-04-26 12:28 - 00388608 _____ (Trend Micro Inc.) C:\Users\WhiteBull\Desktop\HiJackThis204.exe
2014-04-26 08:13 - 2014-05-01 20:27 - 00003080 _____ () C:\Windows\setupact.log
2014-04-26 08:13 - 2014-04-26 08:13 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-25 21:24 - 2014-04-25 21:24 - 00000000 ____D () C:\Users\Public\Documents\Ashampoo
2014-04-25 21:23 - 2014-04-25 21:23 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ashampoo
2014-04-25 20:43 - 2014-04-25 20:43 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\URSoft
2014-04-25 18:32 - 2014-04-25 18:32 - 00187462 _____ () C:\Users\WhiteBull\Documents\cc_20140425_183241.reg
2014-04-25 18:16 - 2014-04-28 18:27 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-25 18:16 - 2014-04-25 18:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-04-25 13:06 - 2014-04-25 13:06 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2014-04-25 13:04 - 2014-04-25 13:06 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Pro
2014-04-25 13:04 - 2014-04-25 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Pro
2014-04-24 07:54 - 2014-04-24 07:54 - 00000000 ___RD () C:\Users\WhiteBull\Creative Cloud Files
2014-04-23 14:16 - 2014-04-23 14:18 - 398690304 _____ () C:\Users\WhiteBull\Downloads\kav_rescue_10.iso
2014-04-23 13:34 - 2010-08-19 19:22 - 00409600 _____ (Kaspersky Lab ZAO) C:\Users\WhiteBull\Desktop\rescue2usb.exe
2014-04-23 13:01 - 2014-04-28 19:09 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\MD5 File Hasher
2014-04-23 13:01 - 2014-04-23 13:01 - 02443152 _____ (Digital-Tronic ) C:\Users\WhiteBull\Downloads\MD5FileHasher_Setup.exe
2014-04-23 13:01 - 2014-04-23 13:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MD5 File Hasher
2014-04-23 13:01 - 2014-04-23 13:01 - 00000000 ____D () C:\Program Files (x86)\MD5 File Hasher
2014-04-23 13:01 - 2013-09-23 13:56 - 01138688 ____S (Digital-Tronic) C:\Windows\SysWOW64\HashControls.ocx
2014-04-23 13:01 - 2005-07-17 07:21 - 00128736 ____S (Karen Kenworthy) C:\Windows\SysWOW64\PTHash.dll
2014-04-23 13:01 - 1998-06-08 23:00 - 00137216 ____S (Microsoft Corporation) C:\Windows\SysWOW64\MSDERUN.DLL
2014-04-23 11:27 - 2014-04-24 08:24 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-04-23 09:02 - 2014-04-23 09:43 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\ImgBurn
2014-04-23 09:02 - 2014-04-23 09:03 - 127631360 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\avg_arl_cdi_all_120_140203a7055.iso
2014-04-23 08:56 - 2014-04-23 08:56 - 03469871 _____ (LIGHTNING UK!) C:\Users\Gast.WhiteBull-PC\Downloads\SetupImgBurn_2.5.8.0.exe
2014-04-23 08:05 - 2014-04-23 08:05 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\DAEMON Tools Lite
2014-04-23 08:05 - 2014-04-23 08:05 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2014-04-22 23:09 - 2010-08-16 17:02 - 00019181 ____R () C:\Users\Gast.WhiteBull-PC\Desktop\license_notice.txt
2014-04-22 23:09 - 2010-06-22 13:39 - 00000237 _____ () C:\Users\Gast.WhiteBull-PC\Desktop\syslinux.cfg
2014-04-22 23:09 - 2010-04-01 11:01 - 00028160 _____ () C:\Users\Gast.WhiteBull-PC\Desktop\syslinux.exe
2014-04-22 23:09 - 2009-10-16 16:43 - 00237849 _____ () C:\Users\Gast.WhiteBull-PC\Desktop\grub.exe
2014-04-22 22:49 - 2014-04-22 22:51 - 398645248 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\kav_rescue_10.iso
2014-04-22 22:36 - 2014-04-22 22:36 - 04831744 _____ (Geza Kovacs) C:\Users\Gast.WhiteBull-PC\Downloads\unetbootin-windows-603.exe
2014-04-22 22:19 - 2014-04-22 22:19 - 00387584 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\rescue2usb1007.exe
2014-04-22 21:33 - 2014-04-22 21:33 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\Downloads\AVG
2014-04-22 21:32 - 2014-02-06 09:52 - 512000000 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\arl_rootfs.ext2
2014-04-22 21:32 - 2014-02-03 14:01 - 00008531 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\CHANGELOG
2014-04-22 21:32 - 2014-02-03 12:51 - 00000011 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\arl-version
2014-04-22 21:32 - 2013-07-11 12:53 - 02852544 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\vmlinuz
2014-04-22 21:32 - 2013-07-11 12:53 - 00993190 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\initrd.lzm
2014-04-22 21:32 - 2013-07-11 12:53 - 00216064 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\syslinux.exe
2014-04-22 21:32 - 2013-07-11 12:53 - 00164504 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\memtest
2014-04-22 21:32 - 2013-07-11 12:53 - 00026256 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\menu.c32
2014-04-22 21:32 - 2013-07-11 12:53 - 00024812 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\libutil.c32
2014-04-22 21:32 - 2013-07-11 12:53 - 00007768 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\setup.sh
2014-04-22 21:32 - 2013-07-11 12:53 - 00001722 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\arl.conf
2014-04-22 21:32 - 2013-07-11 12:53 - 00001523 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\README
2014-04-22 21:32 - 2013-07-11 12:53 - 00000997 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\syslinux.cfg
2014-04-22 21:32 - 2013-07-11 12:53 - 00000702 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\f1.msg
2014-04-22 20:48 - 2014-04-22 21:02 - 171589000 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\kav_rescue_1032.iso
2014-04-22 19:39 - 2014-04-22 19:39 - 00185944 _____ (Лаборатория Касперского) C:\Users\Gast.WhiteBull-PC\Downloads\kss12.0.1.117abRU_EN_DE_FR_ES_IT_JA_PT_ZH_5623 (1).exe
2014-04-22 18:32 - 2014-04-23 11:16 - 00000000 ____D () C:\ProgramData\Weibbing
2014-04-22 18:32 - 2014-04-23 11:02 - 00000000 ____D () C:\Program Files (x86)\Weibbing
2014-04-22 16:13 - 2014-04-22 12:14 - 11583848 ____N (McAfee Inc) C:\Users\WhiteBull\Desktop\stinger.exe
2014-04-22 15:56 - 2014-04-22 15:56 - 00000000 ____D () C:\Quarantine
2014-04-22 15:53 - 2014-04-28 19:48 - 00000000 ____D () C:\Program Files\stinger
2014-04-22 15:53 - 2014-04-22 15:53 - 11575313 _____ () C:\Users\WhiteBull\Downloads\stinger64-epo.zip
2014-04-22 13:06 - 2014-04-22 13:06 - 00387584 _____ () C:\rescue2usb.exe
2014-04-22 12:42 - 2014-04-22 12:43 - 127231689 _____ (Igor Pavlov) C:\Users\Gast.WhiteBull-PC\Downloads\OTLPENet.exe
2014-04-21 14:15 - 2010-08-19 19:22 - 00409600 _____ (Kaspersky Lab ZAO) C:\Users\Gast.WhiteBull-PC\Desktop\rescue2usb.exe
2014-04-21 13:36 - 2014-04-21 13:36 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\InfraRecorder
2014-04-21 13:33 - 2014-04-21 13:33 - 04151536 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\ir053.exe
2014-04-21 13:12 - 2014-04-21 13:12 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-04-21 13:10 - 2014-04-21 13:10 - 00000000 ____D () C:\ProgramData\AVG
2014-04-21 13:09 - 2014-04-21 13:09 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-04-21 12:43 - 2014-04-21 12:43 - 00000364 _____ () C:\Windows\Tasks\AdobeAAMUpdater-1.0-WhiteBull-PC-WhiteBull.job
2014-04-21 10:10 - 2014-04-21 10:13 - 00000000 ____D () C:\ProgramData\Kaspersky Lab Setup Files
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\OLEPRO32.DLL
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\nvspcap.dll
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\nvd3dum.dll
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\nvapi.dll
2014-04-21 09:43 - 2014-04-21 09:43 - 00000010 _____ () C:\Users\Gast.WhiteBull-PC\AppData\Local\sponge.last.runtime.cache
2014-04-21 09:41 - 2014-04-21 09:41 - 02467424 _____ (Trend Micro Inc.) C:\Users\Gast.WhiteBull-PC\Downloads\HousecallLauncher64.exe
2014-04-21 09:41 - 2014-04-21 09:41 - 00000036 _____ () C:\Users\Gast.WhiteBull-PC\AppData\Local\housecall.guid.cache
2014-04-21 09:41 - 2013-09-02 09:58 - 00175528 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys
2014-04-21 09:23 - 2014-04-22 11:50 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\QuickScan
2014-04-18 11:47 - 2014-04-18 11:47 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Apple Computer
2014-04-18 11:42 - 2014-04-18 11:43 - 138607664 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\avira_free_antivirus_de_14.0.3.350.exe
2014-04-18 11:31 - 2014-04-18 11:31 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Leadertech
2014-04-18 11:30 - 2014-04-26 15:04 - 00000000 ___RD () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-18 11:30 - 2014-04-18 11:30 - 04147600 _____ ($Co_Name Inc.) C:\Users\Gast.WhiteBull-PC\Downloads\unifying250.exe
2014-04-18 11:30 - 2014-04-18 11:30 - 03672832 _____ (Logitech Inc.) C:\Users\Gast.WhiteBull-PC\Downloads\setpoint6.61.15_smart.exe
2014-04-18 11:30 - 2014-04-18 11:30 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Logishrd
2014-04-18 11:02 - 2014-04-18 11:02 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\Documents\ProcAlyzer Dumps
2014-04-18 10:57 - 2014-04-18 10:57 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Sony Corporation
2014-04-18 10:47 - 2014-04-18 10:47 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Packages
2014-04-18 10:47 - 2014-04-18 10:47 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Comodo
2014-04-18 10:33 - 2014-04-16 17:52 - 00000924 _____ () C:\Windows\system32\Drivers\etc\hosts.20140418-103332.backup
2014-04-18 09:07 - 2014-04-18 09:07 - 00000000 ____D () C:\ProgramData\YTD Video Downloader
2014-04-18 09:05 - 2014-04-18 09:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YTD Video Downloader
2014-04-16 21:55 - 2014-04-16 21:55 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\TuneUp Software
2014-04-16 21:54 - 2014-04-16 21:55 - 00000000 ____D () C:\ProgramData\AVG2014
2014-04-16 21:51 - 2014-04-17 06:13 - 00000000 ____D () C:\ProgramData\MFAData
2014-04-16 21:51 - 2014-04-16 21:51 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\MFAData
2014-04-16 21:09 - 2014-04-16 21:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-16 18:29 - 2014-04-16 22:04 - 00000000 ____D () C:\Program Files (x86)\My PCBackup Removal Tool
2014-04-16 18:29 - 2013-11-05 14:38 - 01122304 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\SysWOW64\libeay32.dll
2014-04-16 18:29 - 2013-11-05 14:38 - 00274432 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\SysWOW64\ssleay32.dll
2014-04-16 18:29 - 2012-12-10 11:04 - 00356352 _____ (eSellerate Inc.) C:\Windows\eSellerateEngine.dll
2014-04-16 18:29 - 2012-12-10 11:04 - 00081920 _____ (eSellerate Inc.) C:\Windows\eSellerateControl350.dll
2014-04-16 17:53 - 2014-04-16 22:06 - 00012056 _____ () C:\Windows\system32\Drivers\kgpcpy.cfg
2014-04-16 17:53 - 2014-04-16 18:09 - 00000000 _____ () C:\Windows\system32\Drivers\kgpfr2.cfg
2014-04-16 17:53 - 2014-04-16 17:53 - 00000128 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-04-16 17:51 - 2014-04-16 22:10 - 00000000 ____D () C:\Program Files (x86)\STOPzilla!
2014-04-16 17:51 - 2014-04-16 17:52 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\WhiteBull\Downloads\spybot-2.2.exe
2014-04-16 13:22 - 2014-04-16 13:22 - 00000000 _____ () C:\autoexec.bat
2014-04-16 10:44 - 2014-04-16 10:44 - 00000000 ____D () C:\Windows\ERUNT
2014-04-15 22:32 - 2014-04-15 22:32 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Gast.WhiteBull-PC\Downloads\spybot-2.2.exe
2014-04-15 21:57 - 2014-04-23 12:19 - 00043520 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2014-04-15 21:57 - 2014-04-15 21:57 - 00000000 ____D () C:\Windows\system32\log
2014-04-15 21:09 - 2014-04-28 19:31 - 00000000 ____D () C:\AdwCleaner
2014-04-10 20:50 - 2014-04-10 20:50 - 00993720 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\setup (1).exe
2014-04-09 18:17 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 18:17 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 18:17 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-09 18:17 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-09 18:17 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:17 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 18:17 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 18:17 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 18:17 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 18:17 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 18:17 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 18:17 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 18:17 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 18:17 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 18:17 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 18:17 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:17 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:17 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:17 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:17 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 18:17 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-08 21:04 - 2014-04-08 21:04 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\GalileoPress
2014-04-08 20:30 - 2013-07-11 12:53 - 00307200 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Gast.WhiteBull-PC\Downloads\setup.exe
2014-04-06 11:21 - 2014-04-06 11:21 - 00489837 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\Services_Installer_2.3.1.zip
2014-04-05 11:15 - 2014-04-21 13:43 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\vlc
2014-04-05 09:17 - 2014-04-05 09:17 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Macromedia
2014-04-05 09:15 - 2014-04-05 09:16 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Mozilla
2014-04-05 09:15 - 2014-04-05 09:16 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Mozilla
2014-04-05 09:15 - 2014-04-05 09:15 - 00001119 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-04-05 09:15 - 2014-04-05 09:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-05 07:18 - 2014-04-05 07:18 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Realtime Soft
2014-04-03 21:00 - 2014-04-03 21:00 - 00000000 ____H () C:\Users\Gast.WhiteBull-PC\Documents\Default.rdp

