| |
| |||||||
Log-Analyse und Auswertung: Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates"Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
04.06.2014, 13:34
| #1 |
 |  Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Guten Tag, ich habe gestern eine Software von Chip runtergeladen. Das hieß Youtube Converter to MP3. Da es eine legale Software und von Chipword ist, habe ich mir nichts dabei gedacht. Nach der Installation bemerkte ich, dass sehr viele Sachen installiert wurden und habe so schnell es ging die Installation (leider zu spät) abgebrochen. Ab dem Zeitpunkt an öffneten sich beim Surfen immer neue Fenster, dass mein PC nicht geschützt sei und dass ich einen Button anklicken solle. Ich habe einen Scan mit MalewareBytes durchgeführt. Hierbei wurden viele infizierte Dateien gefunden. Nachdem Scan, als nichts besser wurde, habe ich einen Antivirusscan durchgeführt. Hierbei wurden auch Dateien gefunden, aber auch hier wurde es nicht besser. Dann habe ich weiter im Internet recherchiert und hier gelandet. Danach habe ich den ADW Cleaner und ESET Online Scanner runtergeladen und die Scans durchgeführt. Ich füge die Logs hier bei und hoffe sehr auf große Hilfe, dass mein Laptop schnellstmöglich wieder sauber ist. Meldungen vom AntivirusProgramm waren unter anderem: "pup.optional.VBates" und "pup.optional.SweetPacks.A" und "pup.optional.HelperBar.A" Log von ADW Cleaner: Code:
ATTFilter # AdwCleaner v3.211 - Bericht erstellt am 04/06/2014 um 02:13:34
# Aktualisiert 26/05/2014 von Xplode
# Betriebssystem : Windows 8 (64 bits)
# Benutzername : Psycho - PSYCHO-PC
# Gestartet von : C:\Users\Psycho\Downloads\adwcleaner_3.211.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files (x86)\PC Speed Maximizer
Ordner Gelöscht : C:\Program Files (x86)\Common Files\Tobit
Ordner Gelöscht : C:\Program Files\003
Ordner Gelöscht : C:\Program Files\V-bates
Ordner Gelöscht : C:\Users\Psycho\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Psycho\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Psycho\AppData\Roaming\Tobit
Ordner Gelöscht : C:\Users\Psycho\Documents\PC Speed Maximizer
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Psycho\AppData\Roaming\Mozilla\Firefox\Profiles\mg72070i.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Psycho\AppData\Roaming\Mozilla\Firefox\Profiles\mg72070i.default\user.js
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{10AD2C61-0898-4348-8600-14A342F22AC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10AD2C61-0898-4348-8600-14A342F22AC3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10AD2C61-0898-4348-8600-14A342F22AC3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{21EAF666-26B3-4A3C-ABD0-CA2F5A326744}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\suprasavings
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\Myfree Codec
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\LevelQualityWatcher
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\suprasavings
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16537
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\Psycho\AppData\Roaming\Mozilla\Firefox\Profiles\mg72070i.default\prefs.js ]
Zeile gelöscht : user_pref("browser.search.defaultenginename", "Web Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
Zeile gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG3[...]
Zeile gelöscht : user_pref("{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}.ScriptData_whiteListSearch", "{\"isearch.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"se[...]
*************************
AdwCleaner[R0].txt - [9659 octets] - [04/06/2014 02:10:14]
AdwCleaner[R1].txt - [9719 octets] - [04/06/2014 02:12:59]
AdwCleaner[S0].txt - [7019 octets] - [04/06/2014 02:13:34]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7079 octets] ##########
Avira Antivirus I Code:
ATTFilter Exportierte Ereignisse:
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
04.06.2014 01:13 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\ProgramData\dlprotect.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Softomat.AN' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
Code:
ATTFilter Exportierte Ereignisse:
03.06.2014 19:44 [System-Scanner] Malware gefunden
Die Datei
'C:\Users\Psycho\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '57039fc3.qua'
verschoben!
03.06.2014 19:44 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].
Anzahl Dateien: 1274
Anzahl Verzeichnisse: 0
Anzahl Malware: 1
Anzahl Warnungen: 0
03.06.2014 19:41 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\Users\Psycho\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
03.06.2014 19:23 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\Psycho\AppData\Roaming\BupSystem\bup.exe'
enthielt einen Virus oder unerwünschtes Programm 'Adware/AgentCV.A.3743'
[adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '55af93f7.qua'
verschoben!
03.06.2014 19:23 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].
Anzahl Dateien: 994
Anzahl Verzeichnisse: 0
Anzahl Malware: 1
Anzahl Warnungen: 0
03.06.2014 19:23 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].
Anzahl Dateien: 1098
Anzahl Verzeichnisse: 0
Anzahl Malware: 0
Anzahl Warnungen: 0
03.06.2014 19:22 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Psycho\AppData\Roaming\BupSystem\bup.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
03.06.2014 19:22 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Psycho\AppData\Roaming\BupSystem\bup.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
03.06.2014 19:20 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Psycho\AppData\Roaming\BupSystem\bup.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
03.06.2014 19:20 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Psycho\AppData\Roaming\BupSystem\bup.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
03.06.2014 19:20 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Psycho\AppData\Roaming\BupSystem\bup.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
03.06.2014 19:20 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Psycho\AppData\Roaming\Security System 2\data\serv.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
03.06.2014 19:20 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Psycho\AppData\Roaming\Security System 2\data\serv.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=8f7f8afffe772040a2b3fad77351ef39
# engine=18543
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-04 06:15:15
# local_time=2014-06-04 08:15:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 0 267285805 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 1498611 43354757 0 0
# scanned=314187
# found=14
# cleaned=0
# scan_time=20090
sh=26F8F31A081B485938097F9C7AE8014799A9D52E ft=1 fh=512662e3799fe105 vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-3168705560-3439070292-1676408650-1002\$R3AZB0U.exe"
sh=91A80C205C65E37F27D0E608EF65B2BE523E18BD ft=1 fh=4fcdf0195d1e4a50 vn="Win32/MyPCBackup.A evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-3168705560-3439070292-1676408650-1002\$RA045Q1.exe"
sh=38084E97BFF11FA4C4796C7A3CE18EA659BF2890 ft=1 fh=2b2c4b5f9a2653a8 vn="Variante von Win32/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-3168705560-3439070292-1676408650-1002\$RY7YLIM.exe"
sh=B98C851D46F6F34607DEC601FF82469DA350D9EC ft=1 fh=95a049650cc65f75 vn="Variante von Win64/Adware.Adpeak.C Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\003\hmmwwoblzz64.exe.vir"
sh=CED05266ECDC6547AFB0B18E7AB4DBCCA5535FB9 ft=1 fh=2791e6518558f99b vn="Variante von Win32/SpeedingUpMyPC Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe.vir"
sh=990A77ECC18BC46820C2354D3726F20FAAC791E9 ft=0 fh=0000000000000000 vn="Variante von Win32/AdWare.Adpeak.I Anwendung" ac=I fn="C:\temp\t.msi"
sh=1FBCCE3ECEBD5955F90E91C6B6B74EE06783CD66 ft=1 fh=cdd42cd0b2145c18 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Psycho\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V4GO844Q\spstub[1].exe"
sh=FB9F8E113955A5FC70823563FD75780434A05700 ft=1 fh=859e5a61cf26c0f4 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Psycho\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V4GO844Q\v-bates[1].exe"
sh=FB9F8E113955A5FC70823563FD75780434A05700 ft=1 fh=859e5a61cf26c0f4 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Psycho\AppData\Local\Temp\v-bates.exe"
sh=8398427DEE8FECAF5BC25B22C826FC2DC6DF9747 ft=1 fh=81c159dc949cee29 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Psycho\AppData\Local\Temp\nsyE535\SpSetup.exe"
sh=0730F3D050959A72D0552A8231A803A2807CA7BB ft=1 fh=fd26318becbcfbc5 vn="Variante von Win32/Tivmonk.B Trojaner" ac=I fn="C:\Users\Psycho\Downloads\Flash-3-Update5232014.exe"
sh=1447092BA29779C726829611180994E17718C412 ft=1 fh=23f22b72eb3a5b90 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Psycho\Downloads\PDFCreator-1_7_2_setup_offline.exe"
sh=0CE48DA603A5E7431002CE4ACA1F1546C5D6579E ft=1 fh=a7cab65addc4a365 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Psycho\Downloads\Youtube Downloader\FreeYouTubeToMP3Converter32.exe"
sh=990A77ECC18BC46820C2354D3726F20FAAC791E9 ft=0 fh=0000000000000000 vn="Variante von Win32/AdWare.Adpeak.I Anwendung" ac=I fn="C:\Windows\Installer\568d5f6a.msi"
Code:
ATTFilter <?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2014/06/03 02:53:24 +0200</date>
<logfile>mbam-log-2014-06-03 (02-53-23).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.00.2.1012</version>
<malware-database>v2014.06.02.09</malware-database>
<rootkit-database>v2014.05.21.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 8</osversion>
<arch>x64</arch>
<username>Psycho</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>305123</objects>
<time>680</time>
<processes>0</processes>
<modules>0</modules>
<keys>0</keys>
<values>0</values>
<datas>0</datas>
<folders>0</folders>
<files>0</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>warn</pup>
<pum>enabled</pum>
</options>
<items>
</items>
</mbam-log>
Code:
ATTFilter <?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2014/06/03 20:18:57 +0200</date>
<logfile>mbam-log-2014-06-03 (20-18-56).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.00.2.1012</version>
<malware-database>v2014.06.03.06</malware-database>
<rootkit-database>v2014.06.02.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 8</osversion>
<arch>x64</arch>
<username>Psycho</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>0</objects>
<time>0</time>
<processes>1</processes>
<modules>0</modules>
<keys>0</keys>
<values>1</values>
<datas>0</datas>
<folders>0</folders>
<files>1</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>warn</pup>
<pum>enabled</pum>
</options>
<items>
<process><path>C:\ProgramData\dlprotect.exe</path><vendor>Trojan.Downloader</vendor><action>delete-on-reboot</action><pid>380</pid><hash>bb57bcb8dba0f93d9cc2572e9d640ef2</hash></process>
<value><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN</path><valuename>Download Protect</valuename><vendor>Trojan.Downloader</vendor><action>success</action><valuedata>C:\ProgramData\dlprotect.exe</valuedata><hash>bb57bcb8dba0f93d9cc2572e9d640ef2</hash></value>
<file><path>C:\ProgramData\dlprotect.exe</path><vendor>Trojan.Downloader</vendor><action>delete-on-reboot</action><hash>bb57bcb8dba0f93d9cc2572e9d640ef2</hash></file>
</items>
</mbam-log>
Code:
ATTFilter <?xml version="1.0" encoding="UTF-8" ?>
<logs>
<record severity="debug" LoggingEventType="1" datetime="2014-06-03T02:51:56.610181+02:00" source="Manual" type="Update" username="SYSTEM" systemname="PSYCHO-PC" fromVersion="2014.3.27.1" last_modified_tag="cd7202e5-3639-4313-b86e-509a72a514ca" name="Rootkit Database" toVersion="2014.5.21.1"></record>
<record severity="debug" LoggingEventType="1" datetime="2014-06-03T02:52:01.329153+02:00" source="Manual" type="Update" username="SYSTEM" systemname="PSYCHO-PC" fromVersion="2014.5.15.4" last_modified_tag="19bf1ef4-7e78-4cca-b0e6-718266b804e6" name="Malware Database" toVersion="2014.6.2.9"></record>
<record severity="debug" LoggingEventType="1" datetime="2014-06-03T02:52:13.470407+02:00" source="Manual" type="Update" username="SYSTEM" systemname="PSYCHO-PC" fromVersion="2.0.1.1004" last_modified_tag="530a7b7a-02eb-44d5-a16b-d554a9ae3514" name="program" toVersion="2.0.2.1012"></record>
<record severity="debug" LoggingEventType="1" datetime="2014-06-03T02:53:05.078861+02:00" source="Manual" type="Update" username="SYSTEM" systemname="PSYCHO-PC" fromVersion="2014.2.20.1" last_modified_tag="4f5076dc-ebe1-4471-8be5-7a561ce31ad5" name="Rootkit Database" toVersion="2014.5.21.1"></record>
<record severity="debug" LoggingEventType="1" datetime="2014-06-03T02:53:08.329028+02:00" source="Manual" type="Update" username="SYSTEM" systemname="PSYCHO-PC" fromVersion="2014.3.4.9" last_modified_tag="923dd6e8-c129-45f5-ac6b-2094bcb52e6d" name="Malware Database" toVersion="2014.6.2.9"></record>
<record severity="debug" LoggingEventType="1" datetime="2014-06-03T19:49:49.965680+02:00" source="Manual" type="Update" username="SYSTEM" systemname="PSYCHO-PC" fromVersion="2014.5.21.1" last_modified_tag="674c86bf-bb69-4263-babb-3836a564d96f" name="Rootkit Database" toVersion="2014.6.2.1"></record>
<record severity="debug" LoggingEventType="1" datetime="2014-06-03T19:50:09.949276+02:00" source="Manual" type="Update" username="SYSTEM" systemname="PSYCHO-PC" fromVersion="2014.6.2.9" last_modified_tag="7e726c62-9f78-4537-a90d-8d1606673021" name="Malware Database" toVersion="2014.6.3.6"></record>
</logs>
Code:
ATTFilter <?xml version="1.0" encoding="UTF-8" ?>
<logs>
<record severity="debug" LoggingEventType="1" datetime="2014-06-04T01:07:10.444095+02:00" source="Manual" type="Update" username="SYSTEM" systemname="PSYCHO-PC" fromVersion="2014.6.3.6" last_modified_tag="e843aec7-5b94-4755-aaf1-880e01a62bd5" name="Malware Database" toVersion="2014.6.3.7"></record>
</logs>
|
|
04.06.2014, 14:26
| #2 |
| /// the machine /// TB-Ausbilder    | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
04.06.2014, 14:51
| #3 |
| | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Danke für die schnelle Antwort.
