| |
| |||||||
Log-Analyse und Auswertung: System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbstWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
01.07.2014, 14:30
| #1 |
 |  System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst Hey trojaner-board com, wie schon im Titel beschrieben habe ich seit gestern das Problem, dass sich diese beiden Programme von selbst installieren. Ich habe keine Ahnung woher das kommt und hab im Internet danach gesucht aber ohne Erfolg. Ich habe schon einen Thread in diesem Forum durchgelesen und es befolgt aber das hat nichts gebracht. Das Problem nochmal im Detail: Jedesmal wenn ich den Rechner starte, installieren sich diese beiden Programme ca. 5-10min nach dem Start. Es werden mehrere Prozesse dabei erstellt 1 davon hat eine komische abfolge von Buchstaben. Wenn ich die beiden Programme deinstalliere, installieren sie sich nach 5-10min nochmal neu. Prozess beenden stoppt nur die suche meiner Registry von Pc speedup. €: Hab 2 Screens falls dies benötigt wird. Folgendes habe ich schon unternommen: CCleaner durchlaufen lassen Wise Registry Cleaner durchlaufen lassen adwcleaner durchlaufen lassen Malewarebytes - Anti-Maleware durchlaufen lassen Junkware Removel Tool durchlaufen lassen Shortcut cleaner durchlaufen lassen Hier die Loggs: Malewarebytes: Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 01.07.2014 Scan Time: 14:44:14 Logfile: Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.07.01.03 Rootkit Database: v2014.07.01.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Crue Scan Type: Threat Scan Result: Completed Objects Scanned: 271662 Time Elapsed: 8 min, 39 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 3 PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [0a4da0fac6b50234d4a0bcf29d656a96], PUP.Optional.Pricora.A, HKLM\SOFTWARE\WOW6432NODE\Pricora 12.0, Quarantined, [5bfce4b6f3884ee8e4b73c79bd45dc24], PUP.Optional.MySearchDial.A, HKU\S-1-5-21-3555799456-2816562778-17666758-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Delete-on-Reboot, [d5822872710a072f9bda4f5f3ac840c0], Registry Values: 3 PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Mysearchdial, Quarantined, [0a4da0fac6b50234d4a0bcf29d656a96] PUP.Optional.MySearchDial.A, HKU\S-1-5-21-3555799456-2816562778-17666758-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Mysearchdial, Delete-on-Reboot, [d5822872710a072f9bda4f5f3ac840c0] PUP.Optional.QuickStart.A, HKU\S-1-5-21-3555799456-2816562778-17666758-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, quick_start@gmail.com, Delete-on-Reboot, [73e46535bdbeff37e845456ccf330cf4] Registry Data: 1 PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[5106d8c287f4bf779a4cd5b8a65e9f61] Folders: 0 (No malicious items detected) Files: 5 Trojan.Banker.Kreapixel, C:\Users\Crue\AppData\Roaming\~zdyvexm.exe, Quarantined, [f85f46540279d85ec595c77b6a9725db], PUP.Optional.AdPeak.A, C:\temp\InstallFilter64.msi, Quarantined, [87d09406d4a70b2b513628159b65847c], PUP.Optional.SupraSavings.A, C:\temp\t.msi, Quarantined, [e770aceeec8fda5c56e38cea927222de], PUP.Optional.AdPeak.A, C:\Windows\Installer\1761db5.msi, Quarantined, [b6a167336a11f1457215ac9159a722de], PUP.Optional.Elex.A, C:\User Data\Default\Extensions\newtab.crx, Quarantined, [81d64852087342f43ffb26c7d42ffd03], Physical Sectors: 0 (No malicious items detected) Junkware Removal Tool:JRT Logfile: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Crue on 01.07.2014 at 14:57:58,82
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\systweak
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\Users\Crue\AppData\Roaming\systweak"
~~~ FireFox
Emptied folder: C:\Users\Crue\AppData\Roaming\mozilla\firefox\profiles\kl9finm7.default-1395228883835\minidumps [44 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.07.2014 at 15:02:36,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Adwcleaner:AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.212 - Bericht erstellt am 01/07/2014 um 14:23:46
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Crue - CRUE-PC
