| |
| |||||||
Log-Analyse und Auswertung: Virenbefall: IE versucht ständig www_getwindowinfo/ zu öffnenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
19.06.2014, 19:11
| #1 |
| |  Virenbefall: IE versucht ständig www_getwindowinfo/ zu öffnen Hallo, ich habe heute, vom Sohn meines Cousins, das Laptop auf den Tisch bekommen. Mit der Info "Ich glaub ich habe einen Virus". Nach kurzer Google-Suche bin ich bei euch gelandet. Was bisher schon gemacht wurde kann ich nicht sagen, da bereits ein "Freund" am Computer die Probleme lösen wollte. folgende Log files sind von mir erstellt worden: Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:20 on 19/06/2014 (#)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-06-2014 Ran by # (administrator) on PC on 19-06-2014 18:21:05 Running from C:\Users\#\Desktop Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe () C:\Program Files (x86)\Flash Component Manager\srvhelper32.exe (Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Atheros) C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe ==================== Registry (Whitelisted) ================== HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation) HKLM-x32\...\Run: [Windows Servelet System Component] => C:\Program Files (x86)\Flash Component Manager\srvhelper32.exe [640512 2014-05-23] () HKLM-x32\...\Run: [Registry Helper] => "C:\Program Files (x86)\Registry Helper\RegistryHelper.Exe" /boot Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid} HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid} HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid} HKU\S-1-5-21-4051477998-2399887422-2401488135-1000\...\Run: [lollipop_11291349] => "c:\users\#\appdata\local\lollipop\lollipop_11291349.exe" lollipop_11291349 Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=75087&st=home&tid=8679&ver=5.5&ts=1385398089689&tguid=75087-8679-1385398089689-5E5E6A2512F3C5FC1C14CCAA1B73FCC4 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1400509729&from=cor&uid=ST320LT020-9YG142_W0Q481TSXXXXW0Q481TS&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1400509729&from=cor&uid=ST320LT020-9YG142_W0Q481TSXXXXW0Q481TS&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=75087&st=home&tid=8679&ver=5.5&ts=1385398089689&tguid=75087-8679-1385398089689-5E5E6A2512F3C5FC1C14CCAA1B73FCC4 StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM - {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_frmr_14_22_ff&cd=2XzuyEtN2Y1L1Qzu0EtDtDyC0EyCtCyB0B0DyC0EyDyCtDyEtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyByC0D0EyB0EyE0EtG0E0B0EtCtGyEzyyE0BtGtBzyyDtAtGtBtBtD0F0B0BtB0CtCtDyBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzyzz0DzytCyCyBtG0BtA0F0AtG0D0FtB0EtG0DtCyBtDtGtAyEtC0A0A0BtAyDzy0C0Fzy2Q&cr=1063359865&ir= SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=eb1bbda8-dabe-0ccb-9a58-f2917e0ef458&searchtype=ds&q={searchTerms}&installDate=25/11/2013 SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=eb1bbda8-dabe-0ccb-9a58-f2917e0ef458&searchtype=ds&q={searchTerms}&installDate=25/11/2013 SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=75087&st=bs&tid=8679&ver=5.5&ts=1385398089689&tguid=75087-8679-1385398089689-5E5E6A2512F3C5FC1C14CCAA1B73FCC4&q={searchTerms} SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=eb1bbda8-dabe-0ccb-9a58-f2917e0ef458&searchtype=ds&q={searchTerms}&installDate=25/11/2013 SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=eb1bbda8-dabe-0ccb-9a58-f2917e0ef458&searchtype=ds&q={searchTerms}&installDate=25/11/2013 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=116257&tt=5112_8&babsrc=SP_ss&mntrId=3a695604000000000000000000000000 SearchScopes: HKCU - {0F9D3338-9E60-4D7D-A43A-6A5F002C0E85} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10978 SearchScopes: HKCU - {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_frmr_14_22_ff&cd=2XzuyEtN2Y1L1Qzu0EtDtDyC0EyCtCyB0B0DyC0EyDyCtDyEtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyByC0D0EyB0EyE0EtG0E0B0EtCtGyEzyyE0BtGtBzyyDtAtGtBtBtD0F0B0BtB0CtCtDyBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzyzz0DzytCyCyBtG0BtA0F0AtG0D0FtB0EtG0DtCyBtDtGtAyEtC0A0A0BtAyDzy0C0Fzy2Q&cr=1063359865&ir= SearchScopes: HKCU - {31F3298B-6314-4240-A3EE-10AE0AB2B6A8} URL = hxxp://www.bing.com/search?q={searchTerms}&r=248 SearchScopes: HKCU - {328A1422-DCA0-4BD3-ADBB-B08BD39EA7E5} URL = hxxp://search.findwide.com/serp?guid={9596AE97-EC66-4962-AE2B-7DD69FDC1A8E}&action=default_search&k={searchTerms} BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: No Name - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - No File BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File Toolbar: HKCU - No Name - {7357FDC9-CE12-48F0-936E-07F53A3A6FAC} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\#\AppData\Roaming\Mozilla\Firefox\Profiles\yak1wsmr.default FF NewTab: user_pref("browser.newtab.url", ""); FF Homepage: hxxp://www.sweet-page.com/?type=hppp&ts=1401985218&from=cor&uid=ST320LT020-9YG142_W0Q481TSXXXXW0Q481TS FF Keyword.URL: hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=eb1bbda8-dabe-0ccb-9a58-f2917e0ef458&searchtype=ds&installDate=25/11/2013&q= FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.0.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF user.js: detected! => C:\Users\#\AppData\Roaming\Mozilla\Firefox\Profiles\yak1wsmr.default\user.js FF SearchPlugin: C:\Users\#\AppData\Roaming\Mozilla\Firefox\Profiles\yak1wsmr.default\searchplugins\babylon.xml FF SearchPlugin: C:\Users\#\AppData\Roaming\Mozilla\Firefox\Profiles\yak1wsmr.default\searchplugins\internet-search.xml FF SearchPlugin: C:\Users\#\AppData\Roaming\Mozilla\Firefox\Profiles\yak1wsmr.default\searchplugins\Speedial.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\sweet-page.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Feven 1.5 - C:\Users\#\AppData\Roaming\Mozilla\Firefox\Profiles\yak1wsmr.