__________________Meine TXT Log-Datei: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by Psycho (administrator) on PSYCHO-PC on 04-06-2014 15:45:57
Running from C:\Users\Psycho\Downloads
Platform: Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
( ) C:\Windows\System32\lxeccoms.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-17] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [11582848 2012-09-30] (Motorola Solutions, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2917176 2012-09-05] (Synaptics Incorporated)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-07-30] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-12-11] (Samsung Electronics Co., Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-3168705560-3439070292-1676408650-1001\...\Run: [AppLauncher] => C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion)\AppLauncher.exe [969656 2012-08-10] (Ashampoo)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1001\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AppLauncher] => C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion)\AppLauncher.exe [969656 2012-08-10] (Ashampoo)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [AlcoholAutomount] => C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [33120 2010-08-20] (Alcohol Soft Development Team)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [rfxsrvtray] => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AlcoholAutomount] => C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [33120 2010-08-20] (Alcohol Soft Development Team)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [rfxsrvtray] => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVer HID Receiver.lnk
ShortcutTarget: AVer HID Receiver.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVerQuick.lnk
ShortcutTarget: AVerQuick.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe (AVerMedia TECHNOLOGIES, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\smartbar_3312014.exe.lnk
ShortcutTarget: smartbar_3312014.exe.lnk -> C:\Users\Psycho\AppData\Local\Temp\nsk10C6.tmp\112\smartbar_3312014.exe (No File)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Psycho\AppData\Roaming\Mozilla\Firefox\Profiles\mg72070i.default
FF NewTab: about:blank
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Psycho\AppData\Roaming\Mozilla\Firefox\Profiles\mg72070i.default\Extensions\2020Player_IKEA@2020Technologies.com [2014-02-12]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [348160 2009-09-23] (AVerMedia)
R2 AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [393216 2009-04-09] ()
R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-06-29] (IvoSoft)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [805888 2012-11-29] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 lxec_device; C:\Windows\system32\lxeccoms.exe [1052328 2010-04-14] ( )
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-09-24] ()
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2012-10-19] ()
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [1153840 2012-09-24] (Intel® Corporation)
S2 hmmwwoblzz64; C:\Program Files\003\hmmwwoblzz64.exe run options=01100010030000000000000000000000 sourceguid=6DAF2CD5-832E-48EB-8678-2B122163A2D9 [X]
==================== Drivers (Whitelisted) ====================
S3 AVerAF35; C:\Windows\System32\Drivers\AVerAF35.sys [677632 2010-03-16] (AVerMedia TECHNOLOGIES, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130584 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132480 2012-10-01] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1337216 2012-10-01] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [165504 2012-11-14] (ITE )
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [4309032 2012-10-10] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-09-11] (Duplex Secure Ltd.)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
U3 aheqj290; C:\Windows\System32\Drivers\aheqj290.sys [0 ] (Intel Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-04 15:45 - 2014-06-04 15:46 - 00021503 _____ () C:\Users\Psycho\Downloads\FRST.txt
2014-06-04 15:45 - 2014-06-04 15:46 - 00000000 ____D () C:\FRST
2014-06-04 15:43 - 2014-06-04 15:43 - 02068992 _____ (Farbar) C:\Users\Psycho\Downloads\FRST64.exe
2014-06-04 15:42 - 2014-06-04 15:42 - 01059840 _____ (Farbar) C:\Users\Psycho\Downloads\FRST.exe
2014-06-04 02:35 - 2014-06-04 02:35 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-04 02:34 - 2014-06-04 02:34 - 02347384 _____ (ESET) C:\Users\Psycho\Downloads\esetsmartinstaller_deu.exe
2014-06-04 02:19 - 2014-06-04 02:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-06-04 02:18 - 2014-06-04 14:09 - 00000000 ____D () C:\Users\Psycho\Desktop\Log Dateien
2014-06-04 02:09 - 2014-06-04 02:13 - 00000000 ____D () C:\AdwCleaner
2014-06-04 02:08 - 2014-06-04 02:08 - 01327971 _____ () C:\Users\Psycho\Downloads\adwcleaner_3.211.exe
2014-06-03 19:51 - 2014-06-03 19:51 - 00001168 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-03 19:42 - 2014-06-03 19:42 - 01350991 _____ (Openersoft ) C:\Users\Psycho\Downloads\Flash-3-Update5232014.exe
2014-06-03 19:41 - 2014-06-04 02:13 - 00001087 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-06-03 19:33 - 2014-06-03 19:51 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DVDVideoSoft
2014-06-03 19:23 - 2014-06-03 19:25 - 00000000 ____D () C:\temp
2014-06-03 19:23 - 2014-06-03 19:23 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\dlg
2014-06-03 19:21 - 2014-06-03 19:21 - 00119296 _____ () C:\Windows\system32\ieui64.exe
2014-06-03 02:52 - 2014-06-03 02:52 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-02 09:21 - 2014-06-02 18:41 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DropboxMaster
2014-06-02 09:21 - 2014-06-02 09:21 - 00000000 ____D () C:\Users\Psycho\Desktop\Handy Backups
2014-05-26 22:00 - 2014-05-26 22:08 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Yasemin
2014-05-18 23:35 - 2014-05-18 23:58 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Simone Durmus
2014-05-18 11:03 - 2014-04-19 11:39 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-05-18 11:03 - 2014-04-19 10:45 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-18 11:03 - 2014-04-19 10:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-18 11:03 - 2014-04-19 08:57 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-18 11:03 - 2014-04-19 08:57 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 15:06 - 2014-03-28 10:23 - 19759104 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 15:06 - 2014-03-28 08:18 - 17562112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 15:05 - 2014-04-12 11:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 15:05 - 2014-04-12 11:08 - 01281536 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 15:05 - 2014-04-12 11:08 - 00827904 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 15:05 - 2014-04-12 09:22 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 15:05 - 2014-03-28 21:19 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-05-15 15:05 - 2014-03-24 00:11 - 00269592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-05-15 15:05 - 2014-03-11 05:32 - 06987096 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 15:05 - 2014-03-11 02:38 - 00982016 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 15:05 - 2014-03-04 01:07 - 00570216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-05-15 15:04 - 2014-04-12 11:27 - 00172888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 15:04 - 2014-04-12 11:09 - 01043968 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2014-05-15 15:04 - 2014-04-12 11:09 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-05-15 15:04 - 2014-04-12 11:09 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 15:04 - 2014-04-12 11:09 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 15:04 - 2014-04-12 11:08 - 00439808 _____ (Microsoft Corporation) C:\Windows\system32\lsm.dll
2014-05-15 15:04 - 2014-04-12 11:08 - 00318464 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 15:04 - 2014-04-12 11:07 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00961536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00273920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00178688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 15:04 - 2014-04-12 09:22 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 15:04 - 2014-04-12 08:58 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\workerdd.dll
2014-05-15 15:04 - 2014-03-28 10:23 - 01287168 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2014-05-15 15:04 - 2014-03-11 05:25 - 00100184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 15:04 - 2014-03-11 02:41 - 00559104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 15:04 - 2014-03-11 02:41 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 15:04 - 2014-03-11 02:41 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 15:04 - 2014-03-11 02:39 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 15:04 - 2014-03-11 02:38 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 15:04 - 2014-03-10 05:05 - 00668160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-15 15:04 - 2014-03-10 03:27 - 00099840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 15:03 - 2014-05-06 07:14 - 19274752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 15:03 - 2014-05-06 07:14 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 15:03 - 2014-05-06 05:48 - 14367232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 15:03 - 2014-05-06 05:48 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 15:03 - 2014-05-06 05:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 15:03 - 2014-05-06 05:26 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 15:02 - 2014-03-01 11:47 - 01258496 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-05-15 15:02 - 2014-03-01 11:47 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2014-05-15 15:02 - 2014-03-01 10:07 - 01075200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpedit.dll
2014-05-15 15:02 - 2014-03-01 08:59 - 00974848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-05-15 15:02 - 2014-02-27 01:18 - 00621568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-05-15 15:02 - 2014-02-27 01:18 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-05-15 15:02 - 2014-02-27 01:18 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-05-15 15:02 - 2014-02-27 01:18 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2014-05-15 15:02 - 2014-02-15 06:15 - 00078336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2014-05-10 00:34 - 2014-05-10 00:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-07 22:46 - 2014-06-04 02:19 - 00002990 _____ () C:\Windows\System32\Tasks\AutoKMS
==================== One Month Modified Files and Folders =======
2014-06-04 15:46 - 2014-06-04 15:45 - 00021503 _____ () C:\Users\Psycho\Downloads\FRST.txt
2014-06-04 15:46 - 2014-06-04 15:45 - 00000000 ____D () C:\FRST
2014-06-04 15:46 - 2013-06-09 01:06 - 00000000 ____D () C:\Users\Psycho\AppData\Local\Temp
2014-06-04 15:43 - 2014-06-04 15:43 - 02068992 _____ (Farbar) C:\Users\Psycho\Downloads\FRST64.exe
2014-06-04 15:42 - 2014-06-04 15:42 - 01059840 _____ (Farbar) C:\Users\Psycho\Downloads\FRST.exe
2014-06-04 15:42 - 2013-06-09 01:06 - 01301202 _____ () C:\Windows\WindowsUpdate.log
2014-06-04 15:37 - 2013-09-11 19:37 - 00000000 ____D () C:\Users\Psycho\Documents\Outlook-Dateien
2014-06-04 15:22 - 2013-11-22 08:46 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-04 15:22 - 2013-09-12 00:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-04 15:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-06-04 14:09 - 2014-06-04 02:18 - 00000000 ____D () C:\Users\Psycho\Desktop\Log Dateien
2014-06-04 14:06 - 2014-04-16 22:21 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-04 09:22 - 2013-11-22 08:46 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-04 03:55 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-06-04 02:43 - 2013-06-09 01:14 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3168705560-3439070292-1676408650-1002