# Gestartet von : C:\Users\Crue\Desktop\Meine Daten\Programme\adwcleaner_3.212.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Crue\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Crue\AppData\Roaming\wp_update
Datei Gelöscht : C:\Windows\System32\roboot64.exe
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\AddonsFramework.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ButtonSite.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHost.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{19975B78-1907-4DD6-A437-4C48120F46A4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{562B9316-C08A-444A-9482-62080DD851AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{562B9317-C08A-444A-9482-62080DD851AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{93CF54F5-CFAA-4440-B588-8ED0DFAD5C21}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D3BC53E7-0437-4C97-90EE-2CD6FF47FB14}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E4A994B0-5550-4680-A4C6-B9470B888069}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F9EB11AB-9384-4736-9B33-993940F88895}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{93CF54F5-CFAA-4440-B588-8ED0DFAD5C21}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D3BC53E7-0437-4C97-90EE-2CD6FF47FB14}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E4A994B0-5550-4680-A4C6-B9470B888069}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F9EB11AB-9384-4736-9B33-993940F88895}
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKLM\Software\systweak
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17126
-\\ Mozilla Firefox v30.0 (de)
[ Datei : C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\Crue\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [6742 octets] - [04/09/2013 15:09:00]
AdwCleaner[R1].txt - [12385 octets] - [19/03/2014 13:40:25]
AdwCleaner[R2].txt - [16213 octets] - [19/05/2014 19:52:47]
AdwCleaner[R3].txt - [1325 octets] - [01/06/2014 21:43:16]
AdwCleaner[R4].txt - [8387 octets] - [17/06/2014 20:05:04]
AdwCleaner[R5].txt - [1580 octets] - [17/06/2014 20:12:14]
AdwCleaner[R6].txt - [1589 octets] - [22/06/2014 20:40:04]
AdwCleaner[R7].txt - [6001 octets] - [01/07/2014 14:18:22]
AdwCleaner[S0].txt - [4556 octets] - [04/09/2013 15:09:41]
AdwCleaner[S1].txt - [10759 octets] - [19/03/2014 13:42:10]
AdwCleaner[S2].txt - [14141 octets] - [19/05/2014 19:53:13]
AdwCleaner[S3].txt - [8387 octets] - [17/06/2014 20:05:23]
AdwCleaner[S4].txt - [1641 octets] - [17/06/2014 20:17:00]
AdwCleaner[S5].txt - [5807 octets] - [01/07/2014 14:23:46]
########## EOF - C:\AdwCleaner\AdwCleaner[S5].txt - [5867 octets] ##########
Farbbar Recovery Scan Tool logs: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-06-2014
Ran by Crue at 2014-07-01 15:57:53
Running from C:\Users\Crue\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.7.0.1530 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.7.0.1530 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Age of Mythology (HKLM-x32\...\Age of Mythology 1.0) (Version: - )
Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc)
Arc (HKLM-x32\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.9668 - Perfect World Entertainment)
AutoIt v3.3.8.0 (HKLM-x32\...\AutoItv3) (Version: - AutoIt Team)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.450 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0600}) (Version: 12.6.0.1900 - APN, LLC)
Bad Rats (HKLM-x32\...\Steam App 34900) (Version: - Invent4 Entertainment)
Banished (HKLM-x32\...\QmFuaXNoZWQ=_is1) (Version: 1 - )
Batman: Arkham Asylum GOTY Edition (HKLM-x32\...\Steam App 35140) (Version: - Rocksteady Studios)
BioShock (HKLM-x32\...\Steam App 7670) (Version: - 2K Boston)
BioShock 2 (HKLM-x32\...\Steam App 8850) (Version: - 2K Marin)
Blackwell Convergence (HKLM-x32\...\Steam App 80350) (Version: - Wadjet Eye Games)
Blackwell Deception (HKLM-x32\...\Steam App 80360) (Version: - Wadjet Eye Games)
Blackwell Unbound (HKLM-x32\...\Steam App 80340) (Version: - Wadjet Eye Games)
Borderlands (HKLM-x32\...\Steam App 8980) (Version: - Gearbox Software)
Burnout Paradise: The Ultimate Box (HKLM-x32\...\Steam App 24740) (Version: - Criterion Games)
CCleaner (HKLM\...\CCleaner) (Version: 4.01 - Piriform)
Cheat Engine 6.3 (HKLM-x32\...\Cheat Engine 6.3_is1) (Version: - Cheat Engine)