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com [2014-06-05] FF Extension: Fast Start - C:\Users\#\AppData\Roaming\Mozilla\Firefox\Profiles\yak1wsmr.default\Extensions\faststartff@gmail.com [2014-06-05] FF Extension: Speedial - C:\Users\#\AppData\Roaming\Mozilla\Firefox\Profiles\yak1wsmr.default\Extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52} [2014-06-01] FF Extension: Yontoo - C:\Users\#\AppData\Roaming\Mozilla\Firefox\Profiles\yak1wsmr.default\Extensions\plugin@yontoo.com.xpi [2013-02-19] FF Extension: Adblock Plus - C:\Users\#\AppData\Roaming\Mozilla\Firefox\Profiles\yak1wsmr.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-19] FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com [2013-12-01] FF HKLM-x32\...\Firefox\Extensions: [{20d1f7b3-7721-4da0-b6f3-78bb4d7248f4}] - C:\Program Files (x86)\Browser Guard\browserguard.xpi FF Extension: Browser Guard - C:\Program Files (x86)\Browser Guard\browserguard.xpi [2014-02-24] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed] R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-16] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-16] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation) R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe [76960 2012-02-27] (Atheros) [File not signed] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-27] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-27] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG) S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [117888 2012-06-26] (Mobile Connector) [File not signed] R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-04] (Disc Soft Ltd) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-19] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-19 18:21 - 2014-06-19 18:21 - 00017640 _____ () C:\Users\#\Desktop\FRST.txt 2014-06-19 18:20 - 2014-06-19 18:20 - 00000464 _____ () C:\Users\#\Desktop\defogger_disable.log 2014-06-19 18:20 - 2014-06-19 18:20 - 00000000 _____ () C:\Users\#\defogger_reenable 2014-06-19 18:18 - 2014-06-19 18:15 - 00380416 _____ () C:\Users\#\Desktop\Gmer-19357.exe 2014-06-19 18:18 - 2014-06-19 18:01 - 00050477 _____ () C:\Users\#\Desktop\Defogger.exe 2014-06-19 15:18 - 2014-06-19 15:18 - 00000000 ____D () C:\Users\#\Desktop\Virusbeseitigung 2014-06-19 15:18 - 2014-06-05 21:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\#\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-19 15:11 - 2014-06-19 18:21 - 00000000 ____D () C:\FRST 2014-06-19 14:56 - 2014-06-19 14:56 - 00854367 _____ () C:\Users\#\Desktop\SecurityCheck.exe 2014-06-19 14:53 - 2014-06-19 14:53 - 01333465 _____ () C:\Users\#\Desktop\adwcleaner_3.212.exe 2014-06-19 14:50 - 2014-06-19 14:50 - 02082304 _____ (Farbar) C:\Users\#\Desktop\FRST64.exe 2014-06-11 18:39 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2014-06-11 18:39 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll 2014-06-11 18:38 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-06-11 18:38 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-06-11 18:38 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-06-11 18:38 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-06-11 18:38 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-06-11 18:38 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-06-11 18:38 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-06-11 18:38 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-06-11 18:38 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-06-11 18:38 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-06-11 18:38 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-06-11 18:38 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-06-11 18:38 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-06-11 18:38 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-06-11 18:38 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-06-11 18:38 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-06-11 18:38 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-06-11 18:38 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-06-11 18:38 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-06-11 18:38 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-06-11 18:38 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-06-11 18:38 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-06-11 18:38 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-06-11 18:38 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-06-11 18:38 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-06-11 18:38 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-06-11 18:38 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-06-11 18:38 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-06-11 18:38 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-06-11 18:38 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-06-11 18:38 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-06-11 18:38 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-06-11 18:38 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-06-11 18:38 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-06-11 18:38 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-06-11 18:38 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-06-11 18:38 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-06-11 18:38 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-06-11 18:38 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-06-11 18:38 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-06-11 18:38 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-06-11 18:38 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-06-11 18:38 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-06-11 18:38 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-06-11 18:38 