2014-06-04 02:35 - 2014-06-04 02:35 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-04 02:34 - 2014-06-04 02:34 - 02347384 _____ (ESET) C:\Users\Psycho\Downloads\esetsmartinstaller_deu.exe
2014-06-04 02:19 - 2014-06-04 02:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-06-04 02:19 - 2014-05-07 22:46 - 00002990 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-06-04 02:19 - 2013-09-11 03:13 - 00000320 _____ () C:\Windows\Tasks\AutoKMS.job
2014-06-04 02:19 - 2012-11-14 07:45 - 00754172 _____ () C:\Windows\system32\perfh007.dat
2014-06-04 02:19 - 2012-11-14 07:45 - 00156362 _____ () C:\Windows\system32\perfc007.dat
2014-06-04 02:19 - 2012-07-26 09:28 - 01748838 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-04 02:16 - 2013-09-11 03:13 - 00151552 _____ () C:\Windows\KMSEmulator.exe
2014-06-04 02:15 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-04 02:14 - 2013-06-09 01:42 - 00000000 ___RD () C:\Windows\BrowserChoice
2014-06-04 02:14 - 2012-11-14 06:59 - 00120970 _____ () C:\Windows\PFRO.log
2014-06-04 02:14 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-06-04 02:13 - 2014-06-04 02:09 - 00000000 ____D () C:\AdwCleaner
2014-06-04 02:13 - 2014-06-03 19:41 - 00001087 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-06-04 02:13 - 2013-09-11 23:23 - 00000000 ____D () C:\ProgramData\ICQ
2014-06-04 02:08 - 2014-06-04 02:08 - 01327971 _____ () C:\Users\Psycho\Downloads\adwcleaner_3.211.exe
2014-06-03 19:51 - 2014-06-03 19:51 - 00001168 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-03 19:51 - 2014-06-03 19:33 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DVDVideoSoft
2014-06-03 19:42 - 2014-06-03 19:42 - 01350991 _____ (Openersoft ) C:\Users\Psycho\Downloads\Flash-3-Update5232014.exe
2014-06-03 19:40 - 2012-07-26 10:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
2014-06-03 19:39 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\Resources
2014-06-03 19:25 - 2014-06-03 19:23 - 00000000 ____D () C:\temp
2014-06-03 19:23 - 2014-06-03 19:23 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\dlg
2014-06-03 19:21 - 2014-06-03 19:21 - 00119296 _____ () C:\Windows\system32\ieui64.exe
2014-06-03 18:27 - 2012-01-13 22:08 - 00024576 _____ () C:\Users\Psycho\Desktop\Schulden.xls
2014-06-03 02:52 - 2014-06-03 02:52 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-03 02:52 - 2014-04-16 22:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-03 02:52 - 2014-04-16 22:20 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-06-03 02:51 - 2013-06-30 13:19 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\Skype
2014-06-02 20:58 - 2013-09-11 02:03 - 00000000 ___RD () C:\Users\Psycho\Dropbox
2014-06-02 18:41 - 2014-06-02 09:21 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DropboxMaster
2014-06-02 18:41 - 2013-09-11 02:00 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\Dropbox
2014-06-02 18:40 - 2013-06-09 01:08 - 00000000 ___RD () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-02 09:24 - 2012-07-26 09:21 - 00045982 _____ () C:\Windows\setupact.log
2014-06-02 09:21 - 2014-06-02 09:21 - 00000000 ____D () C:\Users\Psycho\Desktop\Handy Backups
2014-06-02 09:20 - 2013-09-11 02:03 - 00000986 _____ () C:\Users\Psycho\Desktop\Dropbox.lnk
2014-06-02 09:20 - 2013-09-11 02:01 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-06-01 22:09 - 2013-09-11 23:01 - 00000000 ____D () C:\Users\Psycho\Documents\Deutschkurs
2014-05-30 13:53 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-05-26 22:08 - 2014-05-26 22:00 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Yasemin
2014-05-26 22:08 - 2013-09-11 23:00 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Clarissa
2014-05-26 14:10 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-05-19 16:06 - 2014-04-14 11:25 - 00000000 ____D () C:\ProgramData\Lx_cats
2014-05-19 16:06 - 2013-09-17 12:49 - 00106004 _____ () C:\ProgramData\lxecJSW.log
2014-05-19 16:01 - 2013-09-17 12:42 - 00002506 _____ () C:\ProgramData\lxecscan.log
2014-05-18 23:58 - 2014-05-18 23:35 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Simone Durmus
2014-05-18 11:21 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-05-18 10:58 - 2013-09-12 00:26 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-18 00:03 - 2013-06-09 01:08 - 00000000 ___RD () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-18 00:00 - 2013-06-09 01:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-05-15 20:30 - 2013-09-13 10:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 20:25 - 2012-11-14 08:51 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 20:25 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-05-15 13:46 - 2013-06-09 01:58 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-15 13:46 - 2013-06-09 01:58 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-14 19:23 - 2013-09-12 00:03 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-12 07:26 - 2014-04-16 22:20 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-04-16 22:20 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2013-09-11 23:12 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 09:17 - 2013-11-22 08:46 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-11 09:17 - 2013-11-22 08:46 - 00003866 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-10 00:34 - 2014-05-10 00:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-07 22:57 - 2013-09-11 23:03 - 00000000 ____D () C:\Users\Psycho\Documents\Meine empfangenen Dateien
2014-05-06 07:14 - 2014-05-15 15:03 - 19274752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 07:14 - 2014-05-15 15:03 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 05:48 - 2014-05-15 15:03 - 14367232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:48 - 2014-05-15 15:03 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-06 05:37 - 2014-05-15 15:03 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:26 - 2014-05-15 15:03 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
Some content of TEMP:
====================
C:\Users\Psycho\AppData\Local\Temp\AskSLib.dll
C:\Users\Psycho\AppData\Local\Temp\avgnt.exe
C:\Users\Psycho\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpctaefl.dll
C:\Users\Psycho\AppData\Local\Temp\install_reader11_de_mssd_aaa_aih.exe
C:\Users\Psycho\AppData\Local\Temp\nse3271.exe
C:\Users\Psycho\AppData\Local\Temp\nsi2F82.exe
C:\Users\Psycho\AppData\Local\Temp\nsj69A5.exe
C:\Users\Psycho\AppData\Local\Temp\nsjFE8B.exe
C:\Users\Psycho\AppData\Local\Temp\nsk90AE.tmp.exe
C:\Users\Psycho\AppData\Local\Temp\nsz10C.exe
C:\Users\Psycho\AppData\Local\Temp\ose00000.exe
C:\Users\Psycho\AppData\Local\Temp\Quarantine.exe
C:\Users\Psycho\AppData\Local\Temp\sfextra.dll
C:\Users\Psycho\AppData\Local\Temp\v-bates.exe
C:\Users\Psycho\AppData\Local\Temp\_isBA82.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe
[2014-05-15 15:05] - [2014-04-12 11:10] - 0578048 ____A (Microsoft Corporation) 75DD70A14145499C9F7D903CF9A8C91B
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-06-01 17:31
==================== End Of Log ============================
und meine Addition Datei: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-06-2014
Ran by Psycho at 2014-06-04 15:46:35
Running from C:\Users\Psycho\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
ACD/Labs Software in C:\ACDFREE12\ (HKLM-x32\...\ACDLabs in C__ACDFREE12_) (Version: v12.00, FREE - ACD/Labs)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Allway Sync version 12.16.1 (HKLM-x32\...\Allway Sync_is1) (Version: - Botkind Inc)
Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
AVerMedia A815 USB DVB-T 1.0.64.61 (HKLM-x32\...\AVerMedia A815 USB DVB-T) (Version: 1.0.64.61 - AVerMedia TECHNOLOGIES, Inc.)
AVerTV (HKLM-x32\...\InstallShield_{E28B1E6F-E0AA-4228-AB89-DB4A0C89D426}) (Version: 6.0.18 - AVerMedia Technologies, Inc.)
AVerTV (x32 Version: 6.0.18 - AVerMedia Technologies, Inc.) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
CambridgeSoft Activation Client (HKLM-x32\...\{E773E0B9-6ABE-4F9E-816C-56B2DD8613B9}) (Version: 12.0 - CambridgeSoft Corporation)
Classic Shell (HKLM\...\{FEA1590B-540A-41FC-A95C-664493C82A21}) (Version: 3.6.8 - IvoSoft)
CyberLink LabelPrint 2.5 (x32 Version: 2.5.5415 - CyberLink Corp.) Hidden
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3111_44883 - CyberLink Corp.) Hidden
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.3124 - CyberLink Corp.)
CyberLink PhotoDirector 3 (x32 Version: 3.0.3124 - CyberLink Corp.) Hidden
CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.7717 - CyberLink Corp.)
CyberLink PhotoNow (x32 Version: 1.1.7717 - CyberLink Corp.) Hidden
CyberLink Power2Go 8 (x32 Version: 8.0.0.1920 - CyberLink Corp.) Hidden
CyberLink PowerDirector (Version: 9.0.0.3815c - CyberLink Corp.) Hidden
CyberLink PowerDVD 10 (x32 Version: 10.0.4125.02 - CyberLink Corp.) Hidden
CyberLink PowerDVD Copy 1.5 (x32 Version: 1.5.2715b - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.0913 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.0913 - CyberLink Corp.) Hidden
CyberLink YouCam 5 (x32 Version: 5.0.1930 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0333 - Disc Soft Ltd)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.84 - DivX, LLC)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
doPDF 7.3 printer (HKLM\...\doPDF 7 printer_is1) (Version: - Softland)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
Galería de fotos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.0 - Google Inc.) Hidden
HP Officejet 4620 series - Grundlegende Software für das Gerät (HKLM\...\{B16F9E6E-1388-472C-98C3-F32D397EF85D}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 4620 series Hilfe (HKLM-x32\...\{72EDA2AC-2908-4BB3-97E5-4F9DDEBF9731}) (Version: 6.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
ICQ6.5 (HKLM-x32\...\{60DE4033-9503-48D1-A483-7846BD217CA9}) (Version: 6.5 - ICQ)
Intel PROSet Wireless (Version: - ) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2875 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{E77289CF-12B9-4CAB-A49E-FEAE947F4D95}) (Version: 15.5.4.0423 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{DA2600C1-6BDF-4FD1-8F3D-148929CC1385}) (Version: 2.6.1210.0278 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (HKLM\...\{1593C708-5535-47A4-8C0F-F8D4BE2B4560}) (Version: 15.05.6000.1620 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: - )
IT9130 Driver v12.2.3.1 (HKLM-x32\...\IT9130 DriverInstaller_12.2.3.1) (Version: - )
Java 7 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.400 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mediathek (HKLM-x32\...\{EFFED0C0-5299-422E-AFE6-8B8066D18A2A}) (Version: 1.4.0 - Medion)
Medion Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
Medion Home Cinema 10 (x32 Version: 10.1924 - CyberLink Corp.) Hidden
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)
Microsoft Office 2010 Service Pack 1 (SP1) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version: - )
NVIDIA Control Panel 307.17 (Version: 307.17 - NVIDIA Corporation) Hidden
NVIDIA Graphics Driver 307.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.17 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.85.551 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0081 - Pegatron Corporation)
Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Raccolta foto (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Radio.fx (HKLM-x32\...\Tobit Radio.fx Server) (Version: - Tobit.Software)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6722 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14013.45 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14013.45 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.5 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.5.158 - Skype Technologies S.A.)