==================== One Month Modified Files and Folders =======

2014-05-01 20:38 - 2014-05-01 20:37 - 00020780 _____ () C:\Users\WhiteBull\Downloads\FRST.txt
2014-05-01 20:37 - 2014-05-01 20:37 - 00000000 ____D () C:\FRST
2014-05-01 20:36 - 2014-05-01 20:36 - 02061824 _____ (Farbar) C:\Users\WhiteBull\Downloads\FRST64.exe
2014-05-01 20:35 - 2009-07-14 06:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-01 20:35 - 2009-07-14 06:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-01 20:31 - 2012-01-12 20:10 - 01077280 _____ () C:\Windows\WindowsUpdate.log
2014-05-01 20:28 - 2012-08-18 08:52 - 00000439 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-05-01 20:27 - 2014-04-26 08:13 - 00003080 _____ () C:\Windows\setupact.log
2014-05-01 20:26 - 2014-04-26 13:40 - 00008746 _____ () C:\Windows\PFRO.log
2014-05-01 20:26 - 2012-01-12 21:47 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-01 20:26 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-01 20:19 - 2012-12-12 13:58 - 00000000 ____D () C:\Users\WhiteBull\Documents\My Digital Editions
2014-05-01 20:19 - 2012-01-13 17:46 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-01 19:55 - 2012-01-12 22:40 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-01 19:53 - 2014-05-01 19:50 - 00052608 _____ () C:\Users\WhiteBull\Adobe Creative Suite Cleaner Tool.log
2014-05-01 19:50 - 2012-01-12 20:20 - 00000000 ____D () C:\Users\WhiteBull
2014-05-01 19:49 - 2014-05-01 19:49 - 08098376 _____ () C:\Users\WhiteBull\Downloads\adobe_creative_suite_6cleaner_tool.zip
2014-05-01 16:45 - 2012-01-13 17:39 - 00000000 ____D () C:\Users\WhiteBull\AppData\Local\Adobe
2014-05-01 15:44 - 2012-06-16 19:04 - 00007680 _____ () C:\Users\WhiteBull\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-01 15:01 - 2014-05-01 11:00 - 00000284 _____ () C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2014-05-01 14:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-01 13:16 - 2012-10-02 21:03 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\UseNeXT
2014-05-01 11:11 - 2014-05-01 10:59 - 00000292 _____ () C:\Windows\Tasks\RegClean Pro_UPDATES.job
2014-05-01 11:09 - 2014-05-01 11:08 - 00000000 ____D () C:\Windows\system32\config\RCCBakup
2014-05-01 11:06 - 2014-05-01 10:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro
2014-05-01 11:05 - 2014-05-01 10:59 - 00000000 ____D () C:\Program Files (x86)\RegClean Pro
2014-05-01 11:00 - 2014-05-01 11:00 - 00002894 _____ () C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2014-05-01 10:59 - 2014-05-01 10:59 - 04853880 _____ (Systweak Inc ) C:\Users\WhiteBull\Downloads\rcpsetup_2005.exe
2014-05-01 10:59 - 2014-05-01 10:59 - 00003050 _____ () C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2014-05-01 10:59 - 2014-05-01 10:59 - 00001014 _____ () C:\Users\Public\Desktop\RegClean Pro.lnk
2014-05-01 10:59 - 2014-05-01 10:59 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\systweak
2014-05-01 09:02 - 2013-09-28 23:50 - 00025723 _____ () C:\Users\WhiteBull\Documents\DxO Logging Name.log
2014-05-01 08:37 - 2014-05-01 08:37 - 00000000 ____D () C:\Users\WhiteBull\Documents\HDR Expose 3
2014-05-01 08:37 - 2014-05-01 08:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HDR Expose 3
2014-05-01 08:37 - 2014-05-01 08:37 - 00000000 ____D () C:\Program Files\Common Files\UCT
2014-05-01 08:36 - 2014-05-01 08:36 - 00000000 ____D () C:\Program Files\UCT
2014-05-01 08:33 - 2014-05-01 08:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photomatix Pro 4.1
2014-05-01 08:33 - 2012-06-16 08:24 - 00000000 ____D () C:\Program Files\PhotomatixPro4
2014-04-30 22:35 - 2012-06-30 07:12 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\vlc
2014-04-30 18:37 - 2012-01-12 21:09 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\DisplayFusion
2014-04-30 18:36 - 2010-11-21 08:50 - 00703214 _____ () C:\Windows\system32\perfh007.dat
2014-04-30 18:36 - 2010-11-21 08:50 - 00150822 _____ () C:\Windows\system32\perfc007.dat
2014-04-30 18:36 - 2009-07-14 07:13 - 01629372 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-29 19:06 - 2014-04-29 19:06 - 00000000 ____D () C:\Program Files (x86)\GreenTree Applications
2014-04-28 21:47 - 2014-04-28 21:47 - 00000122 ___RH () C:\Users\WhiteBull\Downloads\Stinger.opt
2014-04-28 21:47 - 2014-04-28 19:50 - 00001160 _____ () C:\Users\WhiteBull\Downloads\Stinger_28042014_195034.html
2014-04-28 21:47 - 2014-04-28 19:49 - 00000000 ____D () C:\Program Files (x86)\stinger
2014-04-28 19:57 - 2012-01-12 22:40 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 19:57 - 2012-01-12 22:40 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 19:57 - 2012-01-12 22:40 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-28 19:49 - 2014-04-28 19:49 - 10642280 _____ (McAfee Inc) C:\Users\WhiteBull\Downloads\stinger32.exe
2014-04-28 19:48 - 2014-04-28 19:08 - 00000118 ___RH () C:\Users\WhiteBull\Desktop\Stinger.opt
2014-04-28 19:48 - 2014-04-22 15:53 - 00000000 ____D () C:\Program Files\stinger
2014-04-28 19:42 - 2014-04-28 19:42 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\WhiteBull\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-28 19:31 - 2014-04-15 21:09 - 00000000 ____D () C:\AdwCleaner
2014-04-28 19:29 - 2014-04-28 19:29 - 01310283 _____ () C:\Users\WhiteBull\Downloads\adwcleaner.exe
2014-04-28 19:09 - 2014-04-23 13:01 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\MD5 File Hasher
2014-04-28 18:27 - 2014-04-25 18:16 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-28 18:19 - 2014-04-26 12:28 - 00010798 _____ () C:\Users\WhiteBull\Desktop\hijackthis.log
2014-04-28 18:02 - 2014-04-28 18:02 - 11825832 _____ (Elex do Brasil Participações Ltda) C:\Users\WhiteBull\Downloads\yet_another_cleaner_sk.exe
2014-04-28 18:02 - 2014-03-22 17:54 - 00007603 _____ () C:\Users\WhiteBull\AppData\Local\Resmon.ResmonCfg
2014-04-27 22:56 - 2013-03-05 21:17 - 00001456 _____ () C:\Users\WhiteBull\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-04-26 15:04 - 2014-04-18 11:30 - 00000000 ___RD () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-26 15:04 - 2014-03-22 18:01 - 00000000 ____D () C:\Windows\pss
2014-04-26 13:27 - 2014-04-26 13:27 - 00000302 _____ () C:\Windows\Tasks\Systweak Support Dock.job
2014-04-26 13:27 - 2014-04-26 13:27 - 00000000 ____D () C:\Program Files (x86)\Amazon
2014-04-26 13:25 - 2014-03-29 19:36 - 00000444 __RSH () C:\ProgramData\ntuser.pol
2014-04-26 13:20 - 2013-12-24 20:44 - 00000000 ____D () C:\Users\WhiteBull\AppData\Local\cache
2014-04-26 13:18 - 2014-04-26 13:18 - 00000366 _____ () C:\Windows\Tasks\VStart{A37B472A-8335-449F-9568-43ECC2907F06}.job
2014-04-26 12:53 - 2014-04-26 12:53 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-26 12:28 - 2014-04-26 12:28 - 00388608 _____ (Trend Micro Inc.) C:\Users\WhiteBull\Desktop\HiJackThis204.exe
2014-04-26 08:13 - 2014-04-26 08:13 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-25 21:24 - 2014-04-25 21:24 - 00000000 ____D () C:\Users\Public\Documents\Ashampoo
2014-04-25 21:23 - 2014-04-25 21:23 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ashampoo
2014-04-25 21:23 - 2013-07-12 09:54 - 00000000 ____D () C:\Program Files (x86)\Ashampoo
2014-04-25 21:08 - 2014-03-22 19:18 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\UseNeXT
2014-04-25 21:08 - 2014-03-22 18:47 - 00000000 __SHD () C:\ProgramData\NT Kernel
2014-04-25 21:08 - 2014-03-17 21:46 - 00000000 __SHD () C:\Windows\SysWOW64\NT Kernel
2014-04-25 21:08 - 2014-03-05 08:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-25 21:08 - 2013-08-11 15:08 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\Icfe
2014-04-25 21:08 - 2013-02-05 22:08 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\Opuxpe
2014-04-25 21:08 - 2012-11-30 13:31 - 00000000 ____D () C:\Program Files (x86)\Vertus Fluid Mask 3
2014-04-25 21:08 - 2012-08-29 07:28 - 00000000 ____D () C:\Program Files (x86)\SonyEditor
2014-04-25 20:43 - 2014-04-25 20:43 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\URSoft
2014-04-25 20:16 - 2014-03-22 13:48 - 00000000 ____D () C:\Users\WhiteBull\Desktop\alt.binaries.comp
2014-04-25 19:25 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-25 18:37 - 2014-01-01 21:20 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\Winamp
2014-04-25 18:37 - 2012-01-13 18:49 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\DAEMON Tools Pro
2014-04-25 18:36 - 2012-01-12 20:05 - 00000000 ____D () C:\Windows\Panther
2014-04-25 18:32 - 2014-04-25 18:32 - 00187462 _____ () C:\Users\WhiteBull\Documents\cc_20140425_183241.reg
2014-04-25 18:16 - 2014-04-25 18:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-04-25 13:15 - 2012-01-13 18:49 - 00000000 ____D () C:\ProgramData\DAEMON Tools Pro
2014-04-25 13:06 - 2014-04-25 13:06 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2014-04-25 13:06 - 2014-04-25 13:04 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Pro
2014-04-25 13:04 - 2014-04-25 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Pro
2014-04-25 12:57 - 2012-01-13 18:50 - 00386680 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys
2014-04-24 08:24 - 2014-04-23 11:27 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-04-24 07:54 - 2014-04-24 07:54 - 00000000 ___RD () C:\Users\WhiteBull\Creative Cloud Files
2014-04-24 01:29 - 2014-03-22 22:52 - 00000000 ____D () C:\Windows Services
2014-04-24 01:28 - 2013-01-01 23:12 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\Ryydur
2014-04-24 01:22 - 2013-01-25 21:15 - 00000000 ____D () C:\Program Files (x86)\Portrait Professional Studio 10
2014-04-23 14:18 - 2014-04-23 14:16 - 398690304 _____ () C:\Users\WhiteBull\Downloads\kav_rescue_10.iso
2014-04-23 13:01 - 2014-04-23 13:01 - 02443152 _____ (Digital-Tronic ) C:\Users\WhiteBull\Downloads\MD5FileHasher_Setup.exe
2014-04-23 13:01 - 2014-04-23 13:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MD5 File Hasher
2014-04-23 13:01 - 2014-04-23 13:01 - 00000000 ____D () C:\Program Files (x86)\MD5 File Hasher
2014-04-23 12:19 - 2014-04-15 21:57 - 00043520 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2014-04-23 11:16 - 2014-04-22 18:32 - 00000000 ____D () C:\ProgramData\Weibbing
2014-04-23 11:02 - 2014-04-22 18:32 - 00000000 ____D () C:\Program Files (x86)\Weibbing
2014-04-23 11:02 - 2014-03-16 15:16 - 00000000 ____D () C:\ProgramData\4771994fd3ae8c18
2014-04-23 09:43 - 2014-04-23 09:02 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\ImgBurn
2014-04-23 09:03 - 2014-04-23 09:02 - 127631360 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\avg_arl_cdi_all_120_140203a7055.iso
2014-04-23 08:56 - 2014-04-23 08:56 - 03469871 _____ (LIGHTNING UK!) C:\Users\Gast.WhiteBull-PC\Downloads\SetupImgBurn_2.5.8.0.exe
2014-04-23 08:25 - 2014-03-22 19:18 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\Documents\UseNeXT
2014-04-23 08:05 - 2014-04-23 08:05 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\DAEMON Tools Lite
2014-04-23 08:05 - 2014-04-23 08:05 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2014-04-22 22:51 - 2014-04-22 22:49 - 398645248 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\kav_rescue_10.iso
2014-04-22 22:36 - 2014-04-22 22:36 - 04831744 _____ (Geza Kovacs) C:\Users\Gast.WhiteBull-PC\Downloads\unetbootin-windows-603.exe
2014-04-22 22:19 - 2014-04-22 22:19 - 00387584 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\rescue2usb1007.exe
2014-04-22 21:33 - 2014-04-22 21:33 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\Downloads\AVG
2014-04-22 21:02 - 2014-04-22 20:48 - 171589000 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\kav_rescue_1032.iso
2014-04-22 19:39 - 2014-04-22 19:39 - 00185944 _____ (Лаборатория Касперского) C:\Users\Gast.WhiteBull-PC\Downloads\kss12.0.1.117abRU_EN_DE_FR_ES_IT_JA_PT_ZH_5623 (1).exe
2014-04-22 18:33 - 2014-03-16 15:23 - 00000000 ____D () C:\ProgramData\NextCCouup
2014-04-22 18:32 - 2014-03-19 21:35 - 01613640 _____ () C:\Windows\SysWOW64\setup.exe
2014-04-22 18:32 - 2014-03-16 15:23 - 00000000 ____D () C:\Program Files (x86)\NextCCouup
2014-04-22 16:41 - 2014-03-17 21:46 - 00171224 _____ () C:\Users\WhiteBull\AppData\Roaming\msconfig.ini
2014-04-22 16:36 - 2014-03-22 22:52 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\Windows Services
2014-04-22 16:14 - 2014-03-22 22:52 - 00000063 _____ () C:\Users\WhiteBull\AppData\Roaming\install.imp
2014-04-22 15:56 - 2014-04-22 15:56 - 00000000 ____D () C:\Quarantine
2014-04-22 15:53 - 2014-04-22 15:53 - 11575313 _____ () C:\Users\WhiteBull\Downloads\stinger64-epo.zip
2014-04-22 15:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-22 14:25 - 2014-03-22 22:52 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\imlgs
2014-04-22 13:06 - 2014-04-22 13:06 - 00387584 _____ () C:\rescue2usb.exe
2014-04-22 12:43 - 2014-04-22 12:42 - 127231689 _____ (Igor Pavlov) C:\Users\Gast.WhiteBull-PC\Downloads\OTLPENet.exe
2014-04-22 12:14 - 2014-04-22 16:13 - 11583848 ____N (McAfee Inc) C:\Users\WhiteBull\Desktop\stinger.exe
2014-04-22 11:50 - 2014-04-21 09:23 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\QuickScan
2014-04-21 13:43 - 2014-04-05 11:15 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\vlc
2014-04-21 13:36 - 2014-04-21 13:36 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\InfraRecorder
2014-04-21 13:33 - 2014-04-21 13:33 - 04151536 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\ir053.exe
2014-04-21 13:12 - 2014-04-21 13:12 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-04-21 13:10 - 2014-04-21 13:10 - 00000000 ____D () C:\ProgramData\AVG
2014-04-21 13:09 - 2014-04-21 13:09 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-04-21 12:43 - 2014-04-21 12:43 - 00000364 _____ () C:\Windows\Tasks\AdobeAAMUpdater-1.0-WhiteBull-PC-WhiteBull.job
2014-04-21 12:43 - 2012-01-13 17:49 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2014-04-21 10:13 - 2014-04-21 10:10 - 00000000 ____D () C:\ProgramData\Kaspersky Lab Setup Files
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\OLEPRO32.DLL
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\nvspcap.dll
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\nvd3dum.dll
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\nvapi.dll
2014-04-21 09:43 - 2014-04-21 09:43 - 00000010 _____ () C:\Users\Gast.WhiteBull-PC\AppData\Local\sponge.last.runtime.cache
2014-04-21 09:41 - 2014-04-21 09:41 - 02467424 _____ (Trend Micro Inc.) C:\Users\Gast.WhiteBull-PC\Downloads\HousecallLauncher64.exe
2014-04-21 09:41 - 2014-04-21 09:41 - 00000036 _____ () C:\Users\Gast.WhiteBull-PC\AppData\Local\housecall.guid.cache
2014-04-18 11:47 - 2014-04-18 11:47 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Apple Computer
2014-04-18 11:47 - 2014-03-23 09:12 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Apple Computer
2014-04-18 11:47 - 2013-11-02 08:54 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-18 11:43 - 2014-04-18 11:42 - 138607664 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\avira_free_antivirus_de_14.0.3.350.exe
2014-04-18 11:31 - 2014-04-18 11:31 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Leadertech
2014-04-18 11:30 - 2014-04-18 11:30 - 04147600 _____ ($Co_Name Inc.) C:\Users\Gast.WhiteBull-PC\Downloads\unifying250.exe
2014-04-18 11:30 - 2014-04-18 11:30 - 03672832 _____ (Logitech Inc.) C:\Users\Gast.WhiteBull-PC\Downloads\setpoint6.61.15_smart.exe
2014-04-18 11:30 - 2014-04-18 11:30 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Logishrd
2014-04-18 11:30 - 2014-03-22 18:16 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Logitech
2014-04-18 11:02 - 2014-04-18 11:02 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\Documents\ProcAlyzer Dumps
2014-04-18 10:57 - 2014-04-18 10:57 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Sony Corporation
2014-04-18 10:47 - 2014-04-18 10:47 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Packages
2014-04-18 10:47 - 2014-04-18 10:47 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Comodo
2014-04-18 10:47 - 2014-03-22 18:13 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Google
2014-04-18 09:07 - 2014-04-18 09:07 - 00000000 ____D () C:\ProgramData\YTD Video Downloader
2014-04-18 09:05 - 2014-04-18 09:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YTD Video Downloader
2014-04-18 09:03 - 2014-03-17 21:43 - 00000000 ____D () C:\Users\WhiteBull\Desktop\wizard
2014-04-17 06:13 - 2014-04-16 21:51 - 00000000 ____D () C:\ProgramData\MFAData
2014-04-16 22:10 - 2014-04-16 17:51 - 00000000 ____D () C:\Program Files (x86)\STOPzilla!
2014-04-16 22:06 - 2014-04-16 17:53 - 00012056 _____ () C:\Windows\system32\Drivers\kgpcpy.cfg
2014-04-16 22:04 - 2014-04-16 18:29 - 00000000 ____D () C:\Program Files (x86)\My PCBackup Removal Tool
2014-04-16 21:55 - 2014-04-16 21:55 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\TuneUp Software
2014-04-16 21:55 - 2014-04-16 21:54 - 00000000 ____D () C:\ProgramData\AVG2014
2014-04-16 21:51 - 2014-04-16 21:51 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\MFAData
2014-04-16 21:09 - 2014-04-16 21:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-16 18:09 - 2014-04-16 17:53 - 00000000 _____ () C:\Windows\system32\Drivers\kgpfr2.cfg
2014-04-16 17:55 - 2013-04-06 14:53 - 00000000 ____D () C:\Windows\Minidump
2014-04-16 17:54 - 2014-01-02 09:20 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-04-16 17:53 - 2014-04-16 17:53 - 00000128 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-04-16 17:52 - 2014-04-18 10:33 - 00000924 _____ () C:\Windows\system32\Drivers\etc\hosts.20140418-103332.backup
2014-04-16 17:52 - 2014-04-16 17:51 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\WhiteBull\Downloads\spybot-2.2.exe
2014-04-16 17:51 - 2014-01-02 09:20 - 00000000 ____D () C:\Users\Gast
2014-04-16 17:51 - 2014-01-02 09:20 - 00000000 ____D () C:\Users\Administrator
2014-04-16 17:14 - 2014-03-22 18:16 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Adobe
2014-04-16 13:22 - 2014-04-16 13:22 - 00000000 _____ () C:\autoexec.bat
2014-04-16 10:44 - 2014-04-16 10:44 - 00000000 ____D () C:\Windows\ERUNT
2014-04-15 22:32 - 2014-04-15 22:32 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Gast.WhiteBull-PC\Downloads\spybot-2.2.exe
2014-04-15 21:57 - 2014-04-15 21:57 - 00000000 ____D () C:\Windows\system32\log
2014-04-15 21:30 - 2012-01-13 17:31 - 00000000 ___RD () C:\Users\WhiteBull\Dropbox
2014-04-15 21:30 - 2012-01-13 17:28 - 00000000 ____D () C:\Users\WhiteBull\AppData\Roaming\Dropbox
2014-04-15 16:57 - 2014-03-22 18:16 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Adobe
2014-04-14 04:24 - 2014-04-26 12:53 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-04-26 12:53 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-13 07:21 - 2009-07-14 06:45 - 05336760 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-12 17:41 - 2012-01-12 21:09 - 00204952 _____ () C:\Users\WhiteBull\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-12 15:45 - 2014-03-22 18:14 - 00204952 _____ () C:\Users\Gast.WhiteBull-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-12 15:44 - 2012-11-12 22:49 - 00001075 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
2014-04-12 15:43 - 2012-11-12 22:48 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
2014-04-12 15:42 - 2012-01-13 17:48 - 00001037 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
2014-04-12 15:41 - 2012-11-12 22:47 - 00001129 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
2014-04-12 15:39 - 2012-11-12 22:44 - 00001313 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
2014-04-12 15:39 - 2012-01-13 17:46 - 00001479 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
2014-04-12 12:05 - 2014-03-29 16:03 - 00001112 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC (64 Bit).lnk
2014-04-10 20:50 - 2014-04-10 20:50 - 00993720 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\setup (1).exe
2014-04-09 21:50 - 2013-07-25 16:08 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 21:48 - 2012-06-16 09:25 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 21:45 - 2012-01-13 17:48 - 00000000 ____D () C:\Program Files\Adobe
2014-04-08 21:04 - 2014-04-08 21:04 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\GalileoPress
2014-04-06 11:21 - 2014-04-06 11:21 - 00489837 _____ () C:\Users\Gast.WhiteBull-PC\Downloads\Services_Installer_2.3.1.zip
2014-04-05 09:17 - 2014-04-05 09:17 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Macromedia
2014-04-05 09:16 - 2014-04-05 09:15 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Roaming\Mozilla
2014-04-05 09:16 - 2014-04-05 09:15 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Mozilla
2014-04-05 09:15 - 2014-04-05 09:15 - 00001119 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-04-05 09:15 - 2014-04-05 09:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-05 07:18 - 2014-04-05 07:18 - 00000000 ____D () C:\Users\Gast.WhiteBull-PC\AppData\Local\Realtime Soft
2014-04-03 21:00 - 2014-04-03 21:00 - 00000000 ____H () C:\Users\Gast.WhiteBull-PC\Documents\Default.rdp
2014-04-02 18:50 - 2012-11-05 20:46 - 00000000 ____D () C:\Users\WhiteBull\Documents\Outlook-Dateien
2014-04-02 18:37 - 2012-12-02 11:49 - 00000000 ____D () C:\Users\WhiteBull\AppData\Local\2741EED0-6DC1-4A26-87E7-B9D4EB9170DE.aplzod