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-06-11 18:38 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-06-11 18:38 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-06-11 18:38 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-06-11 18:38 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-06-11 18:38 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-06-11 18:38 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-06-11 18:38 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-06-11 18:38 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2014-06-11 18:38 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll 2014-06-11 18:38 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-06-11 18:38 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2014-06-11 18:38 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2014-06-11 18:38 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-06-11 18:38 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll 2014-06-11 18:38 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-06-11 18:38 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2014-06-11 18:38 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-06-11 18:38 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll 2014-06-11 18:38 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-06-06 18:55 - 2014-06-06 18:56 - 00000000 ____D () C:\Users\#\Documents\MeinSpore-Kreationen 2014-06-06 18:55 - 2014-06-06 18:56 - 00000000 ____D () C:\Users\#\AppData\Roaming\SPORE 2014-06-06 18:55 - 2014-06-06 18:55 - 00000000 __RHD () C:\Users\#\AppData\Roaming\SecuROM 2014-06-06 18:53 - 2014-06-06 18:53 - 00001244 _____ () C:\Windows\SysWOW64\ealregsnapshot1.reg 2014-06-06 18:36 - 2014-06-06 18:36 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts 2014-06-06 18:31 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-06-06 18:31 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-06-05 21:04 - 2014-06-19 17:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-05 21:03 - 2014-06-05 21:03 - 00001070 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-05 21:03 - 2014-06-05 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-05 21:03 - 2014-06-05 21:03 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-05 21:03 - 2014-06-05 21:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-06-05 21:03 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-06-05 21:03 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-06-05 21:03 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-06-05 21:02 - 2014-06-05 21:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\#\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-05 20:51 - 2014-06-05 20:51 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\#\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager [1].exe 2014-06-05 20:50 - 2014-06-05 20:50 - 00719128 _____ ( ) C:\Users\#\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager.exe 2014-06-05 20:50 - 2014-06-05 20:50 - 00001183 _____ () C:\Users\#\Desktop\Die Installation von Malwarebytes Anti-Malware fortsetzen.lnk 2014-06-05 20:25 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys 2014-06-05 20:25 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe 2014-06-05 20:25 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2014-06-05 20:25 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll 2014-06-05 20:25 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll 2014-06-05 20:25 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll 2014-06-05 20:25 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll 2014-06-05 20:25 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll 2014-06-05 20:25 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll 2014-06-05 20:25 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll 2014-06-05 20:25 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2014-06-05 20:25 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe 2014-06-05 20:25 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll 2014-06-05 20:25 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2014-06-05 20:25 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll 2014-06-05 20:25 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2014-06-05 20:24 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-06-05 20:24 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll 2014-06-05 18:34 - 2014-06-05 18:39 - 00001644 _____ () C:\Windows\system32\ASOROSet.bin 2014-06-05 18:33 - 2014-06-05 18:34 - 00000000 ____D () C:\Windows\system32\config\RCCBakup 2014-06-05 17:15 - 2014-06-05 17:15 - 00003084 _____ () C:\Windows\System32\Tasks\{DCF742E3-7D62-41CF-932C-F9C3430321F1} 2014-06-05 17:12 - 2014-06-05 17:12 - 00003118 _____ () C:\Windows\System32\Tasks\{B1FC0C1B-4B17-40FB-8F3B-FFC25A5D897A} 2014-06-05 17:12 - 2014-06-05 17:12 - 00003118 _____ () C:\Windows\System32\Tasks\{9CF86AC5-0D43-4D1F-A495-20452F7430AF} 2014-06-05 17:08 - 2014-06-05 17:08 - 00001128 _____ () C:\Users\#\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-06-05 17:05 - 2014-06-05 17:05 - 00000353 _____ () C:\Windows\SynInst.log 2014-06-05 16:23 - 2014-06-05 16:27 - 00000000 ____D () C:\ProgramData\Registry Helper 2014-06-05 16:23 - 2014-06-05 16:23 - 00000000 ____D () C:\Program Files (x86)\predm 2014-06-05 16:18 - 2014-06-05 16:18 - 00000000 ____D () C:\Users\#\AppData\Local\freeSOFTtoday 2014-06-05 16:14 - 2014-06-05 16:14 - 00000000 ____D () C:\Users\#\AppData\Local\TNT2 2014-06-05 16:14 - 2014-06-05 16:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Flash Component Manager 2014-06-05 16:14 - 2014-06-05 16:14 - 00000000 ____D () C:\Program Files (x86)\Flash Component Manager 2014-06-05 16:13 - 2014-06-05 16:13 - 00821728 _____ () C:\Users\#\Downloads\flashplayerpro-setup.exe 2014-06-05 15:48 - 2014-06-05 15:48 - 00000000 ____D () C:\Users\#\AppData\Local\com 