Smart PDF Converter 6.3.0.509 (HKLM\...\Smart PDF Converter_is1) (Version: 6.3.0.509 - Smart Soft)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.12.12 - Synaptics Incorporated)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Winamp (HKLM-x32\...\Winamp) (Version: 5.65 - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows Live (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
WISO Sparbuch 2009 (HKLM-x32\...\{00C58EBE-223E-4AB6-8AE9-38F27F4420BD}) (Version: 16.00.6228 - Buhl Data Service GmbH)
WISO Sparbuch 2010 (HKLM-x32\...\{46B70DEB-97B3-4E38-B746-EC16905E6A8F}) (Version: 17.00.6531 - Buhl Data Service GmbH)
WISO Steuer-Sparbuch 2013 (HKLM-x32\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)
WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{C9852DA9-0AD9-4173-B5AD-A3675EB4D3B8}) (Version: 21.00.8480 - Buhl Data Service GmbH)
==================== Restore Points =========================
==================== Hosts content: ==========================
2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0187EF3B-2648-4B9E-B7AF-A878F37A1069} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {0E22486E-BD76-4AB8-82D9-FF0499C69DC1} - System32\Tasks\Dolby Selector => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {513D35BE-9627-43B0-94C2-9AE7C2D66203} - System32\Tasks\Microsoft\Windows\Setup\Windows Upgrade Notification Task => C:\Windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {573EE68F-8CC7-41E1-A50C-2E159B94924B} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2013-09-11] ()
Task: {5E4D3901-C47F-495E-8771-679433B59FF6} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-09-05] (Synaptics Incorporated)
Task: {88DBFEF6-E790-4135-9E5A-1A17A1502E9F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-22] (Google Inc.)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {BA843391-AE6A-4866-849D-C6D572B06E18} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-22] (Google Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D23BB3E4-901B-4577-AEAA-D5784F62CC50} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-11-29 15:32 - 2012-11-29 15:53 - 00805888 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2013-12-09 16:24 - 2010-06-17 21:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2013-09-17 12:44 - 2009-11-04 13:18 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\lxecdrpp.dll
2014-01-02 22:42 - 2009-04-09 08:02 - 00393216 _____ () C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
2013-09-11 23:55 - 2013-06-03 13:06 - 03999512 _____ () C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
2012-11-14 09:45 - 2012-10-19 13:27 - 00386344 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2011-03-17 00:07 - 2011-03-17 00:07 - 04297568 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2012-11-29 15:32 - 2012-11-27 17:18 - 02215424 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2012-11-29 15:32 - 2010-01-12 19:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2012-11-29 15:32 - 2010-01-12 19:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2012-11-29 15:32 - 2010-12-17 16:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2012-11-29 15:32 - 2012-10-23 20:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2012-11-29 15:32 - 2012-08-08 20:10 - 07536128 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2012-11-14 10:03 - 2012-10-22 19:39 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-02 22:42 - 2009-08-01 04:06 - 00155648 _____ () C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
2012-11-29 15:32 - 2009-12-18 17:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2012-11-29 15:32 - 2009-12-18 17:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2012-11-14 09:43 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 13:34 - 2012-06-08 13:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-02-17 11:22 - 2014-02-17 11:22 - 00017920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\PSIClient\b7497ee745bead9869f53a314470edeb\PSIClient.ni.dll
2012-11-14 10:20 - 2012-06-25 11:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-05-10 00:34 - 2014-05-10 00:34 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\Psycho\Documents\Aufenthalsgenehmigung für sahin.doc:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\Aufentshaltgenehmigung 2 .doc:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\Diablo2 Tipps.doc:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\diablo2 tricks.doc:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\Ebay zahlung usw aktuell!.txt:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\gedichte.doc:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\Gesamtfazit.doc:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\ICQLISte.DOC:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\Lasaigne.txt:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\Lastschriftverfahren für ebay ! ! ! !.txt:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\Liebedefinition.doc:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\Neu Textdokument.txt:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\Parfümanwendung.txt:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\Sternzeichen für zwillinge.txt:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\victoria brille.doc:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\What love is.doc:KAVICHS
AlternateDataStreams: C:\Users\Psycho\Documents\zwillinge.txt:KAVICHS
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/04/2014 01:56:28 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Error: (06/04/2014 02:35:27 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Error: (06/04/2014 02:35:13 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Error: (06/04/2014 02:34:57 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Error: (06/04/2014 02:34:57 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Error: (06/04/2014 02:33:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.532, Zeitstempel: 0x53518532
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x1198
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3
Vollständiger Name des fehlerhaften Pakets: mbam.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbam.exe5
Error: (06/04/2014 02:11:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.532, Zeitstempel: 0x53518532
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x146a31f8
ID des fehlerhaften Prozesses: 0x8444
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3
Vollständiger Name des fehlerhaften Pakets: mbam.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbam.exe5
Error: (06/04/2014 01:03:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x5c498482
ID des fehlerhaften Prozesses: 0x9360
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_13_0_0_214.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe2
Berichtskennung: FlashPlayerPlugin_13_0_0_214.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_13_0_0_214.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_13_0_0_214.exe5
Error: (06/04/2014 01:03:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x012d4fa0
ID des fehlerhaften Prozesses: 0x9360
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_13_0_0_214.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe2
Berichtskennung: FlashPlayerPlugin_13_0_0_214.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_13_0_0_214.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_13_0_0_214.exe5
Error: (06/04/2014 01:03:31 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x5c498482
ID des fehlerhaften Prozesses: 0x490c
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_13_0_0_214.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe2
Berichtskennung: FlashPlayerPlugin_13_0_0_214.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_13_0_0_214.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_13_0_0_214.exe5
System errors:
=============
Error: (06/04/2014 02:15:28 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "hmmwwoblzz64" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/03/2014 07:42:41 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Installer" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (06/03/2014 07:40:41 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/03/2014 07:25:46 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Installer" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (06/03/2014 07:23:46 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/02/2014 09:30:18 AM) (Source: DCOM) (EventID: 10010) (User: Psycho-PC)
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Error: (06/02/2014 09:21:49 AM) (Source: DCOM) (EventID: 10010) (User: Psycho-PC)
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Error: (06/02/2014 09:21:00 AM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (05/18/2014 10:56:08 AM) (Source: NetBT) (EventID: 4319) (User: )
Description: Ein doppelter Name wurde im TCP-Netzwerk entdeckt. Die IP-Adresse des Computers,
der die Meldung gesendet hat, steht in den Daten. Verwenden Sie NBTSTAT -n an
der Eingabeaufforderung, um den doppelten Namen zu bestimmen.
Error: (05/18/2014 10:56:08 AM) (Source: NetBT) (EventID: 4319) (User: )
Description: Ein doppelter Name wurde im TCP-Netzwerk entdeckt. Die IP-Adresse des Computers,
der die Meldung gesendet hat, steht in den Daten. Verwenden Sie NBTSTAT -n an
der Eingabeaufforderung, um den doppelten Namen zu bestimmen.
Microsoft Office Sessions:
=========================
Error: (06/04/2014 01:56:28 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (06/04/2014 02:35:27 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Psycho\Downloads\esetsmartinstaller_deu.exe
Error: (06/04/2014 02:35:13 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Psycho\Downloads\esetsmartinstaller_deu.exe
Error: (06/04/2014 02:34:57 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Psycho\Downloads\esetsmartinstaller_deu.exe
Error: (06/04/2014 02:34:57 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Psycho\Downloads\esetsmartinstaller_deu.exe
Error: (06/04/2014 02:33:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.53253518532unknown0.0.0.000000000c000000500000000119801cf7f8aa11b7277C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeunknownd65f7ccc-eb7f-11e3-beae-84a6c8e3c1a9
Error: (06/04/2014 02:11:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.53253518532unknown0.0.0.000000000c0000005146a31f8844401cf7f874ca01966C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeunknownb5eb3564-eb7c-11e3-bead-84a6c8e3c1a9
Error: (06/04/2014 01:03:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_13_0_0_214.exe13.0.0.2145359c61dunknown0.0.0.000000000c00000055c498482936001cf7f800bf345caC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exeunknown4ab4662b-eb73-11e3-bead-84a6c8e3c1a9
Error: (06/04/2014 01:03:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_13_0_0_214.exe13.0.0.2145359c61dunknown0.0.0.000000000c00001a5012d4fa0936001cf7f800bf345caC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exeunknown49f80a85-eb73-11e3-bead-84a6c8e3c1a9
Error: (06/04/2014 01:03:31 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_13_0_0_214.exe13.0.0.2145359c61dunknown0.0.0.000000000c00000055c498482490c01cf7f80033b0a22C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exeunknown477d4ade-eb73-11e3-bead-84a6c8e3c1a9
==================== Memory info ===========================
Percentage of memory in use: 27%
Total physical RAM: 8070.56 MB
Available physical RAM: 5860.95 MB
Total Pagefile: 9286.56 MB
Available Pagefile: 6807.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:869.8 GB) (Free:604.37 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:40.09 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 462A80D0)
Partition: GPT Partition Type.
==================== End Of Log ============================
|
|
05.06.2014, 11:59
| #4 |
| /// the machine /// TB-Ausbilder | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\$RECYCLE.BIN
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Bestehen aktuell noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.06.2014, 19:07
| #5 |
| | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Hi, ich habe deine Anweisungen befolgt. Mein FIXlog. TXT Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-06-2014
Ran by Psycho at 2014-06-06 00:53:00 Run:1
Running from C:\Users\Psycho\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\$RECYCLE.BIN
*****************
C:\$RECYCLE.BIN => Moved successfully.