Files to move or delete:
====================
C:\Users\WhiteBull\AppData\Roaming\msconfig.ini


Some content of TEMP:
====================
C:\Users\WhiteBull\AppData\Local\Temp\ICReinstall_nsvFA3.tmp.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-01 14:30

==================== End Of Log ============================
--- --- ---
Addition.Txt Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-05-2014 01
Ran by WhiteBull at 2014-05-01 20:38:43
Running from C:\Users\WhiteBull\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.4 64-bit (HKLM\...\{558B5965-CC1B-4AF1-BA07-5D6832404050}) (Version: 5.4.0 - Adobe Systems Incorporated)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Ashampoo UnInstaller 5 v.5.00 (HKLM-x32\...\Ashampoo UnInstaller 5_is1) (Version: 5.0.0 - Ashampoo GmbH & Co. KG)
AVG PC TuneUp 2014 (de-DE) (x32 Version: 14.0.1001.204 - AVG) Hidden
AVG PC TuneUp 2014 (x32 Version: 14.0.1001.204 - AVG) Hidden
Canon MG5100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 4.08 - Piriform)
DAEMON Tools Pro (HKLM-x32\...\DAEMON Tools Pro) (Version: 5.4.0.0377 - Disc Soft Ltd)
Dfx (HKLM\...\Tiffen-Dfx 3.0) (Version: 3.0 - Tiffen)
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
DxO FilmPack 4 (HKLM\...\{E3EA84E1-2CC5-479F-8A5F-DFFF619E58D8}) (Version: 4.5.59.0 - DxO Labs)
DxO Optics Pro 9 (HKLM\...\{818C05A3-9CB3-4A28-B8AA-B595A352DDA8}) (Version: 9.1.2 - DxO Labs)
DxO ViewPoint 2 (HKLM\...\{5602DC38-848F-42BD-B764-4BE48E9E7623}) (Version: 2.1.15.0 - DxO Labs)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
HDR Expose 3 (HKLM-x32\...\HDR Expose 3) (Version: 3.0.3.10714 - UCT)
iCloud (HKLM\...\{EAFB2AD8-D92B-464C-8D97-B9CB94703C4A}) (Version: 3.0.2.163 - Apple Inc.)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{4327107B-E95E-415C-9194-458FCED6BF12}) (Version: 13.03.0000 - Intel Corporation)
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Logitech SetPoint 6.61 (HKLM\...\sp6) (Version: 6.61.15 - Logitech)
MD5 File Hasher 1.4 (HKLM-x32\...\MD5 File Hasher_is1) (Version: - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
NVIDIA 3D Vision Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 334.89 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.147.1067 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 334.89 (Version: 334.89 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Photomatix Pro version 4.1.3 (HKLM\...\PhotomatixPro41x64_is1) (Version: 4.1.3 - HDRsoft Sarl)
RegClean Pro (HKLM-x32\...\RegClean Pro_is1) (Version: 6.21 - Systweak Inc) <==== ATTENTION
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
UltraMon (HKLM\...\{537056B7-32A4-4408-9B54-0341963C7C9C}) (Version: 3.1.0 - Realtime Soft Ltd)
VLC media player 2.0.2 (HKLM\...\VLC media player) (Version: 2.0.2 - VideoLAN)
Wacom Tablett (HKLM\...\Wacom Tablet Driver) (Version: 6.3.7-6 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.3 - Wacom Technology Corp.)
WIDCOMM Bluetooth Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.2350 - Broadcom Corporation)
Windows-Treiberpaket - Leaf Imaging Ltd. Image (02/11/2010 ) (HKLM\...\A35BD68D4A1B3E191138E3C9AA417190A9468F7E) (Version: 02/11/2010 - Leaf Imaging Ltd.)
WinRAR 4.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.10.0 - win.rar GmbH)
WinZip 16.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CD}) (Version: 16.0.9715 - WinZip Computing, S.L. )
YTD Video Downloader 4.7.2 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.7.2 - GreenTree Applications SRL)

==================== Restore Points =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2014-04-18 10:33 - 00450809 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 acdid.acdsystems.com
127.0.0.1 activate.adobe.com
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {01BDD487-7C17-4FCB-8AEA-ACC4F1DB8091} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {1C26E7D7-995C-423D-9C7C-9C61D36CFE3D} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2014-01-03] (Systweak Inc) <==== ATTENTION
Task: {3D8D817F-4B88-4276-A723-BBB1C9DF23A9} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe
Task: {431BC603-6077-4336-B8EB-8FFF85792CAA} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {48F142CC-1901-4AB6-AC85-994F07AF59A0} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2014-01-03] (Systweak Inc) <==== ATTENTION
Task: {4B82F02A-74F9-4E5C-9857-C7EC9DC77F84} - \SpyHunter4Startup No Task File <==== ATTENTION
Task: {62A13D32-F7B9-49CC-A84D-7763F46A0E09} - System32\Tasks\{1A7095F5-56C4-40B2-A346-38A0BF735292} => C:\Program Files (x86)\Portrait Professional Studio 9\PortraitProfessionalStudio.exe
Task: {66B36E5B-518D-4518-A7CA-3295721032D0} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {6959051C-2C8C-474E-B9F2-8856113A0C04} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {7AB02E98-18F1-4052-A837-62516DFD6F18} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28] (Adobe Systems Incorporated)
Task: {817523C2-CDF3-4E40-AFB6-5AD603C73503} - System32\Tasks\ArcSoft Connect Daemon => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
Task: {9B8634DA-CC6C-482C-B926-C2789B064D14} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {AC90BBB0-E9CA-4DD3-8A09-58D6C195CB9F} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03] (Sun Microsystems, Inc.)
Task: {C5C7C440-4954-4FA9-B57E-A45BFFE90BBB} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {DD40E844-96D0-4D6B-9795-BCD761A8A1FE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {E4A5611B-423E-425B-96ED-4DFA95BE73F9} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {F00AC150-953F-4601-90B5-8A7168C83466} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {F93905D4-0F14-4F82-B5E0-6532E2410390} - System32\Tasks\AdobeAAMUpdater-1.0-WhiteBull-PC-WhiteBull => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-02-27] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AdobeAAMUpdater-1.0-WhiteBull-PC-WhiteBull.job => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf386ecdfd4121.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\Systweak Support Dock.job => C:\Program Files (x86)\Systweak Support Dock\SystweakDock.exe
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012.job => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe
Task: C:\Windows\Tasks\VStart{A37B472A-8335-449F-9568-43ECC2907F06}.job => C:\Users\WHITEB~1\AppData\Local\Temp\nseCE39.tmp\v-bates.exe