Combat Arms EU (HKLM-x32\...\Combat Arms EU) (Version: - )
Cossacks - Back To War (HKLM-x32\...\Cossacks : Back To War) (Version: - )
Cossacks - European Wars (HKLM-x32\...\EW : Cossacks) (Version: - )
Cossacks - The Art Of War (HKLM-x32\...\Cossacks : The Art Of War) (Version: - )
Crysis 2 Maximum Edition (HKLM-x32\...\Steam App 108800) (Version: - Crytek Studios)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Deponia (HKLM-x32\...\Steam App 214340) (Version: - Daedalic Entertainment)
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.63.5 - Electronic Arts)
Die Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.5.1 - Electronic Arts)
Die Sims™ 3 Luxus-Accessoires (HKLM-x32\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)
Die Sims™ 3 Stadt-Accessoires (HKLM-x32\...\{7B11296A-F894-449C-8DF6-6AAAA7D4D118}) (Version: 9.0.73 - Electronic Arts)
Dwarfs!? (HKLM-x32\...\Steam App 35480) (Version: - Power of 2)
Earth 2160 (HKLM-x32\...\Steam App 1900) (Version: - Reality Pump Studios)
Free Studio version 2013 (HKLM-x32\...\Free Studio_is1) (Version: 6.1.11.827 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.20.1230 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.20.1230 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.29.304 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.29.304 - DVDVideoSoft Ltd.)
Gameforge Live 1.9.0 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.9.0 - Gameforge)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION
Grand Theft Auto San Andreas (HKLM-x32\...\{2BB114DA-C718-45FE-8AB9-DEFFF0EA5569}_is1) (Version: v1.0/1.1 - Grosses_K)
Greenshot 1.0.6.2228 (HKLM\...\Greenshot_is1) (Version: 1.0.6.2228 - Greenshot)
Halo: Spartan Assault (HKLM-x32\...\Steam App 277430) (Version: - Vanguard Games)
Hotline Miami (HKLM-x32\...\Steam App 219150) (Version: - Dennaton Games)
HTC Driver Installer (HKLM-x32\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.3.0.001 - HTC Corporation)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
Java 7 Update 21 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417021FF}) (Version: 7.0.210 - Oracle)
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
Loadout (HKLM-x32\...\Steam App 208090) (Version: - Edge of Reality)
Magicka (HKLM-x32\...\Steam App 42910) (Version: - Arrowhead Game Studios)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Medal of Honor(TM) Multiplayer (HKLM-x32\...\Steam App 47830) (Version: - Electronic Arts)
Medal of Honor(TM) Single Player (HKLM-x32\...\Steam App 47790) (Version: - Electronic Arts)
Metin2 (HKLM-x32\...\Metin2_is1) (Version: - Gameforge 4D GmbH)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Corporation (Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft Corporation (x32 Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden
Mirror's Edge (HKLM-x32\...\Steam App 17410) (Version: - DICE)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML4 Parser (HKLM-x32\...\{01501EBA-EC35-4F9F-8889-3BE346E5DA13}) (Version: 1.0.0 - Microsoft Game Studios)
Natural Selection 2 (HKLM-x32\...\Steam App 4920) (Version: - Unknown Worlds Entertainment)
Neverwinter (HKLM-x32\...\Neverwinter) (Version: - Cryptic Studios)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.3 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 334.89 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 334.89 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.147.1067 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3489 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 334.89 (Version: 334.89 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.10.4710 - Electronic Arts, Inc.)
PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version: - OVERKILL - a Starbreeze Studio.)
PCSX2 - Playstation 2 Emulator (HKLM-x32\...\pcsx2-r4600) (Version: - )
Peggle (HKLM-x32\...\{715AD72D-887A-459E-988B-D4F3E87FA24B}) (Version: 1.04.0.0 - PopCap Games)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
PremiumSoft Navicat 8.1 for MySQL (HKLM-x32\...\PremiumSoft Navicat 8.1 for MySQL_is1) (Version: - PremiumSoft CyberTech Ltd.)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.989 - Even Balance, Inc.)