==== End of Fixlog ====
Aktuell habe ich keine Probleme, da ich mein Internet immer ausgeschaltet habe und sonst nichts mehr mit dem Laptop gemacht habe. Kann ich nun sicher sein, dass alles entfernt wurde? Kann ich nun einen zusätzlichen Lauf mit Avira oder ADWCleaner oder Maleware-Bytes machen, um sicher zu gehen? Gruß Als ich Windows 8 erhielt, hatte ich die App "Clasic Shell" installiert, um einen normalen Windows Start zu erhalten. Ich hatte bis jetzt nie Probleme, aber als ich den TFC laufen lassen hatte, lief mein Windows Start nicht mehr. Daher habe ich das wieder installiert. Dann habe ich einen weiteren Durchlauf mit Malewarebytes durchgeführt und 16 Funde gehabt. Ich habe die vorgewählte Aktion "Einmal ignorieren" angeklickt. Hier ist mein Log File Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 06.06.2014 Suchlauf-Zeit: 19:49:21 Logdatei: Malewarebytes.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.06.06.06 Rootkit Datenbank: v2014.06.02.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 8 CPU: x64 Dateisystem: NTFS Benutzer: Psycho Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 303831 Verstrichene Zeit: 8 Min, 39 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 1 PUP.Optional.HDPlus.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PlusSHD-91, , [c777225315664bebd82cb6ebc93940c0], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 11 PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}),,[b58975001269d066568eed75c63e8878] PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}),,[89b562139dde01353e8f80ec6e96817f] PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJze1NYd1hZXrDVmX6HdO1KqPHi6SVWGVyjsIVNjvLOGVCwduMVrWK7xoiCG0YDhBV4tDersGbJH_ctyRdRdKSypdcxkyxjdYAaw,,, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJze1NYd1hZXrDVmX6HdO1KqPHi6SVWGVyjsIVNjvLOGVCwduMVrWK7xoiCG0YDhBV4tDersGbJH_ctyRdRdKSypdcxkyxjdYAaw,,),,[2d111b5a8eed1e18cf16aab83fc502fe] PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJze1NYd1hZXrDVmX6HdO1KqPHi6SVWGVyjsIVNjvLOGVCwduMVrWK7xoiCG0YDhBV4tDersGbJH_ctyRdRdKSypdcxkyxjdYAaw,,, Gut: (hxxp://www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJze1NYd1hZXrDVmX6HdO1KqPHi6SVWGVyjsIVNjvLOGVCwduMVrWK7xoiCG0YDhBV4tDersGbJH_ctyRdRdKSypdcxkyxjdYAaw,,),,[72cc0c69cab1a591c9051e4e788c43bd] PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}),,[76c893e20d6e1c1a11d2d58df113e020] PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}),,[dc6220557dfebf77efdde9830ef6a858] PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}),,[c17d1461e3986ec88b5b362cf0147987] PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}),,[023c99dcd4a7de585c736a0240c410f0] PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}),,[1c2285f0e79475c1a245e77b956f40c0] PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}),,[0d316a0bc1ba58dec01013590cf8dc24] PUP.Optional.HelperBar.A, HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK2q0U14moCf-ET1EM4uw4GigvFB13oDfsPU-0fo0C6mk55sJDQ4xohNDZLaAF8rHfg6sUO-ocM74Xu5248rkk0nSFXb6p8jqR5aq-nSaqGyJwSN3OCEmmJR3vPBG399YsSIGkNL8xNb9XqixBLpJMRhPKYGkIUaKvcFL7HVrb-nfJwzDNS7tRlKaMrrUg9px3SRfvYqp5N7mtw,,&q={searchTerms}),,[9ba3076e3b40db5bae34293956ae6799] Ordner: 0 (No malicious items detected) Dateien: 4 PUP.Optional.AdPeak.A, C:\temp\InstallFilter64.msi, , [8faf5025502bb3836610fa432dd343bd], PUP.Optional.SupraSavings.A, C:\temp\t.msi, , [1628bfb6017a51e58fc193c6f70d2fd1], PUP.Optional.SupraSavings.A, C:\Windows\Installer\568d5f6a.msi, , [340aa4d115667cbaba9640193fc5ea16], PUP.Optional.SmartBar.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\smartbar_3312014.exe.lnk, , [fe40136213687db9f5b4adf810f247b9], Physische Sektoren: 0 (No malicious items detected) (end) |
|
07.06.2014, 17:11
| #6 |
| /// the machine /// TB-Ausbilder | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Die Funde kanste löschen, wird danach nochmal was gefunden? Das waren nur inaktive Reste.
__________________ --> Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" |
|
07.06.2014, 18:08
| #7 |
| | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Ich habe jetzt nochmal einen Lauf mit Malewarebytes durchgeführt und due Befunde gelöscht. Des Weiteren habe ich einen Durchlauf mit Avira nochmal gemacht. Dort wurde nichts gefunden. Einen weiteren ADWCleaner Durchlauf habe ich ebenfalls gemacht. Dort fand ich eine Datei, die ich gelöscht habe. Ist mein Laptop nun sicher? Sollte ich nochmal einen Durchlauf mit dem FRST oder TFC laufen lassen? Wenn ja, mit welcher Einstellung? Danke, dass du mir bis dato geholfen hast  PS: Ich kann keine Bilder mehr auf Facebook anklicken, die dann vergrößert werden. Ist zwar nen minimales Problem und ich kann damit auch leben, aber höängt das mit diesen Programmen zusammen, die ich laufen lassen habe? |
|
08.06.2014, 09:50
| #8 |
| /// the machine /// TB-Ausbilder | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" in welchem Browser? POste mal ein frisches FRST Log.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.06.2014, 20:10
| #9 |
| | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Huhu, der Browser, den ich benutze, ist Firefox. Und hier mein Log FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-06-2014 02
Ran by Psycho (administrator) on PSYCHO-PC on 09-06-2014 21:06:58
Running from C:\Users\Psycho\Desktop
Platform: Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
( ) C:\Windows\System32\lxeccoms.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
(Dropbox, Inc.) C:\Users\Psycho\AppData\Roaming\Dropbox\bin\Dropbox.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-17] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [11582848 2012-09-30] (Motorola Solutions, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2917176 2012-09-05] (Synaptics Incorporated)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-07-30] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-12-11] (Samsung Electronics Co., Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Run: [AppLauncher] => C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion)\AppLauncher.exe [969656 2012-08-10] (Ashampoo)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1001-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [AlcoholAutomount] => C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [33120 2010-08-20] (Alcohol Soft Development Team)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [rfxsrvtray] => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AlcoholAutomount] => C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [33120 2010-08-20] (Alcohol Soft Development Team)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [rfxsrvtray] => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [AlcoholAutomount] => C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [33120 2010-08-20] (Alcohol Soft Development Team)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [rfxsrvtray] => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVer HID Receiver.lnk
ShortcutTarget: AVer HID Receiver.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVerQuick.lnk
ShortcutTarget: AVerQuick.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe (AVerMedia TECHNOLOGIES, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()
Startup: C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Psycho\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Psycho\AppData\Roaming\Mozilla\Firefox\Profiles\mg72070i.default
FF NewTab: about:blank
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Psycho\AppData\Roaming\Mozilla\Firefox\Profiles\mg72070i.default\Extensions\2020Player_IKEA@2020Technologies.com [2014-02-12]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [348160 2009-09-23] (AVerMedia)
R2 AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [393216 2009-04-09] ()
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [805888 2012-11-29] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 lxec_device; C:\Windows\system32\lxeccoms.exe [1052328 2010-04-14] ( )
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-09-24] ()
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2012-10-19] ()
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [1153840 2012-09-24] (Intel® Corporation)
S2 hmmwwoblzz64; C:\Program Files\003\hmmwwoblzz64.exe run options=01100010030000000000000000000000 sourceguid=6DAF2CD5-832E-48EB-8678-2B122163A2D9 [X]
==================== Drivers (Whitelisted) ====================
S3 AVerAF35; C:\Windows\System32\Drivers\AVerAF35.sys [677632 2010-03-16] (AVerMedia TECHNOLOGIES, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130584 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132480 2012-10-01] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1337216 2012-10-01] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [165504 2012-11-14] (ITE )
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [4309032 2012-10-10] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-09-11] (Duplex Secure Ltd.)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
U3 a2e04q1p; C:\Windows\System32\Drivers\a2e04q1p.sys [0 ] (Intel Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-09 21:06 - 2014-06-09 21:06 - 02080768 _____ (Farbar) C:\Users\Psycho\Desktop\FRST64.exe
2014-06-09 21:06 - 2014-06-09 21:06 - 00022112 _____ () C:\Users\Psycho\Desktop\FRST.txt
2014-06-09 13:37 - 2014-06-09 13:54 - 00000000 ____D () C:\Users\Psycho\Desktop\mevlüd 08.06.2014
2014-06-07 12:02 - 2014-06-07 12:02 - 00000020 ___SH () C:\Users\TEMP\ntuser.ini
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Vorlagen
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Startmenü
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Netzwerkumgebung
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Lokale Einstellungen
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Eigene Dateien
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Druckumgebung
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Documents\Eigene Musik
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Documents\Eigene Bilder
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\AppData\Local\Verlauf
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\AppData\Local\Anwendungsdaten
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Anwendungsdaten
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 ____D () C:\Users\TEMP
2014-06-07 12:02 - 2014-05-17 23:58 - 00000000 ___RD () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-06-07 12:02 - 2013-09-11 02:12 - 00000000 ___RD () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-06-07 12:02 - 2012-08-11 06:24 - 00001217 _____ () C:\Users\TEMP\Desktop\ALDI Foto.lnk
2014-06-07 12:02 - 2012-08-11 06:22 - 00001275 _____ () C:\Users\TEMP\Desktop\Medion Services.lnk
2014-06-07 12:02 - 2012-08-05 14:12 - 00001809 _____ () C:\Users\TEMP\Desktop\ALDI Talk.lnk
2014-06-07 12:02 - 2012-08-05 14:11 - 00001153 _____ () C:\Users\TEMP\Desktop\ALDI Süd Reisen.lnk
2014-06-07 12:02 - 2012-08-05 14:11 - 00001025 _____ () C:\Users\TEMP\Desktop\ALDI Süd Startseite.lnk
2014-06-07 12:02 - 2012-08-05 14:10 - 00001895 _____ () C:\Users\TEMP\Desktop\ALDI Süd Blumen Service.lnk
2014-06-07 12:02 - 2012-07-26 10:13 - 00000000 ___RD () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-06-07 12:02 - 2012-07-26 10:13 - 00000000 ____D () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-06-07 12:02 - 2012-07-26 10:12 - 00000000 ____D () C:\Users\TEMP\AppData\Local\Temp
2014-06-07 11:40 - 2014-06-07 11:40 - 01333465 _____ () C:\Users\Psycho\Downloads\adwcleaner_3.212.exe
2014-06-06 18:35 - 2014-06-07 12:00 - 00002990 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-06-06 18:31 - 2014-06-09 13:55 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\ClassicShell
2014-06-06 18:31 - 2014-06-06 18:30 - 00002162 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\startscreen.lnk
2014-06-06 18:30 - 2014-06-06 18:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2014-06-06 18:30 - 2014-06-06 18:30 - 00000000 ____D () C:\Program Files\Classic Shell
2014-06-06 18:29 - 2014-06-06 18:29 - 06791360 _____ (IvoSoft) C:\Users\Psycho\Downloads\ClassicShellSetup_4_1_0.exe
2014-06-06 00:55 - 2014-06-06 00:55 - 00448512 _____ (OldTimer Tools) C:\Users\Psycho\Desktop\TFC.exe
2014-06-04 15:46 - 2014-06-04 15:48 - 00039342 _____ () C:\Users\Psycho\Downloads\Addition.txt
2014-06-04 15:45 - 2014-06-09 21:07 - 00000000 ____D () C:\FRST
2014-06-04 15:45 - 2014-06-04 15:48 - 00041813 _____ () C:\Users\Psycho\Downloads\FRST.txt
2014-06-04 15:43 - 2014-06-04 15:43 - 02068992 _____ (Farbar) C:\Users\Psycho\Downloads\FRST64.exe
2014-06-04 02:35 - 2014-06-04 02:35 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-04 02:34 - 2014-06-04 02:34 - 02347384 _____ (ESET) C:\Users\Psycho\Downloads\esetsmartinstaller_deu.exe
2014-06-04 02:19 - 2014-06-04 02:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-06-04 02:18 - 2014-06-07 11:45 - 00000000 ____D () C:\Users\Psycho\Desktop\Log Dateien
2014-06-04 02:09 - 2014-06-07 11:42 - 00000000 ____D () C:\AdwCleaner