==================== Loaded Modules (whitelisted) =============

2010-07-19 17:48 - 2010-07-19 17:48 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2012-01-12 21:47 - 2014-02-08 19:42 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-03-20 12:24 - 2014-03-20 12:24 - 00667808 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
2014-01-15 20:04 - 2013-12-04 18:35 - 01185048 _____ () C:\Program Files\Tablet\Wacom\libxml2.dll
2013-10-13 17:53 - 2013-10-13 17:53 - 00065656 _____ () C:\Program Files\UCT\HDR Expose 3\HDRExpose3Service.exe
2012-11-11 13:09 - 2010-04-05 21:55 - 00116104 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-29 14:48 - 2014-03-15 02:50 - 00051016 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll
2014-03-29 14:48 - 2014-03-15 02:50 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libglesv2.dll
2014-03-29 14:48 - 2014-03-15 02:50 - 00100168 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libegl.dll
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\nvd3dum.dll
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\nvspcap.dll
2014-04-21 09:55 - 2014-04-21 09:55 - 00000000 _____ () C:\Windows\system32\nvapi.dll
2014-03-29 14:48 - 2014-03-15 02:50 - 04061000 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll
2014-03-29 14:48 - 2014-03-15 02:50 - 00394568 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll
2014-03-29 14:48 - 2014-03-15 02:50 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll
2014-03-29 14:48 - 2014-03-15 02:50 - 13637448 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\ProgramData\Microsoft:36ReCdDGzGgfMlqDZCdtu
AlternateDataStreams: C:\ProgramData\Microsoft:g3Lal27bZj1OM18z7IJQ
AlternateDataStreams: C:\ProgramData\Microsoft:KplWQ4xR4ieEuWDz2py6xr
AlternateDataStreams: C:\ProgramData\Nalpeiron:user.ns1
AlternateDataStreams: C:\ProgramData\Nalpeiron:user.ns2
AlternateDataStreams: C:\ProgramData\Nalpeiron:user.ns3
AlternateDataStreams: C:\ProgramData\Nalpeiron:user.ns4
AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51
AlternateDataStreams: C:\Users\WhiteBull\Cookies:sE3uDTSPwNcOPmmcvZGYhMjo155S

==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MultiMon Taskbar.lnk => C:\Windows\pss\MultiMon Taskbar.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^UltraMon.lnk => C:\Windows\pss\UltraMon.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Gast.WhiteBull-PC^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk => C:\Windows\pss\Logitech . Produktregistrierung.lnk.Startup
MSCONFIG\startupreg: Adobe Creative Cloud => "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true
MSCONFIG\startupreg: AdobeBridge => "C:\Program Files\Adobe\Adobe Bridge CC (64 Bit)\Bridge.exe" -stealth
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: DAEMON Tools Pro Agent => "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
MSCONFIG\startupreg: MD5 File Hasher => C:\Program Files (x86)\MD5 File Hasher\MD5FileHasher -s
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Qualcomm Gobi 2000
Description: Qualcomm Gobi 2000
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/01/2014 08:27:22 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2014 08:25:51 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (05/01/2014 02:34:08 PM) (Source: Microsoft-Windows-Defrag) (User: )
Description: Volume "SAMSUNG (E" wurde aufgrund eines Fehlers nicht defragmentiert: Der Datenträger wurde vom System getrennt. (0x89000011)

Error: (05/01/2014 11:12:57 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2014 10:24:08 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2014 07:48:09 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2014 07:47:59 AM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]

Error: (05/01/2014 07:47:59 AM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]

Error: (05/01/2014 07:47:59 AM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]

Error: (04/30/2014 05:06:30 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (05/01/2014 08:30:46 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Defender" wurde mit folgendem Fehler beendet:
%%-2147024891

Error: (05/01/2014 08:28:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Defender" wurde mit folgendem Fehler beendet:
%%-2147024891

Error: (05/01/2014 08:27:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "rimspci" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1058

Error: (05/01/2014 06:21:41 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/01/2014 06:21:41 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/01/2014 06:21:41 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/01/2014 06:21:41 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/01/2014 06:21:41 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/01/2014 06:21:41 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/01/2014 06:21:41 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.


Microsoft Office Sessions:
=========================
Error: (05/01/2014 08:27:22 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2014 08:25:51 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe)(User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (05/01/2014 02:34:08 PM) (Source: Microsoft-Windows-Defrag)(User: )
Description: SAMSUNG (EDer Datenträger wurde vom System getrennt. (0x89000011)

Error: (05/01/2014 11:12:57 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2014 10:24:08 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2014 07:48:09 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2014 07:47:59 AM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcNvVAD initialization failed [6]

Error: (05/01/2014 07:47:59 AM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]

Error: (05/01/2014 07:47:59 AM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]

Error: (04/30/2014 05:06:30 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Percentage of memory in use: 32%
Total physical RAM: 6006.88 MB
Available physical RAM: 4038.25 MB
Total Pagefile: 12011.95 MB
Available Pagefile: 9708.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:457.55 GB) (Free:360.76 GB) NTFS
Drive e: (SAMSUNG) (Fixed) (Total:465.76 GB) (Free:249.3 GB) NTFS
Drive g: (SAMSUNG) (Fixed) (Total:931.51 GB) (Free:690.72 GB) NTFS
Drive o: (Samsung) (Fixed) (Total:232.88 GB) (Free:79.5 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 7A695750)
Partition 1: (Not Active) - (Size=8 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=458 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 708717A6)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
Attempted reading MBR returned 0 bytes.
Could not read MBR for disk 7.

========================================================
Disk: 8 (Size: 932 GB) (Disk ID: 2F338B4A)
Partition 1: (Active) - (Size=932 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Nichts weiterhin gemacht. Merci für die Hilfe schonmal vorab
__________________
Alt 01.05.2014, 22:17   #4
Bootsektor
Ruhe in Frieden
† 2019
 
TimeServer.exe - Standard

TimeServer.exe


Hallo Anderl's Pho,

hast du kein Antivirenprogramm auf dem Rechner?
Momentan würde sowieso die Hälfte der Antivirenprogramme auf deinem Rechner nicht laufen.

Ich sehe da grad aktuell keine TimeServer.exe in der Prozessliste, lade dir bitte den ProcessExplorer herunter
Starte ihn mit Rechtsklick als Administrator ausführen und wenn du bemerkst dass die TimeServer.exe wieder läuft, dann schau in die Prozessliste des Prozessexplorers, klicke auf die TimeServer.exe. Gehe auf den Reiter Image und poste mir was dort unter Path und Autostart Direction steht

Schritt 1
Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.
  • Klicke auf Wählen Sie eine
  • Kopiere nun folgendes in die Suchleiste
    Code:
    ATTFilter
    C:\Windows\system32\Drivers\kgpcpy.cfg
  • und klicke auf Öffnen.
  • Klicke auf Scannen!.
  • Warte bitte bis die Datei vollständig hochgeladen wurde. Solltest Du folgende Meldung bekommen
    Zitat:
    Diese Datei wurde bereits von VirusTotal analysiert...
    klicke auf Neu analysieren.
  • Warte bis dir das Analysedatum angezeigt wird und der Scan abgeschlossen ist.
  • Kopiere den Link aus deiner Adresszeile und poste ihn hier.


Schritt 2
Bitte deinstalliere folgende Programme (falls vorhanden) :

RegClean Pro
Dazu gehe auf:
den Windowsbutton in der Taskleiste --> Systemsteuerung --> Programme (Unterpunkt Programme deinstallieren) --> Programm auswählen --> entfernen

Schritt 3

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
IFEO\AvastSvc.exe: [Debugger] nqij.exe
IFEO\AvastUI.exe: [Debugger] nqij.exe
IFEO\avcenter.exe: [Debugger] nqij.exe
IFEO\avconfig.exe: [Debugger] nqij.exe
IFEO\avgcsrvx.exe: [Debugger] nqij.exe
IFEO\avgidsagent.exe: [Debugger] nqij.exe
IFEO\avgnt.exe: [Debugger] nqij.exe
IFEO\avgrsx.exe: [Debugger] nqij.exe
IFEO\avguard.exe: [Debugger] nqij.exe
IFEO\avgui.exe: [Debugger] nqij.exe
IFEO\avgwdsvc.exe: [Debugger] nqij.exe
IFEO\avscan.exe: [Debugger] nqij.exe
IFEO\bdagent.exe: [Debugger] nqij.exe
IFEO\blindman.exe: [Debugger] nqij.exe
IFEO\ccuac.exe: [Debugger] nqij.exe
IFEO\ComboFix.exe: [Debugger] nqij.exe
IFEO\egui.exe: [Debugger] nqij.exe
IFEO\hijackthis.exe: [Debugger] nqij.exe
IFEO\instup.exe: [Debugger] nqij.exe
IFEO\iSafeScan.exe: [Debugger] nqij.exe
IFEO\keyscrambler.exe: [Debugger] nqij.exe
IFEO\mbam.exe: [Debugger] nqij.exe
IFEO\mbamgui.exe: [Debugger] nqij.exe
IFEO\mbampt.exe: [Debugger] nqij.exe
IFEO\mbamscheduler.exe: [Debugger] nqij.exe
IFEO\mbamservice.exe: [Debugger] nqij.exe
IFEO\MpCmdRun.exe: [Debugger] nqij.exe
IFEO\MSASCui.exe: [Debugger] nqij.exe
IFEO\MsMpEng.exe: [Debugger] nqij.exe
IFEO\msseces.exe: [Debugger] nqij.exe
IFEO\rstrui.exe: [Debugger] nqij.exe
IFEO\SDFiles.exe: [Debugger] nqij.exe
IFEO\SDFSSvc.exe: [Debugger] nqij.exe
IFEO\SDMain.exe: [Debugger] nqij.exe
IFEO\SDWinSec.exe: [Debugger] nqij.exe
IFEO\SDWSCSvc.exe: [Debugger] nqij.exe
IFEO\spybotsd.exe: [Debugger] nqij.exe
IFEO\TuneUpUtilitiesApp64.exe: [Debugger] nqij.exe
IFEO\TuneUpUtilitiesService64.exe: [Debugger] nqij.exe
IFEO\wireshark.exe: [Debugger] nqij.exe
IFEO\zlclient.exe: [Debugger] nqij.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Tcpip\..\Interfaces\{AF6B63A0-54E4-46EE-A10B-EAF69F39B59E}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
C:\Windows\SysWOW64\NT Kernel\NTKernel.exe
C:\Users\WhiteBull\Downloads\yet_another_cleaner_sk.exe
C:\Users\WhiteBull\AppData\Roaming\systweak
C:\Users\WhiteBull\AppData\Roaming\Icfe
C:\Users\WhiteBull\AppData\Roaming\Opuxpe
 C:\Users\WhiteBull\AppData\Roaming\Ryydur
C:\Users\WhiteBull\AppData\Roaming\imlgs
lternateDataStreams: C:\ProgramData\Microsoft:36ReCdDGzGgfMlqDZCdtu
AlternateDataStreams: C:\ProgramData\Microsoft:g3Lal27bZj1OM18z7IJQ
AlternateDataStreams: C:\ProgramData\Microsoft:KplWQ4xR4ieEuWDz2py6xr
AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51
AlternateDataStreams: C:\Users\WhiteBull\Cookies:sE3uDTSPwNcOPmmcvZGYhMjo155S
cmd: type C:\Users\WhiteBull\AppData\Roaming\msconfig.ini

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt 4
Starte noch einmal FRST
  • gebe in das Eingabefeld folgendes ein
    Code:
    ATTFilter
    nqij.exe
  • drücke auf search File(s) (mittig unter dem Eingabefeld)
  • FRST erstellt ein Logfile search.txt
  • poste mir dieses

Schritt 5
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.
Alt 02.05.2014, 13:11   #5
Anderl's Pho
 
TimeServer.exe - Standard

TimeServer.exe


Danke das ging ja schnell. Ich muss dazu sagen das ich die Prozesse vom TimeServer.exe im Taskmanager under Prozesse bzw Dienste deaktiviert habe. Zum anderen die Anitvierprogg's bzw zur Entfernung von Malware lassen sich erst gar nicht installieren ( Berechtigung nicht vorhanden) Desweiteren Hatte ich das Problem das in der Systemsteuerung unter Programme deinstallieren einige nicht aufgeführt sind die eigentlich vorhanden sind.. Und ich hatte Tuneup Utillitys drauf ist auch verschwunden..

https://www.virustotal.com/de/file/5ce49beb32aba800c5d035bb4848c21d5c4889a7ef2d6bae33242509c28e8a40/analysis/1399032547/

Scan wurde ausgeführt,weitere Schritte folgen .