2014-06-05 15:47 - 2014-06-05 21:52 - 00000000 ____D () C:\Program Files (x86)\globalUpdate 2014-06-05 15:47 - 2014-06-05 15:57 - 00000000 ____D () C:\Users\#\AppData\Roaming\Activeris 2014-06-05 15:47 - 2014-06-05 15:47 - 00000000 ____D () C:\Users\#\AppData\Local\globalUpdate 2014-06-05 15:46 - 2014-06-05 22:01 - 00000000 ____D () C:\Program Files\003 2014-06-05 15:45 - 2014-06-05 15:45 - 00831888 _____ () C:\Users\#\Downloads\Setup.exe 2014-06-05 15:43 - 2014-06-05 15:43 - 00283144 _____ (Mozilla) C:\Users\#\Downloads\Firefox Setup Stub 29.0.1.exe 2014-06-05 14:51 - 2014-06-05 14:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-06-05 14:51 - 2014-05-07 15:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-06-05 14:51 - 2014-05-07 14:59 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-06-05 14:51 - 2014-05-07 14:59 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-06-05 14:51 - 2014-05-07 14:58 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-06-05 14:50 - 2014-06-05 14:51 - 00005661 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_60-b19.log 2014-06-01 11:48 - 2014-06-01 11:48 - 00000000 ____D () C:\Users\#\Documents\PC Speed Maximizer 2014-06-01 11:44 - 2014-06-05 21:59 - 00000000 ____D () C:\temp 2014-06-01 11:44 - 2014-06-01 11:44 - 215659728 _____ (Macrovision Corporation) C:\Users\#\Downloads\spore [1].exe 2014-06-01 11:44 - 2014-06-01 11:44 - 00000000 ____D () C:\Users\#\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InfiniteCrisis 2014-06-01 11:44 - 2014-06-01 11:44 - 00000000 ____D () C:\Users\#\AppData\Roaming\InfiniteCrisis299 2014-06-01 11:43 - 2014-06-19 15:43 - 00000276 _____ () C:\Windows\Tasks\Speedial.job 2014-06-01 11:43 - 2014-06-01 11:43 - 00003196 _____ () C:\Windows\System32\Tasks\Speedial 2014-06-01 11:43 - 2014-06-01 11:43 - 00000000 ____D () C:\Users\#\AppData\Roaming\Speedial 2014-06-01 11:42 - 2014-06-05 22:01 - 00000000 ____D () C:\Program Files\004 2014-06-01 11:42 - 2014-06-01 11:48 - 00000000 ____D () C:\Program Files (x86)\PC Speed Maximizer 2014-05-28 19:31 - 2014-05-28 19:31 - 00000000 ____D () C:\Users\#\AppData\Local\LogMeIn 2014-05-28 19:31 - 2014-05-28 19:31 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-05-28 19:17 - 2014-05-28 19:17 - 00961360 _____ (Chip Digital GmbH) C:\Users\#\Downloads\LogMeIn Hamachi - CHIP-Installer.exe 2014-05-28 19:17 - 2014-05-28 19:17 - 00000000 ____D () C:\Users\#\AppData\Local\Skype 2014-05-28 19:17 - 2014-05-28 19:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-05-28 19:14 - 2014-05-28 19:14 - 00961360 _____ (Chip Digital GmbH) C:\Users\#\Downloads\Skype - CHIP-Installer.exe ==================== One Month Modified Files and Folders ======= 2014-06-19 18:21 - 2014-06-19 18:21 - 00017640 _____ () C:\Users\#\Desktop\FRST.txt 2014-06-19 18:21 - 2014-06-19 15:11 - 00000000 ____D () C:\FRST 2014-06-19 18:20 - 2014-06-19 18:20 - 00000464 _____ () C:\Users\#\Desktop\defogger_disable.log 2014-06-19 18:20 - 2014-06-19 18:20 - 00000000 _____ () C:\Users\#\defogger_reenable 2014-06-19 18:20 - 2012-06-26 20:52 - 00000000 ____D () C:\Users\# 2014-06-19 18:19 - 2012-05-12 17:33 - 08637452 _____ () C:\Windows\system32\perfh007.dat 2014-06-19 18:19 - 2012-05-12 17:33 - 02697286 _____ () C:\Windows\system32\perfc007.dat 2014-06-19 18:19 - 2009-07-14 07:13 - 00006472 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-19 18:18 - 2013-06-04 20:09 - 00020823 _____ () C:\Windows\setupact.log 2014-06-19 18:15 - 2014-06-19 18:18 - 00380416 _____ () C:\Users\#\Desktop\Gmer-19357.exe 2014-06-19 18:04 - 2009-07-14 06:45 - 00024192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-19 18:04 - 2009-07-14 06:45 - 00024192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-19 18:01 - 2014-06-19 18:18 - 00050477 _____ () C:\Users\#\Desktop\Defogger.exe 2014-06-19 17:59 - 2014-06-05 21:04 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-19 17:56 - 2012-05-12 07:49 - 00000828 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job 2014-06-19 17:56 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-06-19 15:46 - 2012-05-12 07:45 - 01659488 _____ () C:\Windows\WindowsUpdate.log 2014-06-19 15:46 - 2012-03-28 20:36 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-06-19 15:43 - 2014-06-01 11:43 - 00000276 _____ () C:\Windows\Tasks\Speedial.job 2014-06-19 15:18 - 2014-06-19 15:18 - 00000000 ____D () C:\Users\#\Desktop\Virusbeseitigung 2014-06-19 14:56 - 2014-06-19 14:56 - 00854367 _____ () C:\Users\#\Desktop\SecurityCheck.exe 2014-06-19 14:53 - 2014-06-19 14:53 - 01333465 _____ () C:\Users\#\Desktop\adwcleaner_3.212.exe 2014-06-19 14:50 - 2014-06-19 14:50 - 02082304 _____ (Farbar) C:\Users\#\Desktop\FRST64.exe 2014-06-12 15:54 - 2013-08-20 15:43 - 00000000 ____D () C:\Windows\system32\MRT 2014-06-12 15:50 - 2013-06-04 20:01 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-06-09 19:59 - 2012-05-12 07:49 - 00000830 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job 2014-06-07 08:02 - 2013-12-01 19:25 - 00000000 ____D () C:\Users\#\AppData\Roaming\.minecraft 2014-06-06 18:56 - 2014-06-06 18:55 - 00000000 ____D () C:\Users\#\Documents\MeinSpore-Kreationen 2014-06-06 18:56 - 2014-06-06 18:55 - 00000000 ____D () C:\Users\#\AppData\Roaming\SPORE 2014-06-06 18:55 - 2014-06-06 18:55 - 00000000 __RHD () C:\Users\#\AppData\Roaming\SecuROM 2014-06-06 18:55 - 2013-11-25 17:54 - 00000000 ____D () C:\Users\#\Desktop\Spiele 2014-06-06 18:53 - 2014-06-06 18:53 - 00001244 _____ () C:\Windows\SysWOW64\ealregsnapshot1.reg 2014-06-06 18:53 - 2012-11-24 12:42 - 00000000 ____D () C:\Users\#\AppData\Local\Downloaded Installations 2014-06-06 18:52 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-06-06 18:36 - 2014-06-06 18:36 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts 2014-06-06 18:34 - 2012-03-28 20:43 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-06-06 