2014-06-03 19:51 - 2014-06-03 19:51 - 00001168 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-03 19:42 - 2014-06-03 19:42 - 01350991 _____ (Openersoft ) C:\Users\Psycho\Downloads\Flash-3-Update5232014.exe
2014-06-03 19:41 - 2014-06-04 02:13 - 00001087 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-06-03 19:33 - 2014-06-03 19:51 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DVDVideoSoft
2014-06-03 19:23 - 2014-06-07 11:58 - 00000000 ____D () C:\temp
2014-06-03 19:23 - 2014-06-03 19:23 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\dlg
2014-06-03 19:21 - 2014-06-03 19:21 - 00119296 _____ () C:\Windows\system32\ieui64.exe
2014-06-03 02:52 - 2014-06-03 02:52 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-02 09:21 - 2014-06-09 20:58 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DropboxMaster
2014-06-02 09:21 - 2014-06-02 09:21 - 00000000 ____D () C:\Users\Psycho\Desktop\Handy Backups
2014-05-26 22:00 - 2014-05-26 22:08 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Yasemin
2014-05-18 23:35 - 2014-06-05 06:21 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Simone Durmus
2014-05-18 11:03 - 2014-04-19 11:39 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-05-18 11:03 - 2014-04-19 10:45 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-18 11:03 - 2014-04-19 10:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-18 11:03 - 2014-04-19 08:57 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-18 11:03 - 2014-04-19 08:57 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 15:06 - 2014-03-28 10:23 - 19759104 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 15:06 - 2014-03-28 08:18 - 17562112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 15:05 - 2014-04-12 11:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 15:05 - 2014-04-12 11:08 - 01281536 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 15:05 - 2014-04-12 11:08 - 00827904 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 15:05 - 2014-04-12 09:22 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 15:05 - 2014-03-28 21:19 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-05-15 15:05 - 2014-03-24 00:11 - 00269592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-05-15 15:05 - 2014-03-11 05:32 - 06987096 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 15:05 - 2014-03-11 02:38 - 00982016 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 15:05 - 2014-03-04 01:07 - 00570216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-05-15 15:04 - 2014-04-12 11:27 - 00172888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 15:04 - 2014-04-12 11:09 - 01043968 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2014-05-15 15:04 - 2014-04-12 11:09 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-05-15 15:04 - 2014-04-12 11:09 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 15:04 - 2014-04-12 11:09 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 15:04 - 2014-04-12 11:08 - 00439808 _____ (Microsoft Corporation) C:\Windows\system32\lsm.dll
2014-05-15 15:04 - 2014-04-12 11:08 - 00318464 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 15:04 - 2014-04-12 11:07 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00961536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00273920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00178688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 15:04 - 2014-04-12 09:22 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 15:04 - 2014-04-12 08:58 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\workerdd.dll
2014-05-15 15:04 - 2014-03-28 10:23 - 01287168 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2014-05-15 15:04 - 2014-03-11 05:25 - 00100184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 15:04 - 2014-03-11 02:41 - 00559104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 15:04 - 2014-03-11 02:41 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 15:04 - 2014-03-11 02:41 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 15:04 - 2014-03-11 02:39 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 15:04 - 2014-03-11 02:38 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 15:04 - 2014-03-10 05:05 - 00668160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-15 15:04 - 2014-03-10 03:27 - 00099840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 15:03 - 2014-05-06 07:14 - 19274752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 15:03 - 2014-05-06 07:14 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 15:03 - 2014-05-06 05:48 - 14367232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 15:03 - 2014-05-06 05:48 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 15:03 - 2014-05-06 05:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 15:03 - 2014-05-06 05:26 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 15:02 - 2014-03-01 11:47 - 01258496 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-05-15 15:02 - 2014-03-01 11:47 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2014-05-15 15:02 - 2014-03-01 10:07 - 01075200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpedit.dll
2014-05-15 15:02 - 2014-03-01 08:59 - 00974848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-05-15 15:02 - 2014-02-27 01:18 - 00621568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-05-15 15:02 - 2014-02-27 01:18 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-05-15 15:02 - 2014-02-27 01:18 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-05-15 15:02 - 2014-02-27 01:18 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2014-05-15 15:02 - 2014-02-15 06:15 - 00078336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2014-05-10 00:34 - 2014-05-10 00:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2014-06-09 21:07 - 2014-06-09 21:06 - 00022112 _____ () C:\Users\Psycho\Desktop\FRST.txt
2014-06-09 21:07 - 2014-06-04 15:45 - 00000000 ____D () C:\FRST
2014-06-09 21:07 - 2013-06-09 01:06 - 00000000 ____D () C:\Users\Psycho\AppData\Local\Temp
2014-06-09 21:06 - 2014-06-09 21:06 - 02080768 _____ (Farbar) C:\Users\Psycho\Desktop\FRST64.exe
2014-06-09 21:01 - 2013-06-09 01:14 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3168705560-3439070292-1676408650-1002
2014-06-09 21:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-06-09 20:58 - 2014-06-02 09:21 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DropboxMaster
2014-06-09 20:58 - 2013-09-11 02:03 - 00000000 ___RD () C:\Users\Psycho\Dropbox
2014-06-09 20:58 - 2013-09-11 02:00 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\Dropbox
2014-06-09 20:56 - 2013-11-22 08:46 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-09 13:55 - 2014-06-06 18:31 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\ClassicShell
2014-06-09 13:54 - 2014-06-09 13:37 - 00000000 ____D () C:\Users\Psycho\Desktop\mevlüd 08.06.2014
2014-06-09 13:54 - 2013-06-09 01:06 - 01477602 _____ () C:\Windows\WindowsUpdate.log
2014-06-09 13:39 - 2013-09-11 23:42 - 00000000 ____D () C:\Users\Psycho\Desktop\Notenmitteilung
2014-06-09 13:37 - 2012-11-14 07:45 - 00754172 _____ () C:\Windows\system32\perfh007.dat
2014-06-09 13:37 - 2012-11-14 07:45 - 00156362 _____ () C:\Windows\system32\perfc007.dat
2014-06-09 13:37 - 2012-07-26 09:28 - 01748838 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-08 01:22 - 2013-11-22 08:46 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-08 01:22 - 2013-09-12 00:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-07 19:30 - 2013-09-11 19:37 - 00000000 ____D () C:\Users\Psycho\Documents\Outlook-Dateien
2014-06-07 19:10 - 2014-04-16 22:21 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-07 17:53 - 2013-06-09 01:08 - 00000000 ___RD () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-07 12:02 - 2014-06-07 12:02 - 00000020 ___SH () C:\Users\TEMP\ntuser.ini
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Vorlagen
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Startmenü
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Netzwerkumgebung
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Lokale Einstellungen
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Eigene Dateien
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Druckumgebung
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Documents\Eigene Musik
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Documents\Eigene Bilder
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\AppData\Local\Verlauf
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\AppData\Local\Anwendungsdaten
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 _SHDL () C:\Users\TEMP\Anwendungsdaten
2014-06-07 12:02 - 2014-06-07 12:02 - 00000000 ____D () C:\Users\TEMP
2014-06-07 12:00 - 2014-06-06 18:35 - 00002990 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-06-07 12:00 - 2013-09-11 03:13 - 00151552 _____ () C:\Windows\KMSEmulator.exe
2014-06-07 12:00 - 2013-09-11 03:13 - 00000320 _____ () C:\Windows\Tasks\AutoKMS.job
2014-06-07 11:59 - 2012-11-14 06:59 - 00122260 _____ () C:\Windows\PFRO.log
2014-06-07 11:59 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-07 11:58 - 2014-06-03 19:23 - 00000000 ____D () C:\temp
2014-06-07 11:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
2014-06-07 11:45 - 2014-06-04 02:18 - 00000000 ____D () C:\Users\Psycho\Desktop\Log Dateien
2014-06-07 11:42 - 2014-06-04 02:09 - 00000000 ____D () C:\AdwCleaner
2014-06-07 11:40 - 2014-06-07 11:40 - 01333465 _____ () C:\Users\Psycho\Downloads\adwcleaner_3.212.exe
2014-06-06 18:43 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-06-06 18:32 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-06-06 18:30 - 2014-06-06 18:31 - 00002162 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\startscreen.lnk
2014-06-06 18:30 - 2014-06-06 18:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2014-06-06 18:30 - 2014-06-06 18:30 - 00000000 ____D () C:\Program Files\Classic Shell
2014-06-06 18:29 - 2014-06-06 18:29 - 06791360 _____ (IvoSoft) C:\Users\Psycho\Downloads\ClassicShellSetup_4_1_0.exe
2014-06-06 00:55 - 2014-06-06 00:55 - 00448512 _____ (OldTimer Tools) C:\Users\Psycho\Desktop\TFC.exe
2014-06-05 06:26 - 2014-04-14 11:25 - 00000000 ____D () C:\ProgramData\Lx_cats
2014-06-05 06:25 - 2013-09-17 12:49 - 00109394 _____ () C:\ProgramData\lxecJSW.log
2014-06-05 06:25 - 2013-09-11 23:00 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Clarissa
2014-06-05 06:21 - 2014-05-18 23:35 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Simone Durmus
2014-06-05 06:20 - 2013-09-17 12:42 - 00002616 _____ () C:\ProgramData\lxecscan.log
2014-06-04 15:48 - 2014-06-04 15:46 - 00039342 _____ () C:\Users\Psycho\Downloads\Addition.txt
2014-06-04 15:48 - 2014-06-04 15:45 - 00041813 _____ () C:\Users\Psycho\Downloads\FRST.txt
2014-06-04 15:43 - 2014-06-04 15:43 - 02068992 _____ (Farbar) C:\Users\Psycho\Downloads\FRST64.exe
2014-06-04 03:55 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-06-04 02:35 - 2014-06-04 02:35 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-04 02:34 - 2014-06-04 02:34 - 02347384 _____ (ESET) C:\Users\Psycho\Downloads\esetsmartinstaller_deu.exe
2014-06-04 02:19 - 2014-06-04 02:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-06-04 02:14 - 2013-06-09 01:42 - 00000000 ___RD () C:\Windows\BrowserChoice
2014-06-04 02:13 - 2014-06-03 19:41 - 00001087 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-06-04 02:13 - 2013-09-11 23:23 - 00000000 ____D () C:\ProgramData\ICQ
2014-06-03 19:51 - 2014-06-03 19:51 - 00001168 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-03 19:51 - 2014-06-03 19:33 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DVDVideoSoft
2014-06-03 19:42 - 2014-06-03 19:42 - 01350991 _____ (Openersoft ) C:\Users\Psycho\Downloads\Flash-3-Update5232014.exe
2014-06-03 19:39 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\Resources
2014-06-03 19:23 - 2014-06-03 19:23 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\dlg
2014-06-03 19:21 - 2014-06-03 19:21 - 00119296 _____ () C:\Windows\system32\ieui64.exe
2014-06-03 18:27 - 2012-01-13 22:08 - 00024576 _____ () C:\Users\Psycho\Desktop\Schulden.xls
2014-06-03 02:52 - 2014-06-03 02:52 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-03 02:52 - 2014-04-16 22:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-03 02:52 - 2014-04-16 22:20 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-06-03 02:51 - 2013-06-30 13:19 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\Skype
2014-06-02 09:24 - 2012-07-26 09:21 - 00045982 _____ () C:\Windows\setupact.log
2014-06-02 09:21 - 2014-06-02 09:21 - 00000000 ____D () C:\Users\Psycho\Desktop\Handy Backups
2014-06-02 09:20 - 2013-09-11 02:03 - 00000986 _____ () C:\Users\Psycho\Desktop\Dropbox.lnk
2014-06-02 09:20 - 2013-09-11 02:01 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-06-01 22:09 - 2013-09-11 23:01 - 00000000 ____D () C:\Users\Psycho\Documents\Deutschkurs
2014-05-26 22:08 - 2014-05-26 22:00 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Yasemin