Alt 02.05.2014, 13:35   #6
Anderl's Pho
 
TimeServer.exe - Standard

TimeServer.exe


Fixlog ist erstellt.

Alt 02.05.2014, 13:43   #7
Anderl's Pho
 
TimeServer.exe - Standard

TimeServer.exe


Farbar Recovery Scan Tool (x64) Version: 02-05-2014
Ran by WhiteBull at 2014-05-02 14:37:02
Running from C:\Users\WhiteBull\Downloads\Trojaner Board
Boot Mode: Normal

================== Search: "nqij.exe" ===================

====== End Of Search ======

Alt 02.05.2014, 13:54   #8
Anderl's Pho
 
TimeServer.exe - Standard

TimeServer.exe


Beide Logs FRST.txt und Addition.txt

Alt 02.05.2014, 23:23   #9
Bootsektor
Ruhe in Frieden
† 2019
 
TimeServer.exe - Standard

TimeServer.exe


Zitat:
Ich muss dazu sagen das ich die Prozesse vom TimeServer.exe im Taskmanager under Prozesse bzw Dienste deaktiviert habe.
Naja, wenn ich die entfernen soll, dann muss ich schon wissen, von wo die laufen...
Zitat:
Zum anderen die Anitvierprogg's bzw zur Entfernung von Malware lassen sich erst gar nicht installieren ( Berechtigung nicht vorhanden)
Ja, da arbeiten wir dran

Zitat:
Desweiteren Hatte ich das Problem das in der Systemsteuerung unter Programme deinstallieren einige nicht aufgeführt sind die eigentlich vorhanden sind..
Ich rate ja eigentlich nicht zum CCCleaner... aber guck damit mal nach, ob die Programme noch da sind, wenn du die Programme nicht deinstallieren kannst, versuche es mal mit dem Revo-Uninstaller

Bitte demnächst die Logs wieder in CodeTags posten

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:
  • Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
  • Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
  • Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\Winlogon: [Shell] explorer.exe,"C:\Windows\SysWOW64\NT Kernel\NTKernel.exe" <==== ATTENTION 
Task: {4B82F02A-74F9-4E5C-9857-C7EC9DC77F84} - \SpyHunter4Startup No Task File <==== ATTENTION
Task: C:\Windows\Tasks\VStart{A37B472A-8335-449F-9568-43ECC2907F06}.job => C:\Users\WHITEB~1\AppData\Local\Temp\nseCE39.tmp\v-bates.exe
C:\Program Files (x86)\RegClean Pro
2014-05-01 10:59 - 2014-05-01 10:59 - 04853880 _____ (Systweak Inc ) C:\Users\WhiteBull\Downloads\rcpsetup_2005.exe
2014-05-01 10:59 - 2014-01-03 13:16 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
C:\Users\WhiteBull\AppData\Roaming\msconfig.ini

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


Alt 03.05.2014, 07:37   #10
Anderl's Pho
 
TimeServer.exe - Unglücklich

TimeServer.exe


Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-05-2014
Ran by WhiteBull at 2014-05-03 07:51:53 Run:2
Running from C:\Users\WhiteBull\Downloads\Trojaner Board
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\...\Winlogon: [Shell] explorer.exe,"C:\Windows\SysWOW64\NT Kernel\NTKernel.exe" <==== ATTENTION 
Task: {4B82F02A-74F9-4E5C-9857-C7EC9DC77F84} - \SpyHunter4Startup No Task File <==== ATTENTION
Task: C:\Windows\Tasks\VStart{A37B472A-8335-449F-9568-43ECC2907F06}.job => C:\Users\WHITEB~1\AppData\Local\Temp\nseCE39.tmp\v-bates.exe
C:\Program Files (x86)\RegClean Pro
2014-05-01 10:59 - 2014-05-01 10:59 - 04853880 _____ (Systweak Inc ) C:\Users\WhiteBull\Downloads\rcpsetup_2005.exe
2014-05-01 10:59 - 2014-01-03 13:16 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
C:\Users\WhiteBull\AppData\Roaming\msconfig.ini
         
*****************

HKU\S-1-5-21-3771404351-1378321806-3142792130-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4B82F02A-74F9-4E5C-9857-C7EC9DC77F84} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4B82F02A-74F9-4E5C-9857-C7EC9DC77F84} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SpyHunter4Startup => Key deleted successfully.
C:\Windows\Tasks\VStart{A37B472A-8335-449F-9568-43ECC2907F06}.job => Moved successfully.
C:\Program Files (x86)\RegClean Pro => Moved successfully.
C:\Users\WhiteBull\Downloads\rcpsetup_2005.exe => Moved successfully.
C:\Windows\system32\roboot64.exe => Moved successfully.
C:\Users\WhiteBull\AppData\Roaming\msconfig.ini => Moved successfully.

==== End of Fixlog ====
[QUOTE=Bootsektor;1294650]Naja, wenn ich die entfernen soll, dann muss ich schon wissen, von wo die laufen...

Ja, da arbeiten wir dran


Ich rate ja eigentlich nicht zum CCCleaner... aber guck damit mal nach, ob die Programme noch da sind, wenn du die Programme nicht deinstallieren kannst, versuche es mal mit dem Revo-Uninstaller



Da sind nur noch nicht mal 15 Proggs aufgeführt,versteh ich nicht

Alt 03.05.2014, 21:13   #11
Bootsektor
Ruhe in Frieden
† 2019
 
TimeServer.exe - Standard

TimeServer.exe


Hallo Anderl's Pho
Zitat:
Da sind nur noch nicht mal 15 Proggs aufgeführt,versteh ich nicht
Das liegt auch daran, ob die Programme die du verwendest auch in den Registreierungsschlüsseln stehen, die die Tools auslesen um dann auszugeben, ob diese installiert sind

Wie sieht es nun mit Antivirenprogrammen aus?

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
S4 Time; C:\ProgramData\Microsoft\Windows\Time\Time-svc.exe [10752 2013-07-26] 
(Microsoft)
C:\ProgramData\Microsoft\Windows\Time\Time-svc.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt 2
Downloade dir bitte Farbar Service Scanner Farbar Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.




Schritt 3
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
  • Klicke im Anschluss auf Suchlauf, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf jetzt starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Aktionen anwenden.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Wähle Exportieren auf Textdatei (.txt) und speichere die Datei als mbam.txt auf dem Desktop ab.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Schritt 4
Da der Scan mit Eset sehr gründlich ist, kann er unter Umständen mehrere Stunden dauern

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt 5
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.
Alt 13.05.2014, 23:03   #12
Bootsektor
Ruhe in Frieden
† 2019
 
TimeServer.exe - Standard

TimeServer.exe


Hallo,

ich habe schon länger keine Antwort mehr von Dir erhalten. Benötigst Du weiterhin noch Hilfe?

Wenn ich in den nächsten 24 Stunden nichts von Dir höre, gehe ich davon aus, dass sich das Thema erledigt hat wenn du weiter machen möchtest schicke mir bitte eine PN

Hinweis: Wir sind noch nicht fertig! Auch wenn die Symptome verschwunden sein sollten, kann dein System weiterhin infiziert sein und über Sicherheitslücken verfügen, welche eine erneute Infektion möglich machen.

Alt 27.05.2014, 10:49   #13
Bootsektor
Ruhe in Frieden
† 2019
 
TimeServer.exe - Standard

TimeServer.exe


Fehlende Rückmeldung
Schicke mir bitte eine
PM falls Du weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen

Alt 27.05.2014, 20:50   #14
Anderl's Pho
 
TimeServer.exe - Standard

TimeServer.exe


Code:
ATTFilter
Fixlog nicht gefunden dann Fehler bei Malwareinstallation ( Interner Fehler: Expression Error/Runtime Error:Cat 79:177/External exception E06D7376/
Werde jetzt den Onlinscan durchführen.Meld mich dann wieder.