18:19 - 2010-11-21 05:47 - 00539760 _____ () C:\Windows\PFRO.log 2014-06-05 22:01 - 2014-06-05 15:46 - 00000000 ____D () C:\Program Files\003 2014-06-05 22:01 - 2014-06-01 11:42 - 00000000 ____D () C:\Program Files\004 2014-06-05 22:01 - 2014-05-19 16:29 - 00000000 ____D () C:\ProgramData\IePluginServices 2014-06-05 22:01 - 2013-11-17 20:57 - 00000000 ____D () C:\Windows\Msagent 2014-06-05 21:59 - 2014-06-01 11:44 - 00000000 ____D () C:\temp 2014-06-05 21:52 - 2014-06-05 15:47 - 00000000 ____D () C:\Program Files (x86)\globalUpdate 2014-06-05 21:03 - 2014-06-19 15:18 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\#\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-05 21:03 - 2014-06-05 21:03 - 00001070 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-05 21:03 - 2014-06-05 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-05 21:03 - 2014-06-05 21:03 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-05 21:03 - 2014-06-05 21:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-06-05 21:03 - 2014-06-05 21:02 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\#\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-05 20:51 - 2014-06-05 20:51 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\#\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager [1].exe 2014-06-05 20:50 - 2014-06-05 20:50 - 00719128 _____ ( ) C:\Users\#\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager.exe 2014-06-05 20:50 - 2014-06-05 20:50 - 00001183 _____ () C:\Users\#\Desktop\Die Installation von Malwarebytes Anti-Malware fortsetzen.lnk 2014-06-05 19:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-06-05 18:39 - 2014-06-05 18:34 - 00001644 _____ () C:\Windows\system32\ASOROSet.bin 2014-06-05 18:39 - 2009-07-14 04:34 - 70516736 _____ () C:\Windows\system32\config\SOFTWARE.bak 2014-06-05 18:39 - 2009-07-14 04:34 - 20447232 _____ () C:\Windows\system32\config\SYSTEM.bak 2014-06-05 18:39 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak 2014-06-05 18:35 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM.bak 2014-06-05 18:34 - 2014-06-05 18:33 - 00000000 ____D () C:\Windows\system32\config\RCCBakup 2014-06-05 17:15 - 2014-06-05 17:15 - 00003084 _____ () C:\Windows\System32\Tasks\{DCF742E3-7D62-41CF-932C-F9C3430321F1} 2014-06-05 17:12 - 2014-06-05 17:12 - 00003118 _____ () C:\Windows\System32\Tasks\{B1FC0C1B-4B17-40FB-8F3B-FFC25A5D897A} 2014-06-05 17:12 - 2014-06-05 17:12 - 00003118 _____ () C:\Windows\System32\Tasks\{9CF86AC5-0D43-4D1F-A495-20452F7430AF} 2014-06-05 17:12 - 2014-05-19 16:29 - 00000000 ____D () C:\Users\#\AppData\Roaming\sweet-page 2014-06-05 17:08 - 2014-06-05 17:08 - 00001128 _____ () C:\Users\#\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-06-05 17:05 - 2014-06-05 17:05 - 00000353 _____ () C:\Windows\SynInst.log 2014-06-05 17:00 - 2014-05-19 16:29 - 00000000 ____D () C:\ProgramData\WPM 2014-06-05 16:57 - 2012-12-17 21:07 - 00000000 ____D () C:\Users\#\AppData\Local\CrashDumps 2014-06-05 16:52 - 2012-12-03 20:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge 2014-06-05 16:52 - 2012-12-03 20:18 - 00000000 ____D () C:\Program Files (x86)\Gameforge 2014-06-05 16:50 - 2012-05-12 08:12 - 00000000 ____D () C:\Program Files\EgisTec IPS 2014-06-05 16:50 - 2012-05-12 08:12 - 00000000 ____D () C:\Program Files (x86)\EgisTec IPS 2014-06-05 16:49 - 2012-05-12 08:12 - 00000000 ____D () C:\Program Files (x86)\EgisTec MyWinLocker 2014-06-05 16:27 - 2014-06-05 16:23 - 00000000 ____D () C:\ProgramData\Registry Helper 2014-06-05 16:26 - 2013-12-01 19:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-06-05 16:26 - 2013-05-30 21:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-06-05 16:23 - 2014-06-05 16:23 - 00000000 ____D () C:\Program Files (x86)\predm 2014-06-05 16:18 - 2014-06-05 16:18 - 00000000 ____D () C:\Users\#\AppData\Local\freeSOFTtoday 2014-06-05 16:14 - 2014-06-05 16:14 - 00000000 ____D () C:\Users\#\AppData\Local\TNT2 2014-06-05 16:14 - 2014-06-05 16:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Flash Component Manager 2014-06-05 16:14 - 2014-06-05 16:14 - 00000000 ____D () C:\Program Files (x86)\Flash Component Manager 2014-06-05 16:13 - 2014-06-05 16:13 - 00821728 _____ () C:\Users\#\Downloads\flashplayerpro-setup.exe 2014-06-05 16:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources 2014-06-05 15:57 - 2014-06-05 15:47 - 00000000 ____D () C:\Users\#\AppData\Roaming\Activeris 2014-06-05 15:56 - 2013-11-25 18:40 - 00000000 ____D () C:\Program Files (x86)\Optimizer Pro 2014-06-05 15:52 - 2012-05-12 07:52 - 00000000 ____D () C:\ProgramData\Temp 2014-06-05 15:48 - 2014-06-05 15:48 - 00000000 ____D () C:\Users\#\AppData\Local\com 2014-06-05 15:47 - 2014-06-05 15:47 - 00000000 ____D () C:\Users\#\AppData\Local\globalUpdate 2014-06-05 15:46 - 2012-11-24 12:41 - 00000000 _____ () C:\END 2014-06-05 15:45 - 2014-06-05 15:45 - 00831888 _____ () C:\Users\#\Downloads\Setup.exe 2014-06-05 15:44 - 2013-05-30 21:03 - 00001127 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-06-05 15:43 - 2014-06-05 15:43 - 00283144 _____ (Mozilla) C:\Users\#\Downloads\Firefox Setup Stub 29.0.1.exe 2014-06-05 14:51 - 2014-06-05 14:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-06-05 14:51 - 2014-06-05 14:50 - 00005661 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_60-b19.log 2014-06-05 14:51 - 2013-12-01 19:25 - 00000000 ____D () C:\ProgramData\Oracle 2014-06-05 14:51 - 2013-12-01 19:21 - 00000000 ____D () C:\Program Files (x86)\Java 2014-06-01 17:18 - 2013-11-25 18:42 - 00002264 _____ () C:\Users\#\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2014-06-01 17:18 - 2012-06-26 20:53 - 00001571 _____ () C:\Users\#\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-06-01 11:48 - 2014-06-01 11:48 - 00000000 ____D () C:\Users\#\Documents\PC Speed Maximizer 2014-06-01 11:48 - 2014-06-01 11:42 - 00000000 ____D () C:\Program Files (x86)\PC Speed Maximizer 2014-06-01 11:44 - 2014-06-01 11:44 - 215659728 _____ (Macrovision Corporation) C:\Users\#\Downloads\spore [1].exe 2014-06-01 11:44 - 2014-06-01 11:44 - 00000000 ____D () C:\Users\#\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InfiniteCrisis 2014-06-01 11:44 - 2014-06-01 11:44 - 00000000 ____D () C:\Users\#\AppData\Roaming\InfiniteCrisis299 2014-06-01 11:43 - 2014-06-01 11:43 - 00003196 _____ () C:\Windows\System32\Tasks\Speedial 2014-06-01 11:43 - 2014-06-01 11:43 - 00000000 ____D () C:\Users\#\AppData\Roaming\Speedial 2014-05-30 12:21 - 2014-06-11 18:38 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-30 12:02 - 2014-06-11 18:38 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-30 12:02 - 2014-06-11 18:38 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-05-30 11:45 - 2014-06-11 18:38 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-05-30 11:39 - 2014-06-11 18:38 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-05-30 11:39 - 2014-06-11 18:38 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-05-30 11:38 - 2014-06-11 18:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-05-30 11:28 - 2014-06-11 18:38 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-05-30 11:27 - 2014-06-11 18:38 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-05-30 11:24 - 2014-06-11 18:38 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-05-30 11:21 - 2014-06-11 18:38 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-05-30 11:21 - 2014-06-11 18:38 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-05-30 11:20 - 2014-06-11 18:38 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-05-30 11:18 - 2014-06-11 18:38 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-30 11:11 - 2014-06-11 18:38 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-05-30 11:08 - 2014-06-11 18:38 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-05-30 11:06 - 2014-06-11 18:38 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-05-30 11:02 - 2014-06-11 18:38 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-30 10:55 - 2014-06-11 18:38 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-05-30 10:49 - 2014-06-11 18:38 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-05-30 10:46 - 2014-06-11 18:38 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-30 10:44 - 2014-06-11 18:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-05-30 10:44 - 2014-06-11 18:38 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-05-30 10:43 - 2014-06-11 18:38 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-05-30 10:42 - 2014-06-11 18:38 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-05-30 10:38 - 2014-06-11 18:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-05-30 10:35 - 2014-06-11 18:38 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-05-30 10:34 - 2014-06-11 18:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-05-30 10:33 - 2014-06-11 18:38 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-05-30 10:30 - 2014-06-11 18:38 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-05-30 10:29 - 2014-06-11 18:38 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-05-30 10:28 - 2014-06-11 18:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-05-30 10:27 - 2014-06-11 18:38 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-05-30 10:24 - 2014-06-11 18:38 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-05-30 10:23 - 2014-06-11 18:38 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-05-30 10:16 - 2014-06-11 18:38 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-05-30 10:10 - 2014-06-11 18:38 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-05-30 10:06 - 2014-06-11 18:38 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-05-30 10:04 - 2014-06-11 18:38 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-30 10:02 - 2014-06-11 18:38 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-05-30 09:56 - 2014-06-11 18:38 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-05-30 09:56 - 2014-06-11 18:38 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-05-30 09:54 - 2014-06-11 18:38 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-05-30 09:50 - 2014-06-11 18:38 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-05-30 09:49 - 2014-06-11 18:38 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-05-30 09:43 - 2014-06-11 18:38 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-05-30 09:40 - 2014-06-11 18:38 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-05-30 09:30 - 2014-06-11 18:38 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-05-30 09:21 - 2014-06-11 18:38 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-05-30 09:15 - 2014-06-11 18:38 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-05-30 09:13 - 2014-06-11 18:38 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-05-30 09:13 - 2014-06-11 18:38 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-05-28 20:17 - 2012-06-26 21:18 - 00000000 ____D () C:\Users\#\AppData\Roaming\Skype 2014-05-28 19:31 - 2014-05-28 19:31 - 00000000 ____D () C:\Users\#\AppData\Local\LogMeIn 2014-05-28 19:31 - 2014-05-28 19:31 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-05-28 19:17 - 2014-05-28 19:17 - 00961360 _____ (Chip Digital GmbH) C:\Users\#\Downloads\LogMeIn Hamachi - CHIP-Installer.exe 2014-05-28 19:17 - 2014-05-28 19:17 - 00000000 ____D () C:\Users\#\AppData\Local\Skype 2014-05-28 19:17 - 2014-05-28 19:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-05-28 19:17 - 2014-03-05 17:40 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-05-28 19:17 - 2012-03-28 21:18 - 00000000 ____D () C:\ProgramData\Skype 2014-05-28 19:14 - 2014-05-28 19:14 - 00961360 _____ (Chip Digital GmbH) C:\Users\#\Downloads\Skype - CHIP-Installer.exe 2014-05-27 16:25 - 2013-11-17 21:00 