2014-05-26 14:10 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-05-18 11:21 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-05-18 10:58 - 2013-09-12 00:26 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-18 00:03 - 2013-06-09 01:08 - 00000000 ___RD () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-18 00:00 - 2013-06-09 01:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-17 23:58 - 2014-06-07 12:02 - 00000000 ___RD () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-05-15 20:30 - 2013-09-13 10:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 20:25 - 2012-11-14 08:51 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 20:25 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-05-15 13:46 - 2013-06-09 01:58 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-15 13:46 - 2013-06-09 01:58 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-14 19:23 - 2013-09-12 00:03 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-12 07:26 - 2014-04-16 22:20 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-04-16 22:20 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2013-09-11 23:12 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 09:17 - 2013-11-22 08:46 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-11 09:17 - 2013-11-22 08:46 - 00003866 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-10 00:34 - 2014-05-10 00:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
Some content of TEMP:
====================
C:\Users\Psycho\AppData\Local\Temp\avgnt.exe
C:\Users\Psycho\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprv0zay.dll
C:\Users\Psycho\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-06-01 17:31
==================== End Of Log ============================
|
|
10.06.2014, 14:28
| #10 |
| /// the machine /// TB-Ausbilder | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.06.2014, 21:07
| #11 |
| | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Wenn ich damit fir3fox deinstalliere und neu installiere, sind dann meine favoriten auch gelöscht? Kann ich sie nicht irgendwie noch sichern? Hey, ich habe nun dieLesezeichen von meinem Firefox exportiert, komplett deinstalliert und nochmal installiert. Dann habe ich die Einstellungen zurücksetzen lassen und meine Favoriten wieder importiert. Dann habe ich den ADW Cleaner durchlaufen lassen und dann nochmal mit dem FRST. Hier meine Logs: FRST: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-06-2014 02
Ran by Psycho (administrator) on PSYCHO-PC on 10-06-2014 22:02:43
Running from C:\Users\Psycho\Desktop
Platform: Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
( ) C:\Windows\System32\lxeccoms.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\HPNetworkCommunicator.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-17] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [11582848 2012-09-30] (Motorola Solutions, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2917176 2012-09-05] (Synaptics Incorporated)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-07-30] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-12-11] (Samsung Electronics Co., Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-3168705560-3439070292-1676408650-1001\...\Run: [AppLauncher] => C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion)\AppLauncher.exe [969656 2012-08-10] (Ashampoo)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1001\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [AlcoholAutomount] => C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [33120 2010-08-20] (Alcohol Soft Development Team)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [rfxsrvtray] => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3168705560-3439070292-1676408650-1002\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVer HID Receiver.lnk
ShortcutTarget: AVer HID Receiver.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVerQuick.lnk
ShortcutTarget: AVerQuick.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe (AVerMedia TECHNOLOGIES, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Psycho\AppData\Roaming\Mozilla\Firefox\Profiles\x0mjifr7.default-1402429610148
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [348160 2009-09-23] (AVerMedia)
R2 AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [393216 2009-04-09] ()
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [805888 2012-11-29] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 lxec_device; C:\Windows\system32\lxeccoms.exe [1052328 2010-04-14] ( )
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-09-24] ()
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2012-10-19] ()
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [1153840 2012-09-24] (Intel® Corporation)
S2 hmmwwoblzz64; C:\Program Files\003\hmmwwoblzz64.exe run options=01100010030000000000000000000000 sourceguid=6DAF2CD5-832E-48EB-8678-2B122163A2D9 [X]
==================== Drivers (Whitelisted) ====================
S3 AVerAF35; C:\Windows\System32\Drivers\AVerAF35.sys [677632 2010-03-16] (AVerMedia TECHNOLOGIES, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130584 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132480 2012-10-01] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1337216 2012-10-01] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [165504 2012-11-14] (ITE )
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [4309032 2012-10-10] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-09-11] (Duplex Secure Ltd.)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
U3 ain51ok7; C:\Windows\System32\Drivers\ain51ok7.sys [0 ] (Intel Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-10 22:02 - 2014-06-10 22:02 - 00018781 _____ () C:\Users\Psycho\Desktop\FRST.txt
2014-06-10 22:00 - 2014-06-10 22:00 - 00002990 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-06-10 21:46 - 2014-06-10 21:46 - 00000000 ____D () C:\Users\Psycho\Desktop\Alte Firefox-Daten
2014-06-10 21:43 - 2014-06-10 21:43 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-10 21:43 - 2014-06-10 21:43 - 00001155 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-10 21:43 - 2014-06-10 21:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-10 21:42 - 2014-06-10 21:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-10 21:37 - 2014-06-10 21:37 - 00001272 _____ () C:\Users\Psycho\Desktop\Revo Uninstaller.lnk
2014-06-10 21:37 - 2014-06-10 21:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-10 21:36 - 2014-06-10 21:36 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Psycho\Downloads\revosetup95.exe
2014-06-10 21:33 - 2014-06-10 21:34 - 00000000 ____D () C:\Users\Psycho\Downloads\Lesezeichnen
2014-06-10 21:31 - 2014-06-10 21:31 - 00283144 _____ (Mozilla) C:\Users\Psycho\Downloads\Firefox Setup Stub 29.0.1.exe
2014-06-09 21:06 - 2014-06-09 21:06 - 02080768 _____ (Farbar) C:\Users\Psycho\Desktop\FRST64.exe
2014-06-09 13:37 - 2014-06-09 13:54 - 00000000 ____D () C:\Users\Psycho\Desktop\mevlüd 08.06.2014
2014-06-07 11:40 - 2014-06-07 11:40 - 01333465 _____ () C:\Users\Psycho\Downloads\adwcleaner_3.212.exe
2014-06-06 18:31 - 2014-06-10 21:54 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\ClassicShell
2014-06-06 18:31 - 2014-06-06 18:30 - 00002162 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\startscreen.lnk
2014-06-06 18:30 - 2014-06-06 18:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2014-06-06 18:30 - 2014-06-06 18:30 - 00000000 ____D () C:\Program Files\Classic Shell
2014-06-06 18:29 - 2014-06-06 18:29 - 06791360 _____ (IvoSoft) C:\Users\Psycho\Downloads\ClassicShellSetup_4_1_0.exe
2014-06-06 00:55 - 2014-06-06 00:55 - 00448512 _____ (OldTimer Tools) C:\Users\Psycho\Desktop\TFC.exe
2014-06-04 15:46 - 2014-06-04 15:48 - 00039342 _____ () C:\Users\Psycho\Downloads\Addition.txt
2014-06-04 15:45 - 2014-06-10 22:02 - 00000000 ____D () C:\FRST
2014-06-04 15:45 - 2014-06-04 15:48 - 00041813 _____ () C:\Users\Psycho\Downloads\FRST.txt
2014-06-04 15:43 - 2014-06-04 15:43 - 02068992 _____ (Farbar) C:\Users\Psycho\Downloads\FRST64.exe
2014-06-04 02:35 - 2014-06-04 02:35 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-04 02:34 - 2014-06-04 02:34 - 02347384 _____ (ESET) C:\Users\Psycho\Downloads\esetsmartinstaller_deu.exe
2014-06-04 02:19 - 2014-06-04 02:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-06-04 02:18 - 2014-06-10 22:02 - 00000000 ____D () C:\Users\Psycho\Desktop\Log Dateien
2014-06-04 02:09 - 2014-06-10 21:56 - 00000000 ____D () C:\AdwCleaner
2014-06-03 19:42 - 2014-06-03 19:42 - 01350991 _____ (Openersoft ) C:\Users\Psycho\Downloads\Flash-3-Update5232014.exe
2014-06-03 19:33 - 2014-06-03 19:51 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DVDVideoSoft
2014-06-03 19:23 - 2014-06-07 11:58 - 00000000 ____D () C:\temp
2014-06-03 19:23 - 2014-06-03 19:23 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\dlg
2014-06-03 19:21 - 2014-06-03 19:21 - 00119296 _____ () C:\Windows\system32\ieui64.exe
2014-06-03 02:52 - 2014-06-03 02:52 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-02 09:21 - 2014-06-10 21:32 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DropboxMaster
2014-06-02 09:21 - 2014-06-02 09:21 - 00000000 ____D () C:\Users\Psycho\Desktop\Handy Backups
2014-05-26 22:00 - 2014-05-26 22:08 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Yasemin
2014-05-18 23:35 - 2014-06-05 06:21 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Simone Durmus
2014-05-18 11:03 - 2014-04-19 11:39 - 00628024 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-05-18 11:03 - 2014-04-19 10:45 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-18 11:03 - 2014-04-19 10:45 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-18 11:03 - 2014-04-19 08:57 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-18 11:03 - 2014-04-19 08:57 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 15:06 - 2014-03-28 10:23 - 19759104 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 15:06 - 2014-03-28 08:18 - 17562112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 15:05 - 2014-04-12 11:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 15:05 - 2014-04-12 11:08 - 01281536 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 15:05 - 2014-04-12 11:08 - 00827904 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 15:05 - 2014-04-12 09:22 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 15:05 - 2014-03-28 21:19 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-05-15 15:05 - 2014-03-24 00:11 - 00269592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-05-15 15:05 - 2014-03-11 05:32 - 06987096 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 15:05 - 2014-03-11 02:38 - 00982016 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 15:05 - 2014-03-04 01:07 - 00570216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-05-15 15:04 - 2014-04-12 11:27 - 00172888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 15:04 - 2014-04-12 11:09 - 01043968 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2014-05-15 15:04 - 2014-04-12 11:09 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-05-15 15:04 - 2014-04-12 11:09 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 15:04 - 2014-04-12 11:09 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 15:04 - 2014-04-12 11:08 - 00439808 _____ (Microsoft Corporation) C:\Windows\system32\lsm.dll
2014-05-15 15:04 - 2014-04-12 11:08 - 00318464 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 15:04 - 2014-04-12 11:07 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00961536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00273920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00178688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 15:04 - 2014-04-12 09:23 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 15:04 - 2014-04-12 09:22 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 15:04 - 2014-04-12 08:58 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\workerdd.dll
2014-05-15 15:04 - 2014-03-28 10:23 - 01287168 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2014-05-15 15:04 - 2014-03-11 05:25 - 00100184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 15:04 - 2014-03-11 02:41 - 00559104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 15:04 - 2014-03-11 02:41 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 15:04 - 2014-03-11 02:41 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 15:04 - 2014-03-11 02:39 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 15:04 - 2014-03-11 02:38 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 15:04 - 2014-03-11 02:38 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 15:04 - 2014-03-10 05:05 - 00668160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-15 15:04 - 2014-03-10 03:27 - 00099840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 15:03 - 2014-05-06 07:14 - 19274752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 15:03 - 2014-05-06 07:14 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 15:03 - 2014-05-06 05:48 - 14367232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 15:03 - 2014-05-06 05:48 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 15:03 - 2014-05-06 05:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 15:03 - 2014-05-06 05:26 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 15:02 - 2014-03-01 11:47 - 01258496 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-05-15 15:02 - 2014-03-01 11:47 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2014-05-15 15:02 - 2014-03-01 10:07 - 01075200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpedit.dll