Lg Andel

Alt 28.05.2014, 04:44   #15
Anderl's Pho
 
TimeServer.exe - Standard

TimeServer.exe


Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=60b9f2815339a549b4f9811b54a63ed8
# engine=18435
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-27 11:08:44
# local_time=2014-05-28 01:08:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 5841424 152861974 0 0
# scanned=349067
# found=110
# cleaned=0
# scan_time=11632
sh=D2CC428F92036B587E147CAB96471315C3BFDDEA ft=1 fh=cd25ea2718166015 vn="Variante von Win32/ELEX.AI evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\iSafe\iSvc2.dll.vir"
sh=53708CCF2410434187CA268A7A724A3992C0FC65 ft=1 fh=a6207637a02e9db4 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=D30BAC56E88EDAEF64D8813330D1FB24921088FA ft=1 fh=5da947440ba8911d vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir"
sh=4539C49EE54EF49172ADAA38B553E38FDF347C80 ft=1 fh=ab01c90ebcba11aa vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=1E3BA56AFE7F70CA844E8330E38FD662A4B41790 ft=1 fh=9c60344bfd510269 vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=33093FCFDCE7C07DD5886ECC4DA42672E5314B09 ft=1 fh=d3cea830025d3e5f vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir"
sh=3D6705DAB5126B0393B6FF5C26484B0899A3D125 ft=1 fh=51586fa0d05d1c4e vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir"
sh=DE134CEDD3AE537C91B6196D66BFCB0FD7DFE550 ft=1 fh=a9eb9770e77ea827 vn="Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir"
sh=856E28D7768BB8C0CD7F1E4355A810D8DB55F6B0 ft=1 fh=1f4105694a25c3d7 vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=4E475FD620FBCCBB37453AF2BD0427BDA73109FF ft=1 fh=70875884387ffbdb vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"
sh=EC7EC5D60C5A578BC9953115D368BECD05BA14B2 ft=1 fh=ecbff00cc7dcc0fd vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir"
sh=95D8C7F2851240F836D46EBD0DCB0BBAE3C9C3C8 ft=1 fh=c39b2415a29978f2 vn="Variante von Win32/ELEX.AD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\IePluginService\PluginService.exe.vir"
sh=559637F0567C7A95BD4881D7BAF0B284D640215A ft=1 fh=c2f893dd822f18f6 vn="Variante von Win32/ELEX.AE evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\WPM\wprotectmanager.exe.vir"
sh=A15C9536148CE02615132AE1DB1A6BF8F873A726 ft=1 fh=41c25fe63c7f6257 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Gast.WhiteBull-PC\AppData\Roaming\OpenCandy\CA276A798BCD477D82531D2C8122C03E\search_protect_global.exe.vir"
sh=E176D7F68E9CC6D03E8555B51565423033CDF6A9 ft=0 fh=0000000000000000 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\WhiteBull\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie2.2.5.zip.vir"
sh=E45C1D583BDD644F636D8DA387761796CE1D7038 ft=1 fh=fe33acdf835fbfaa vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\WhiteBull\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DaemonProcess.exe.vir"
sh=75773C452146645B80387025120B3AFC1BD7F608 ft=1 fh=f924702fd032a998 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\WhiteBull\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\Mobogenie.exe.vir"
sh=CD814F8CAC8880831029BCA4568031141FFE8534 ft=0 fh=0000000000000000 vn="Variante von Android/Mobserv.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\WhiteBull\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\MUServer.apk.vir"
sh=D9B3BA161D98EA1AD0E61015B2F11DB47A0A6875 ft=1 fh=8252b73ae811ba6a vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\WhiteBull\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\New_UpdateMoboGenie.exe.vir"
sh=41814846E01247E84EA5FBC7C998BBFCDFAE61A0 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\invalidprefs.js.vir"
sh=EC7EC5D60C5A578BC9953115D368BECD05BA14B2 ft=1 fh=ecbff00cc7dcc0fd vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\WhiteBull\AppData\Roaming\SupTab\SupTab.dll.vir"
sh=360313131E7AE57002C2403DFC48BC20718D2CB0 ft=1 fh=c71c001198f425ea vn="Win32/InstalleRex.M evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\All Users\InstallMate\{CFFB1553-7365-4467-A68C-3B47141837A5}\Custom.dll"
sh=62C72A6523D6A7BDEB7DD6605941FD65BD11FF15 ft=1 fh=8f796fdea0e56942 vn="Variante von MSIL/Agent.OOB Trojaner" ac=I fn="C:\Documents and Settings\All Users\Microsoft\Windows\Time\Time-svc.exe"
sh=27CF52739F685860815422CB353483A518C94F28 ft=1 fh=a9159edfe59eceed vn="Variante von MSIL/CoinMiner.CE Trojaner" ac=I fn="C:\Documents and Settings\All Users\Microsoft\Windows\Time\WindowsTime.exe"
sh=3B2C90B0A0AF44B405D746E437ACBE2DA1E5E741 ft=1 fh=d0e8a9f046f91a20 vn="Win32/TrojanDownloader.Agent.AFD Trojaner" ac=I fn="C:\Documents and Settings\All Users\TopApp software\SO.Booster\SO.Booster.exe"
sh=689C2077B6DFB3D895BD0A264D642B2966FCB703 ft=1 fh=064c54f8e35d4f2a vn="Win32/OutBrowse.G evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\Gast.WhiteBull-PC\Downloads\setup (1).exe"
sh=FD288B7A4E8DB4F577016A5B639EA2F28C6CC34C ft=1 fh=77c2a964ea346545 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Z2J1ARK\lcMt7QY[1].exe"
sh=FA929B7441FA9BD405D6352522746DF2C1848CA8 ft=1 fh=6b72444eed03bd8f vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Z2J1ARK\M79QD0d[1].exe"
sh=AC61D6DFC05971460FE0A982E62F52AE50755770 ft=1 fh=a0439de4e77ee855 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33K6MF73\5r0yAe[1].exe"
sh=64769C061C7E1AE70C1EF81A5CF5F61BCB9666D2 ft=1 fh=986eeb71bc35f36f vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33K6MF73\Axifoenq[1].exe"
sh=3B2C90B0A0AF44B405D746E437ACBE2DA1E5E741 ft=1 fh=d0e8a9f046f91a20 vn="Win32/TrojanDownloader.Agent.AFD Trojaner" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7YLR1PI2\agup[1].exe"
sh=B1C2D1DCB88B137401A14285DACB93D116F4BE03 ft=1 fh=e4f00ebe12a4a3e0 vn="Win32/Duckegg.A evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7YLR1PI2\duckegg[1].exe"
sh=6B350A227F1FF76D708D25E95486B47C37887D17 ft=1 fh=d37a8fb430b2b8af vn="Variante von Win32/AdWare.SpeedingUpMyPC.L Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G77NN2E4\OptimizerPro[1].exe"
sh=6D04D56668E67E0D634A6914E54F503EC43CAC8D ft=1 fh=c71c001194990d1f vn="Variante von Win32/SProtector.H evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G77NN2E4\tpq[1].exe"
sh=4861163621FB0467DE29A853C55BF9FB2E47BFFA ft=1 fh=59016df9a267f924 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSW9FRQB\d8zq[1].exe"
sh=04E6AF4D68B33C53C2A122CDBD70E8074CF4A5F9 ft=1 fh=0f9c35755dfa62f7 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TZ0MQJMP\ZP933Na[1].exe"
sh=B1C2D1DCB88B137401A14285DACB93D116F4BE03 ft=1 fh=e4f00ebe12a4a3e0 vn="Win32/Duckegg.A evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Temp\FastDownload.exe"
sh=7F5C96D7B9CE5F53C9F596A0A09A10FD6A273A41 ft=1 fh=f744e4c8a8b25458 vn="Variante von Win32/AnyProtect.C evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Temp\ICReinstall_nsvFA3.tmp.exe"
sh=282501AA2FA177D942282F8E2EB5E1D25CA17AED ft=1 fh=170a29edd91c8b10 vn="Variante von Win32/ELEX.AD evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Temp\fullpackage_temp1398511062\tmp\SupTab.exe"
sh=9A189D6EAB28C6F9C20AEEFA3E7134916E38C65B ft=1 fh=c71c0011b919b825 vn="Variante von Win32/ELEX.AE evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Temp\fullpackage_temp1398511062\tmp\wpm.exe"
sh=8C1B4AF23884F48B3394C25DFF659496C26A64E0 ft=1 fh=b281aa308fdd7c22 vn="Win32/AnyProtect.D evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Local\Temp\is82122515\4921981_stp\AnyProtectScannerSetup.exe"
sh=C3B9070D198528C5B022CB0D0F0B4BB98624582D ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\prefs-3.js"
sh=CBAC6310CCA8234885C1A71F6DD143255D0EBF44 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\prefs.js.new"
sh=0C2DADFDD2DDBAF4274E186E08DA9205D6C61171 ft=1 fh=bb1f3b8feb52c9de vn="Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung" ac=I fn="C:\Documents and Settings\WhiteBull\Downloads\cnet2_eu281en_exe.exe"
sh=360313131E7AE57002C2403DFC48BC20718D2CB0 ft=1 fh=c71c001198f425ea vn="Win32/InstalleRex.M evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\All Users\InstallMate\{CFFB1553-7365-4467-A68C-3B47141837A5}\Custom.dll"
sh=62C72A6523D6A7BDEB7DD6605941FD65BD11FF15 ft=1 fh=8f796fdea0e56942 vn="Variante von MSIL/Agent.OOB Trojaner" ac=I fn="C:\Dokumente und Einstellungen\All Users\Microsoft\Windows\Time\Time-svc.exe"
sh=27CF52739F685860815422CB353483A518C94F28 ft=1 fh=a9159edfe59eceed vn="Variante von MSIL/CoinMiner.CE Trojaner" ac=I fn="C:\Dokumente und Einstellungen\All Users\Microsoft\Windows\Time\WindowsTime.exe"
sh=3B2C90B0A0AF44B405D746E437ACBE2DA1E5E741 ft=1 fh=d0e8a9f046f91a20 vn="Win32/TrojanDownloader.Agent.AFD Trojaner" ac=I fn="C:\Dokumente und Einstellungen\All Users\TopApp software\SO.Booster\SO.Booster.exe"
sh=689C2077B6DFB3D895BD0A264D642B2966FCB703 ft=1 fh=064c54f8e35d4f2a vn="Win32/OutBrowse.G evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\Gast.WhiteBull-PC\Downloads\setup (1).exe"
sh=FD288B7A4E8DB4F577016A5B639EA2F28C6CC34C ft=1 fh=77c2a964ea346545 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Z2J1ARK\lcMt7QY[1].exe"
sh=FA929B7441FA9BD405D6352522746DF2C1848CA8 ft=1 fh=6b72444eed03bd8f vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Z2J1ARK\M79QD0d[1].exe"
sh=AC61D6DFC05971460FE0A982E62F52AE50755770 ft=1 fh=a0439de4e77ee855 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33K6MF73\5r0yAe[1].exe"
sh=64769C061C7E1AE70C1EF81A5CF5F61BCB9666D2 ft=1 fh=986eeb71bc35f36f vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33K6MF73\Axifoenq[1].exe"
sh=3B2C90B0A0AF44B405D746E437ACBE2DA1E5E741 ft=1 fh=d0e8a9f046f91a20 vn="Win32/TrojanDownloader.Agent.AFD Trojaner" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7YLR1PI2\agup[1].exe"