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-05-27 16:25 - 2013-11-17 21:00 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-05-23 16:27 - 2012-06-26 20:52 - 00070800 _____ () C:\Users\#\AppData\Local\GDIPFONTCACHEV1.DAT Some content of TEMP: ==================== C:\Users\#\AppData\Local\Temp\amsetup_activeris_default_010414_installer.exe C:\Users\#\AppData\Local\Temp\avgnt.exe C:\Users\#\AppData\Local\Temp\BackupSetup.exe C:\Users\#\AppData\Local\Temp\clearfiSetup.exe C:\Users\#\AppData\Local\Temp\cloud_backup_setup.exe C:\Users\#\AppData\Local\Temp\drm_dyndata_7370014.dll C:\Users\#\AppData\Local\Temp\ICReinstall_mbam-setup-2.0.2.1012_CB-DL-Manager.exe C:\Users\#\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe C:\Users\#\AppData\Local\Temp\optimizerpro.exe C:\Users\#\AppData\Local\Temp\setup{64A6CB8B-8357-4A48-B392-CECE1C118683}.exe C:\Users\#\AppData\Local\Temp\tbinst.exe C:\Users\#\AppData\Local\Temp\tbu2981.exe C:\Users\#\AppData\Local\Temp\tbu8268.exe C:\Users\#\AppData\Local\Temp\tbu8574.exe C:\Users\#\AppData\Local\Temp\tbu861F.exe C:\Users\#\AppData\Local\Temp\tbu93A7.exe C:\Users\#\AppData\Local\Temp\uninst1.exe C:\Users\#\AppData\Local\Temp\Uninstall.exe C:\Users\#\AppData\Local\Temp\Uninstaller.exe C:\Users\#\AppData\Local\Temp\UninstallerGer.dll C:\Users\#\AppData\Local\Temp\UninstallerIta.dll C:\Users\#\AppData\Local\Temp\vcredist_x64.exe C:\Users\#\AppData\Local\Temp\vopackage.exe C:\Users\#\AppData\Local\Temp\WtgDriverInstallX.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2013-10-13 14:54 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-06-2014
Ran by # at 2014-06-19 15:13:19
Running from C:\Users\#\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Acer Backup Manager (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.100 - NTI Corporation)
Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{A0382E3C-7384-429A-9BFA-AF5888E5A193}) (Version: 1.5.2624.00 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.5.2624.00 - CyberLink Corp.) Hidden
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3010 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3507 - Acer Incorporated)
Acer Instant Update Service (HKLM\...\{36674AE9-6D3D-48D6-BC7B-209F556D65EE}) (Version: 1.00.3004 - Acer Incorporated)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.04.3506 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 20.11.1107.1418 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3501 - Acer Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.9.0.1030 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.9.0.1030 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.01) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.01 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc)
Angry Birds Space (HKLM-x32\...\{C9C763DF-F912-457F-A8BF-88E043BC45FE}) (Version: 1.6.0 - Rovio Entertainment Ltd.)
Angry Birds Star Wars (HKLM-x32\...\{38F829C7-975C-4667-A73B-D674C30E6C8A}) (Version: 1.4.0 - Rovio Entertainment Ltd.)
Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.126 - Atheros)
Atheros Driver Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Atheros)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
Backup Manager V3 (x32 Version: 3.0.0.100 - NTI Corporation) Hidden
Browser Guard (HKLM-x32\...\Browser Guard) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
DealPly (HKCU\...\DealPly) (Version: - ) <==== ATTENTION
DealPly (HKLM-x32\...\DealPly) (Version: - DealPly Technologies Ltd) <==== ATTENTION
DMUninstaller (HKLM-x32\...\DMUninstaller) (Version: - ) <==== ATTENTION
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.7 - Dolby Laboratories Inc)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Free YouTube Download version 3.1.40.1031 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.40.1031 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.11.35.1031 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.35.1031 - DVDVideoSoft Ltd.)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3501 - Acer Incorporated)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.35342 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.4.1441 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2712 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.600 - Oracle)
Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) Hidden
JPEGCrops 0.7.5 beta (HKLM-x32\...\{DEAD07C6-D070-43AB-A60D-D9ABE55E296D}_is1) (Version: - )
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LEGO Digital Designer (HKLM-x32\...\New LEGO Digital Designer) (Version: - LEGO A/S)
Lollipop (HKCU\...\lollipop_11291349) (Version: - Lollipop Network, S.L.) <==== ATTENTION
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mathematik 6 MV (HKLM-x32\...\com.westermann.mathe6mv.5E8736CC72780A3AB44A7F466B5597F22FEA1697.1) (Version: 1.3 - Bildungshaus Schulbuchverlage Westermann Schroedel Diesterwe)
Mathematik 6 MV (x32 Version: 1.3 - Bildungshaus Schulbuchverlage Westermann Schroedel Diesterwe) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access 2003 Runtime (HKLM-x32\...\{901C0407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.5139.5005 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM-x32\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
newsXpresso (HKLM-x32\...\InstallShield_{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}) (Version: 1.0.0.40 - esobi Inc.)
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden
Open Office Packages (HKCU\...\Open Office Packages) (Version: - ) <==== ATTENTION
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Pflanzen gegen Zombies (HKLM-x32\...\Pflanzen gegen Zombies) (Version: - PopCap Games)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.54.309.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6577 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.27015 - Realtek Semiconductor Corp.)