2014-05-15 15:02 - 2014-03-01 08:59 - 00974848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-05-15 15:02 - 2014-02-27 01:18 - 00621568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-05-15 15:02 - 2014-02-27 01:18 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-05-15 15:02 - 2014-02-27 01:18 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-05-15 15:02 - 2014-02-27 01:18 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2014-05-15 15:02 - 2014-02-15 06:15 - 00078336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
==================== One Month Modified Files and Folders =======
2014-06-10 22:03 - 2014-06-10 22:02 - 00018781 _____ () C:\Users\Psycho\Desktop\FRST.txt
2014-06-10 22:03 - 2013-06-09 01:06 - 00000000 ____D () C:\Users\Psycho\AppData\Local\Temp
2014-06-10 22:02 - 2014-06-04 15:45 - 00000000 ____D () C:\FRST
2014-06-10 22:02 - 2014-06-04 02:18 - 00000000 ____D () C:\Users\Psycho\Desktop\Log Dateien
2014-06-10 22:00 - 2014-06-10 22:00 - 00002990 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-06-10 22:00 - 2013-09-11 03:13 - 00000320 _____ () C:\Windows\Tasks\AutoKMS.job
2014-06-10 22:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-06-10 21:58 - 2013-11-22 08:46 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-10 21:58 - 2013-09-11 03:13 - 00151552 _____ () C:\Windows\KMSEmulator.exe
2014-06-10 21:57 - 2012-11-14 06:59 - 00123358 _____ () C:\Windows\PFRO.log
2014-06-10 21:57 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-10 21:56 - 2014-06-04 02:09 - 00000000 ____D () C:\AdwCleaner
2014-06-10 21:54 - 2014-06-06 18:31 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\ClassicShell
2014-06-10 21:54 - 2013-09-11 19:37 - 00000000 ____D () C:\Users\Psycho\Documents\Outlook-Dateien
2014-06-10 21:46 - 2014-06-10 21:46 - 00000000 ____D () C:\Users\Psycho\Desktop\Alte Firefox-Daten
2014-06-10 21:43 - 2014-06-10 21:43 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-10 21:43 - 2014-06-10 21:43 - 00001155 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-10 21:43 - 2014-06-10 21:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-10 21:43 - 2014-06-10 21:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-10 21:43 - 2013-06-09 01:50 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\Mozilla
2014-06-10 21:37 - 2014-06-10 21:37 - 00001272 _____ () C:\Users\Psycho\Desktop\Revo Uninstaller.lnk
2014-06-10 21:37 - 2014-06-10 21:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-10 21:36 - 2014-06-10 21:36 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Psycho\Downloads\revosetup95.exe
2014-06-10 21:35 - 2012-11-14 07:45 - 00754172 _____ () C:\Windows\system32\perfh007.dat
2014-06-10 21:35 - 2012-11-14 07:45 - 00156362 _____ () C:\Windows\system32\perfc007.dat
2014-06-10 21:35 - 2012-07-26 09:28 - 01748838 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-10 21:34 - 2014-06-10 21:33 - 00000000 ____D () C:\Users\Psycho\Downloads\Lesezeichnen
2014-06-10 21:32 - 2014-06-02 09:21 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DropboxMaster
2014-06-10 21:32 - 2013-09-11 02:03 - 00000000 ___RD () C:\Users\Psycho\Dropbox
2014-06-10 21:32 - 2013-09-11 02:00 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\Dropbox
2014-06-10 21:31 - 2014-06-10 21:31 - 00283144 _____ (Mozilla) C:\Users\Psycho\Downloads\Firefox Setup Stub 29.0.1.exe
2014-06-10 21:27 - 2013-06-09 01:14 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3168705560-3439070292-1676408650-1002
2014-06-10 15:11 - 2013-06-09 01:06 - 01537844 _____ () C:\Windows\WindowsUpdate.log
2014-06-10 14:22 - 2013-11-22 08:46 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-10 14:22 - 2013-09-12 00:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-10 13:36 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-06-09 21:07 - 2013-06-09 01:08 - 00000000 ___RD () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-09 21:06 - 2014-06-09 21:06 - 02080768 _____ (Farbar) C:\Users\Psycho\Desktop\FRST64.exe
2014-06-09 13:54 - 2014-06-09 13:37 - 00000000 ____D () C:\Users\Psycho\Desktop\mevlüd 08.06.2014
2014-06-09 13:39 - 2013-09-11 23:42 - 00000000 ____D () C:\Users\Psycho\Desktop\Notenmitteilung
2014-06-07 19:10 - 2014-04-16 22:21 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-07 11:58 - 2014-06-03 19:23 - 00000000 ____D () C:\temp
2014-06-07 11:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
2014-06-07 11:40 - 2014-06-07 11:40 - 01333465 _____ () C:\Users\Psycho\Downloads\adwcleaner_3.212.exe
2014-06-06 18:32 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-06-06 18:30 - 2014-06-06 18:31 - 00002162 _____ () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\startscreen.lnk
2014-06-06 18:30 - 2014-06-06 18:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2014-06-06 18:30 - 2014-06-06 18:30 - 00000000 ____D () C:\Program Files\Classic Shell
2014-06-06 18:29 - 2014-06-06 18:29 - 06791360 _____ (IvoSoft) C:\Users\Psycho\Downloads\ClassicShellSetup_4_1_0.exe
2014-06-06 00:55 - 2014-06-06 00:55 - 00448512 _____ (OldTimer Tools) C:\Users\Psycho\Desktop\TFC.exe
2014-06-05 06:26 - 2014-04-14 11:25 - 00000000 ____D () C:\ProgramData\Lx_cats
2014-06-05 06:25 - 2013-09-17 12:49 - 00109394 _____ () C:\ProgramData\lxecJSW.log
2014-06-05 06:25 - 2013-09-11 23:00 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Clarissa
2014-06-05 06:21 - 2014-05-18 23:35 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Simone Durmus
2014-06-05 06:20 - 2013-09-17 12:42 - 00002616 _____ () C:\ProgramData\lxecscan.log
2014-06-04 15:48 - 2014-06-04 15:46 - 00039342 _____ () C:\Users\Psycho\Downloads\Addition.txt
2014-06-04 15:48 - 2014-06-04 15:45 - 00041813 _____ () C:\Users\Psycho\Downloads\FRST.txt
2014-06-04 15:43 - 2014-06-04 15:43 - 02068992 _____ (Farbar) C:\Users\Psycho\Downloads\FRST64.exe
2014-06-04 03:55 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-06-04 02:35 - 2014-06-04 02:35 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-04 02:34 - 2014-06-04 02:34 - 02347384 _____ (ESET) C:\Users\Psycho\Downloads\esetsmartinstaller_deu.exe
2014-06-04 02:19 - 2014-06-04 02:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-06-04 02:14 - 2013-06-09 01:42 - 00000000 ___RD () C:\Windows\BrowserChoice
2014-06-04 02:13 - 2013-09-11 23:23 - 00000000 ____D () C:\ProgramData\ICQ
2014-06-03 19:51 - 2014-06-03 19:33 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\DVDVideoSoft
2014-06-03 19:42 - 2014-06-03 19:42 - 01350991 _____ (Openersoft ) C:\Users\Psycho\Downloads\Flash-3-Update5232014.exe
2014-06-03 19:39 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\Resources
2014-06-03 19:23 - 2014-06-03 19:23 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\dlg
2014-06-03 19:21 - 2014-06-03 19:21 - 00119296 _____ () C:\Windows\system32\ieui64.exe
2014-06-03 18:27 - 2012-01-13 22:08 - 00024576 _____ () C:\Users\Psycho\Desktop\Schulden.xls
2014-06-03 02:52 - 2014-06-03 02:52 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-03 02:52 - 2014-04-16 22:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-03 02:52 - 2014-04-16 22:20 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-06-03 02:51 - 2013-06-30 13:19 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\Skype
2014-06-02 09:24 - 2012-07-26 09:21 - 00045982 _____ () C:\Windows\setupact.log
2014-06-02 09:21 - 2014-06-02 09:21 - 00000000 ____D () C:\Users\Psycho\Desktop\Handy Backups
2014-06-02 09:20 - 2013-09-11 02:03 - 00000986 _____ () C:\Users\Psycho\Desktop\Dropbox.lnk
2014-06-02 09:20 - 2013-09-11 02:01 - 00000000 ____D () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-06-01 22:09 - 2013-09-11 23:01 - 00000000 ____D () C:\Users\Psycho\Documents\Deutschkurs
2014-05-26 22:08 - 2014-05-26 22:00 - 00000000 ____D () C:\Users\Psycho\Documents\Bewerbung Yasemin
2014-05-26 14:10 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-05-18 11:21 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-05-18 10:58 - 2013-09-12 00:26 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-18 00:03 - 2013-06-09 01:08 - 00000000 ___RD () C:\Users\Psycho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-17 23:58 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-05-15 20:30 - 2013-09-13 10:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 20:25 - 2012-11-14 08:51 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 20:25 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-05-15 13:46 - 2013-06-09 01:58 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-15 13:46 - 2013-06-09 01:58 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-14 19:23 - 2013-09-12 00:03 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-12 07:26 - 2014-04-16 22:20 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-04-16 22:20 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2013-09-11 23:12 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 09:17 - 2013-11-22 08:46 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-11 09:17 - 2013-11-22 08:46 - 00003866 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
Some content of TEMP:
====================
C:\Users\Psycho\AppData\Local\Temp\avgnt.exe
C:\Users\Psycho\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpoybese.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-06-10 11:55
==================== End Of Log ============================
--- --- --- und hier von meinem ADW Cleaner: Code:
ATTFilter # AdwCleaner v3.212 - Bericht erstellt am 10/06/2014 um 21:56:43
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 8 (64 bits)
# Benutzername : Psycho - PSYCHO-PC
# Gestartet von : C:\Users\Psycho\Downloads\adwcleaner_3.212.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16537
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\Psycho\AppData\Roaming\Mozilla\Firefox\Profiles\x0mjifr7.default-1402429610148\prefs.js ]
*************************
AdwCleaner[R0].txt - [9659 octets] - [04/06/2014 02:10:14]
AdwCleaner[R1].txt - [9719 octets] - [04/06/2014 02:12:59]
AdwCleaner[R2].txt - [1195 octets] - [07/06/2014 11:41:06]
AdwCleaner[R3].txt - [1316 octets] - [09/06/2014 21:23:41]
AdwCleaner[R4].txt - [1225 octets] - [10/06/2014 21:55:17]
AdwCleaner[S0].txt - [7191 octets] - [04/06/2014 02:13:34]
AdwCleaner[S1].txt - [1257 octets] - [07/06/2014 11:42:26]
AdwCleaner[S2].txt - [1377 octets] - [09/06/2014 21:25:02]
AdwCleaner[S3].txt - [1147 octets] - [10/06/2014 21:56:43]
########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1207 octets] ##########
Lieben Gruß |
|
11.06.2014, 20:08
| #12 |
| /// the machine /// TB-Ausbilder | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Das ist kein Fund sondern einfach nur dein FF Profil Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter S2 hmmwwoblzz64; C:\Program Files\003\hmmwwoblzz64.exe run options=01100010030000000000000000000000 sourceguid=6DAF2CD5-832E-48EB-8678-2B122163A2D9 [X]
C:\Program Files\003
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.06.2014, 21:27
| #13 |
| | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Könntest du mir evtl bitte sagen, was genau dieser Fix bewerkstelligt? Nur als Info? Schon mal vielen Dank für die Info Und ich meine ich habe keinen Defogger und keinen Combofix benutzt. Fallen dann diese Sachen für mich weg und fange dann direkt bei nr 3 an oder fällt dann alles weg? Hier den Inhalt: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-06-2014 01
Ran by Psycho at 2014-06-11 22:53:29 Run:2
Running from C:\Users\Psycho\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
S2 hmmwwoblzz64; C:\Program Files\003\hmmwwoblzz64.exe run options=01100010030000000000000000000000 sourceguid=6DAF2CD5-832E-48EB-8678-2B122163A2D9 [X]
C:\Program Files\003
*****************
hmmwwoblzz64 => Service deleted successfully.
"C:\Program Files\003" => File/Directory not found.
==== End of Fixlog ====
Geändert von sgsadurm (11.06.2014 um 21:54 Uhr) |
|
12.06.2014, 08:32
| #14 |
| /// the machine /// TB-Ausbilder | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Wir haben da jetzt noch einen Adware-Dienst gelöscht, das war aber nur ein inaktiver Rest
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.06.2014, 19:25
| #15 |
| | Fenster öffnen sich und Antivirus Meldung "pup.optional.VBates" Ok Dann hoffe ich nun, dass mein System gesäubert ist und ich danke dir herzlichst. Dann kannst du wahrscheinlich diesen Thread abmelden. Lg |
|
Linear-Darstellung