sh=B1C2D1DCB88B137401A14285DACB93D116F4BE03 ft=1 fh=e4f00ebe12a4a3e0 vn="Win32/Duckegg.A evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7YLR1PI2\duckegg[1].exe"
sh=6B350A227F1FF76D708D25E95486B47C37887D17 ft=1 fh=d37a8fb430b2b8af vn="Variante von Win32/AdWare.SpeedingUpMyPC.L Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G77NN2E4\OptimizerPro[1].exe"
sh=6D04D56668E67E0D634A6914E54F503EC43CAC8D ft=1 fh=c71c001194990d1f vn="Variante von Win32/SProtector.H evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G77NN2E4\tpq[1].exe"
sh=4861163621FB0467DE29A853C55BF9FB2E47BFFA ft=1 fh=59016df9a267f924 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSW9FRQB\d8zq[1].exe"
sh=04E6AF4D68B33C53C2A122CDBD70E8074CF4A5F9 ft=1 fh=0f9c35755dfa62f7 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TZ0MQJMP\ZP933Na[1].exe"
sh=B1C2D1DCB88B137401A14285DACB93D116F4BE03 ft=1 fh=e4f00ebe12a4a3e0 vn="Win32/Duckegg.A evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Temp\FastDownload.exe"
sh=7F5C96D7B9CE5F53C9F596A0A09A10FD6A273A41 ft=1 fh=f744e4c8a8b25458 vn="Variante von Win32/AnyProtect.C evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Temp\ICReinstall_nsvFA3.tmp.exe"
sh=282501AA2FA177D942282F8E2EB5E1D25CA17AED ft=1 fh=170a29edd91c8b10 vn="Variante von Win32/ELEX.AD evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Temp\fullpackage_temp1398511062\tmp\SupTab.exe"
sh=9A189D6EAB28C6F9C20AEEFA3E7134916E38C65B ft=1 fh=c71c0011b919b825 vn="Variante von Win32/ELEX.AE evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Temp\fullpackage_temp1398511062\tmp\wpm.exe"
sh=8C1B4AF23884F48B3394C25DFF659496C26A64E0 ft=1 fh=b281aa308fdd7c22 vn="Win32/AnyProtect.D evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Local\Temp\is82122515\4921981_stp\AnyProtectScannerSetup.exe"
sh=C3B9070D198528C5B022CB0D0F0B4BB98624582D ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\prefs-3.js"
sh=CBAC6310CCA8234885C1A71F6DD143255D0EBF44 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\prefs.js.new"
sh=0C2DADFDD2DDBAF4274E186E08DA9205D6C61171 ft=1 fh=bb1f3b8feb52c9de vn="Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung" ac=I fn="C:\Dokumente und Einstellungen\WhiteBull\Downloads\cnet2_eu281en_exe.exe"
sh=ADB253E693F1A9B1757607450D8F7F550FC4B3ED ft=1 fh=1843158cbd8056e1 vn="Win32/Systweak.B evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\WhiteBull\Downloads\rcpsetup_2005.exe.xBAD"
sh=32F99788C6D45851A067C84FFFA1116E54CA3EF3 ft=1 fh=c71c00116263307f vn="Variante von Win32/SProtector.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\SO.Booster"
sh=D721D4DD67656C8F7D0F40ABA7718ABB2A3AFB4F ft=1 fh=51202a2339d0474f vn="Variante von Win32/SProtector.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\SOSvc.dll"
sh=AE4B3ECB491AEF6D1594361E820A6FCC8EF44E3E ft=1 fh=c71c0011d35ff60a vn="Variante von Win64/SProtector.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\SO_x64.Booster"
sh=748226A881D1B81B57CAB2787B80E1E0ACBAF660 ft=1 fh=45636f949d50973a vn="Win32/Toolbar.Conduit.S evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\NCH Software\Components\NCHToolbars\conduit\ConduitInstaller.exe"
sh=0DAFA42039405F8D49A6790180194076BD57C833 ft=1 fh=c71c001147036410 vn="Variante von Win32/AdWare.MultiPlug.N Anwendung" ac=I fn="C:\Program Files (x86)\SNT\DuQt9Fj.dll"
sh=61CB4B5228E6253863391EF3346C2F9920DBC554 ft=1 fh=c71c00112b13579c vn="Variante von Win64/Adware.MultiPlug.A Anwendung" ac=I fn="C:\Program Files (x86)\SNT\DuQt9Fj.x64.dll"
sh=0DAFA42039405F8D49A6790180194076BD57C833 ft=1 fh=c71c001147036410 vn="Variante von Win32/AdWare.MultiPlug.N Anwendung" ac=I fn="C:\Program Files (x86)\YoutubeAdblocker\A7y8lHs.dll"
sh=61CB4B5228E6253863391EF3346C2F9920DBC554 ft=1 fh=c71c00112b13579c vn="Variante von Win64/Adware.MultiPlug.A Anwendung" ac=I fn="C:\Program Files (x86)\YoutubeAdblocker\A7y8lHs.x64.dll"
sh=360313131E7AE57002C2403DFC48BC20718D2CB0 ft=1 fh=c71c001198f425ea vn="Win32/InstalleRex.M evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\InstallMate\{CFFB1553-7365-4467-A68C-3B47141837A5}\Custom.dll"
sh=62C72A6523D6A7BDEB7DD6605941FD65BD11FF15 ft=1 fh=8f796fdea0e56942 vn="Variante von MSIL/Agent.OOB Trojaner" ac=I fn="C:\ProgramData\Microsoft\Windows\Time\Time-svc.exe"
sh=27CF52739F685860815422CB353483A518C94F28 ft=1 fh=a9159edfe59eceed vn="Variante von MSIL/CoinMiner.CE Trojaner" ac=I fn="C:\ProgramData\Microsoft\Windows\Time\WindowsTime.exe"
sh=3B2C90B0A0AF44B405D746E437ACBE2DA1E5E741 ft=1 fh=d0e8a9f046f91a20 vn="Win32/TrojanDownloader.Agent.AFD Trojaner" ac=I fn="C:\ProgramData\TopApp software\SO.Booster\SO.Booster.exe"
sh=360313131E7AE57002C2403DFC48BC20718D2CB0 ft=1 fh=c71c001198f425ea vn="Win32/InstalleRex.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\InstallMate\{CFFB1553-7365-4467-A68C-3B47141837A5}\Custom.dll"
sh=62C72A6523D6A7BDEB7DD6605941FD65BD11FF15 ft=1 fh=8f796fdea0e56942 vn="Variante von MSIL/Agent.OOB Trojaner" ac=I fn="C:\Users\All Users\Microsoft\Windows\Time\Time-svc.exe"
sh=27CF52739F685860815422CB353483A518C94F28 ft=1 fh=a9159edfe59eceed vn="Variante von MSIL/CoinMiner.CE Trojaner" ac=I fn="C:\Users\All Users\Microsoft\Windows\Time\WindowsTime.exe"
sh=3B2C90B0A0AF44B405D746E437ACBE2DA1E5E741 ft=1 fh=d0e8a9f046f91a20 vn="Win32/TrojanDownloader.Agent.AFD Trojaner" ac=I fn="C:\Users\All Users\TopApp software\SO.Booster\SO.Booster.exe"
sh=689C2077B6DFB3D895BD0A264D642B2966FCB703 ft=1 fh=064c54f8e35d4f2a vn="Win32/OutBrowse.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Gast.WhiteBull-PC\Downloads\setup (1).exe"
sh=FD288B7A4E8DB4F577016A5B639EA2F28C6CC34C ft=1 fh=77c2a964ea346545 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Z2J1ARK\lcMt7QY[1].exe"
sh=FA929B7441FA9BD405D6352522746DF2C1848CA8 ft=1 fh=6b72444eed03bd8f vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Z2J1ARK\M79QD0d[1].exe"
sh=AC61D6DFC05971460FE0A982E62F52AE50755770 ft=1 fh=a0439de4e77ee855 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33K6MF73\5r0yAe[1].exe"
sh=64769C061C7E1AE70C1EF81A5CF5F61BCB9666D2 ft=1 fh=986eeb71bc35f36f vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33K6MF73\Axifoenq[1].exe"
sh=3B2C90B0A0AF44B405D746E437ACBE2DA1E5E741 ft=1 fh=d0e8a9f046f91a20 vn="Win32/TrojanDownloader.Agent.AFD Trojaner" ac=I fn="C:\Users\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7YLR1PI2\agup[1].exe"
sh=B1C2D1DCB88B137401A14285DACB93D116F4BE03 ft=1 fh=e4f00ebe12a4a3e0 vn="Win32/Duckegg.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7YLR1PI2\duckegg[1].exe"
sh=6B350A227F1FF76D708D25E95486B47C37887D17 ft=1 fh=d37a8fb430b2b8af vn="Variante von Win32/AdWare.SpeedingUpMyPC.L Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G77NN2E4\OptimizerPro[1].exe"
sh=6D04D56668E67E0D634A6914E54F503EC43CAC8D ft=1 fh=c71c001194990d1f vn="Variante von Win32/SProtector.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G77NN2E4\tpq[1].exe"
sh=4861163621FB0467DE29A853C55BF9FB2E47BFFA ft=1 fh=59016df9a267f924 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSW9FRQB\d8zq[1].exe"
sh=04E6AF4D68B33C53C2A122CDBD70E8074CF4A5F9 ft=1 fh=0f9c35755dfa62f7 vn="Variante von Win32/AdWare.MultiPlug.R Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TZ0MQJMP\ZP933Na[1].exe"
sh=B1C2D1DCB88B137401A14285DACB93D116F4BE03 ft=1 fh=e4f00ebe12a4a3e0 vn="Win32/Duckegg.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Temp\FastDownload.exe"
sh=7F5C96D7B9CE5F53C9F596A0A09A10FD6A273A41 ft=1 fh=f744e4c8a8b25458 vn="Variante von Win32/AnyProtect.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Temp\ICReinstall_nsvFA3.tmp.exe"
sh=282501AA2FA177D942282F8E2EB5E1D25CA17AED ft=1 fh=170a29edd91c8b10 vn="Variante von Win32/ELEX.AD evtl. unerwünschte Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Temp\fullpackage_temp1398511062\tmp\SupTab.exe"
sh=9A189D6EAB28C6F9C20AEEFA3E7134916E38C65B ft=1 fh=c71c0011b919b825 vn="Variante von Win32/ELEX.AE evtl. unerwünschte Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Temp\fullpackage_temp1398511062\tmp\wpm.exe"
sh=8C1B4AF23884F48B3394C25DFF659496C26A64E0 ft=1 fh=b281aa308fdd7c22 vn="Win32/AnyProtect.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Local\Temp\is82122515\4921981_stp\AnyProtectScannerSetup.exe"
sh=C3B9070D198528C5B022CB0D0F0B4BB98624582D ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\prefs-3.js"
sh=CBAC6310CCA8234885C1A71F6DD143255D0EBF44 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\WhiteBull\AppData\Roaming\Mozilla\Firefox\Profiles\j1di8db6.default\prefs.js.new"
sh=0C2DADFDD2DDBAF4274E186E08DA9205D6C61171 ft=1 fh=bb1f3b8feb52c9de vn="Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\WhiteBull\Downloads\cnet2_eu281en_exe.exe"
sh=AD4CBF3B4F10E986AF44B5E32902BEA711223963 ft=1 fh=bff9e8a0156e0725 vn="Win32/AdWare.MultiPlug.V Anwendung" ac=I fn="C:\Windows\System32\setup.exe"
sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\update[1]"
sh=8EEC2F3EC9E824FC4D7E561C8C22B1A5C4546640 ft=1 fh=89f68a07f7f8a43c vn="Variante von Win32/Toolbar.Perion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\update[1]"
sh=AD4CBF3B4F10E986AF44B5E32902BEA711223963 ft=1 fh=bff9e8a0156e0725 vn="Win32/AdWare.MultiPlug.V Anwendung" ac=I fn="C:\Windows\SysWOW64\setup.exe"
sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\update[1]"
sh=8EEC2F3EC9E824FC4D7E561C8C22B1A5C4546640 ft=1 fh=89f68a07f7f8a43c vn="Variante von Win32/Toolbar.Perion.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\update[1]"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="Variante von Win32/SProtector.D evtl. unerwünschte Anwendung" ac=I fn="${Memory}"