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
SPORE™ (HKLM-x32\...\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}) (Version: 1.00.0000 - Electronic Arts)
Sweet Page (HKLM-x32\...\sweet-page uninstaller) (Version: - sweet-page) <==== ATTENTION
VLC media player 2.0.4 (HKLM\...\VLC media player) (Version: 2.0.4 - VideoLAN)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Yontoo 1.10.03 (HKLM\...\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 1.10.03 - Yontoo LLC) <==== ATTENTION
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
==================== Restore Points =========================
19-05-2014 14:29:57 Installed OpenOffice 4.0.1
19-05-2014 14:34:08 RegClean Pro Mo, Mai 19, 14 16:34
19-05-2014 15:25:59 OpenOffice 4.1.0 wird installiert
19-05-2014 15:28:20 OpenOffice 4.1.0 wird installiert
28-05-2014 17:29:57 Installed LogMeIn Hamachi
01-06-2014 09:46:00 Installiert SPORE™ Labor Basisversion
05-06-2014 12:49:38 Installed Java 7 Update 60
05-06-2014 14:32:31 Removed LogMeIn Hamachi
05-06-2014 14:34:49 Entfernt SPORE™ Labor Basisversion
05-06-2014 14:48:48 Entfernt MyWinLocker Suite
05-06-2014 14:53:15 Configured NTI Media Maker 9
05-06-2014 15:09:58 Removed Skype™ 6.16
05-06-2014 16:31:33 RegClean Pro Do, Jun 05, 14 18:31
05-06-2014 18:24:13 Windows Update
06-06-2014 16:26:15 Installiert SPORE™
06-06-2014 16:36:07 Installiert SPORE™
06-06-2014 16:53:10 Installiert EA Download Manager
06-06-2014 18:30:56 Windows Update
12-06-2014 13:44:05 Windows Update
13-06-2014 14:47:40 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {1AC798B9-3DEB-4770-BBA2-9F8C92F48169} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {57DC1F46-6142-4595-AD78-37E58668A4D2} - System32\Tasks\Speedial => C:\Users\#\AppData\Roaming\Speedial\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {8AA8CC51-0678-4A76-B986-0465B6D71F2E} - System32\Tasks\DealPlyUpdate => C:\Program Files (x86)\DealPly\DealPlyUpdate.exe <==== ATTENTION
Task: {906287F0-9EC1-4882-BFCF-078A176E41BD} - System32\Tasks\DealPly => C:\Users\#\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {B157747F-A722-409B-B768-B2E3C517C59E} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect <==== ATTENTION
Task: {C6F629BE-C587-435E-96D0-C0FF22C6E974} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-16] (Adobe Systems Incorporated)
Task: {CB2B28CC-20B8-4B98-830B-B4FACEE30521} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {FEDC90DC-CFEC-42F5-A6CB-B5E79F6FB7D6} - System32\Tasks\UALU notificatin => C:\Program Files\Acer\Acer Updater\UALU.exe [2012-02-07] (Acer Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\Speedial.job => C:\Users\#\AppData\Roaming\Speedial\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2014-06-05 16:14 - 2014-05-23 13:11 - 00640512 _____ () C:\Program Files (x86)\Flash Component Manager\srvhelper32.exe
2012-05-12 07:49 - 2012-03-16 13:48 - 00127320 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
2014-06-05 16:14 - 2014-03-14 22:25 - 00236544 _____ () C:\Program Files (x86)\Flash Component Manager\sqlite3.dll
2012-01-05 23:22 - 2012-01-05 23:22 - 00465344 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-01-05 23:22 - 2012-01-05 23:22 - 01081368 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-01-05 23:22 - 2012-01-05 23:22 - 00125464 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2013-12-01 19:23 - 2014-05-07 04:27 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-05-16 15:46 - 2014-05-16 15:46 - 16361136 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll
2012-05-12 07:49 - 2012-03-07 16:27 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:373E1720
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\#\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: AthBtTray => "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
MSCONFIG\startupreg: AtherosBtStack => "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
MSCONFIG\startupreg: BackupManagerTray => "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: Dolby Advanced Audio v2 => "C:\Dolby PCEE4\pcee4.exe" -autostart
MSCONFIG\startupreg: G Data AntiVirus Tray Application => C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
MSCONFIG\startupreg: GDFirewallTray => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: InstantUpdate => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe
MSCONFIG\startupreg: LManager => C:\Program Files (x86)\Launch Manager\LManager.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: Power Management => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
MSCONFIG\startupreg: RtHDVBg_Dolby => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4
MSCONFIG\startupreg: RTHDVCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: starter4g => C:\Windows\starter4g.exe
MSCONFIG\startupreg: SuiteTray => "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
MSCONFIG\startupreg: SynTPEnh => %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: USB3MON => "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/19/2014 02:39:43 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (06/19/2014 02:39:43 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (06/19/2014 02:39:42 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (06/18/2014 05:16:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (06/18/2014 05:16:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (06/18/2014 05:16:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (06/17/2014 08:34:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (06/17/2014 08:34:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (06/17/2014 08:34:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (06/17/2014 06:43:02 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
System errors:
=============
Error: (06/13/2014 05:09:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (06/13/2014 05:09:52 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Error: (06/13/2014 05:09:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.
Error: (06/12/2014 03:59:18 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800f0902 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2957509)
Error: (06/12/2014 03:59:18 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800f0902 fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme (KB2800095)
Error: (06/10/2014 06:30:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (06/10/2014 06:30:33 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.
Error: (06/10/2014 06:30:33 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Error: (06/09/2014 09:12:30 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst eventlog erreicht.
Error: (06/09/2014 09:11:30 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst eventlog erreicht.
Microsoft Office Sessions:
=========================
Error: (06/19/2014 02:39:43 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
Error: (06/19/2014 02:39:43 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (06/19/2014 02:39:42 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (06/18/2014 05:16:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
Error: (06/18/2014 05:16:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (06/18/2014 05:16:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (06/17/2014 08:34:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
Error: (06/17/2014 08:34:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (06/17/2014 08:34:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (06/17/2014 06:43:02 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
CodeIntegrity Errors:
===================================
Date: 2013-11-05 17:42:40.460
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 51%
Total physical RAM: 3889.6 MB
Available physical RAM: 1901.43 MB
Total Pagefile: 7777.38 MB
Available Pagefile: 5420.08 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (ACER) (Fixed) (Total:281.88 GB) (Free:215.46 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 789B35E3)
Partition 1: (Not Active) - (Size=16 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=282 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-06-19 19:25:32 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST320LT0 rev.0010 298,09GB Running: Gmer-19357.exe; Driver: C:\Users\#\AppData\Local\Temp\ugtdapow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[1644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[1644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2396] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2396] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 ? C:\Windows\system32\mssprxy.dll [2896] entry point in ".rdata" section 00000000751a71e6 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3672] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3672] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[708] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[708] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\Flash Component Manager\srvhelper32.exe[624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Flash Component Manager\srvhelper32.exe[624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1524] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1524] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c018855b6f38 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e006e617bd6e Reg HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@Object List 110166 110172 110184 110194 110204 110224 110268 110278 110316 110322 110338 Reg HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@Last Counter 110344 Reg HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@Last Help 110345 Reg HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@First Counter 110166 Reg HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@First Help 110167 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c018855b6f38 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e006e617bd6e (not active ControlSet) ---- EOF - GMER 2.1 ---- |
Baum-Darstellung