RollerCoaster Tycoon 3: Platinum! (HKLM-x32\...\Steam App 2700) (Version: - Frontier)
Serious Sam 2 (HKLM-x32\...\Steam App 204340) (Version: - Croteam)
Serious Sam 3: BFE (HKLM-x32\...\Steam App 41070) (Version: - Croteam)
Serious Sam HD: The First Encounter (HKLM-x32\...\Steam App 41000) (Version: - Croteam)
Serious Sam HD: The Second Encounter (HKLM-x32\...\Steam App 41010) (Version: - Croteam)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Smart Technology Programming Software 7.0.24.8 (HKLM\...\{F31F1F66-5685-4C21-906E-20CB74C7BCDF}) (Version: 7.0.24.8 - Mad Catz)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold 2 (HKLM-x32\...\{16D2C649-CBA8-44EE-B730-12584667D487}) (Version: 1.40.1000 - Firefly Studios)
Stronghold 3 (HKLM-x32\...\Steam App 47400) (Version: - FireFly Studios)
Stronghold Crusader Extreme (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: 1.20.0000 - Firefly Studios)
Stronghold Legends (HKLM-x32\...\{66A405D2-BA14-4594-BF36-B3B544F0754E}) (Version: 1.20.0000 - Firefly Studios)
SupraSavings (Version: 1.0.0.0 - SupraSavings) Hidden <==== ATTENTION
Syberia (HKLM-x32\...\Steam App 46500) (Version: - Anuman)
Syberia 2 (HKLM-x32\...\Steam App 46510) (Version: - Anuman / Microids)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.10 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.26297 - TeamViewer)
The Blackwell Legacy (HKLM-x32\...\Steam App 80330) (Version: - Wadjet Eye Games)
The Lord of the Rings: War in the North (HKLM-x32\...\Steam App 32800) (Version: - Snowblind Studios)
The Mighty Quest For Epic Loot (HKLM-x32\...\Steam App 239220) (Version: - Ubisoft Montreal)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED)
Titanfall™ (HKLM-x32\...\{347EE0C3-0690-48F6-A231-53853C2A80D6}) (Version: 1.0.3.7 - Electronic Arts)
Torchlight II (HKLM-x32\...\Steam App 200710) (Version: - Runic Games)
Tropico 4 (HKLM-x32\...\Steam App 57690) (Version: - Haemimont Games)
UltraISO Premium V9.6 (HKLM-x32\...\UltraISO_is1) (Version: - )
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
Warface Launcher (Beta) (HKLM-x32\...\{28D1723C-31C4-4A83-9799-DFFB3739026D}) (Version: 1.0.0 - Crytek GmbH)
Warframe (HKLM-x32\...\Steam App 230410) (Version: - Digital Extremes)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wise Registry Cleaner 8.12 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 8.12 - WiseCleaner.com, Inc.)
Worms Revolution (HKLM-x32\...\Steam App 200170) (Version: - Team17 Digital Ltd.)
Worms Ultimate Mayhem (HKLM-x32\...\Steam App 70600) (Version: - Team17 Software Ltd.)