Antwort
Seite 1 von 2 1 2

Themen zu TimeServer.exe
ander, befindet, einiger, hilfe, laptop, leerlauf, lüfter, problem, prozesse, servus, taskma, taskmanager, taucht


« Zeichen auf der Firefox Startseite | AntiVir funktioniert nicht mehr »


Ähnliche Themen: TimeServer.exe


  1. TimeServer.exe - System seitdem laaaangsam
    Log-Analyse und Auswertung - 27.11.2013 (4)
  2. Windows 7: TimeServer.exe und WindowsTime.exe anscheinend GPU-Bitcoin-Miner
    Log-Analyse und Auswertung - 10.11.2013 (11)
  3. TimeServer.exe hohe CPU Auslastung
    Plagegeister aller Art und deren Bekämpfung - 05.09.2013 (15)
  4. Windows 7 (64bit) - hyperaktive timeserver.exe - Malwarebytes kann Befall nicht dauerhaft entfernen
    Log-Analyse und Auswertung - 15.08.2013 (5)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema TimeServer.exe - Servus beinand , Ich habe auch seit einiger Zeit das Problem mit diesem TimeServer.exe. Beim Taskmanager unter Prozesse taucht bei mir auch dieses Problem auf. Bei mir macht es sich - TimeServer.exe...
Archiv
Du betrachtest: TimeServer.exe auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130