XAMPP (HKLM-x32\...\xampp) (Version: 1.8.3-2 - BitNami)
==================== Restore Points =========================
22-06-2014 19:19:22 Geplanter Prüfpunkt
24-06-2014 13:46:33 Windows Update
30-06-2014 12:56:32 Removed LogMeIn Hamachi
30-06-2014 15:06:03 Removed SupraSavings
01-07-2014 11:54:44 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {29D7C502-C1DB-4101-92CA-F9E77D1F0A11} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)
Task: {3DB47C9C-ABBB-4E79-9243-43CCFAB675F5} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-4 No Task File <==== ATTENTION
Task: {55414255-4CB3-4A2A-9D12-B7C14CB3221B} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files (x86)\IObit\Game Booster 3\AutoUpdate.exe <==== ATTENTION
Task: {5D0AA912-7A99-4B92-88B4-255E2711CED5} - \globalUpdateUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {616F2D8C-3B28-456F-B90F-66923DBB16B9} - System32\Tasks\WIN-fdfEfEfAfC => C:\Users\Crue\AppData\Roaming\~bobtsxu.exe [2014-06-30] ()
Task: {6F4D6BBA-24BB-420F-ADDF-983E438A3C80} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-17] (Adobe Systems Incorporated)
Task: {7466379E-920C-4B48-8D24-91BC3DCB1A64} - System32\Tasks\WIN-statsSystem => C:\Users\Crue\AppData\Local\Microsoft\WinU\~hkebvqx.exe [2014-06-30] ()
Task: {7CF0E93A-340A-4318-88A3-1514BB5F9497} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {85CF2311-CEC1-4C3D-A9F3-9A3EDA3D08B6} - System32\Tasks\WIN-statsAdmin => C:\Users\Crue\AppData\Local\Microsoft\WinU\~frwgdnm.exe [2014-06-30] ()
Task: {871AD24D-8D64-421E-B00D-4953FD186088} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {97D5559A-2250-46D7-9863-209F38FF0831} - \DealPlyLiveUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {A5EFC68B-4BB4-43BB-BF60-BDCF5AD1D5DA} - \DealPlyLiveUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {ACFDB62E-92BD-4E77-9182-24D570054B7E} - \DealPlyUpdate No Task File <==== ATTENTION
Task: {ADD8D483-7B92-4C2E-AE8F-7FDDAB0B820F} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-1 No Task File <==== ATTENTION
Task: {B04A14AB-4F9A-46A6-B9A2-0AC298BF0351} - \Lyrics Seeker Update No Task File <==== ATTENTION
Task: {B693F56A-25E6-4DC4-8B04-C7A49435F2D7} - \Dealply No Task File <==== ATTENTION
Task: {D5F272B6-2BCF-4D59-8BC7-D2C7344AA65B} - System32\Tasks\wp_update => C:\Users\Crue\AppData\Roaming\~zdyvexm.exe <==== ATTENTION
Task: {DD8191EB-EBD6-463E-BE5A-EEF62AA97740} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-3 No Task File <==== ATTENTION
Task: {FD25ECF2-EF85-4575-BE70-F7D2E36E2B52} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-05-01 15:18 - 2014-02-08 19:42 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-12-07 18:27 - 2012-12-07 18:27 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2013-11-13 17:10 - 2013-11-13 17:22 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-06-12 14:55 - 2014-06-12 14:55 - 00751952 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOSBrowser.exe
2014-05-08 14:41 - 2014-05-22 15:10 - 10701264 _____ () C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\PEM.exe
2014-06-12 14:55 - 2014-06-12 14:55 - 00698704 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOSOverlay.exe
2014-05-01 08:08 - 2014-05-31 03:27 - 01116672 _____ () C:\Program Files (x86)\Steam\libavcodec-55.dll
2014-04-20 16:07 - 2014-05-31 03:27 - 00438784 _____ () C:\Program Files (x86)\Steam\libavutil-53.dll
2014-05-01 08:08 - 2014-05-31 03:27 - 00399360 _____ () C:\Program Files (x86)\Steam\libavformat-55.dll
2014-01-08 18:35 - 2014-05-31 03:27 - 00331264 _____ () C:\Program Files (x86)\Steam\libavresample-1.dll
2013-08-21 14:18 - 2014-06-27 00:40 - 00764416 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2014-05-01 08:08 - 2014-06-30 23:47 - 02139328 _____ () C:\Program Files (x86)\Steam\video.dll
2014-05-01 08:08 - 2014-04-29 02:37 - 00519168 _____ () C:\Program Files (x86)\Steam\libswscale-2.dll
2013-09-06 12:55 - 2014-06-30 23:46 - 01116864 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-08-07 11:31 - 2014-05-02 01:35 - 20628160 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2013-06-14 15:49 - 2013-06-15 01:49 - 01100800 _____ () C:\Program Files (x86)\Steam\bin\avcodec-53.dll
2013-06-14 15:49 - 2013-06-15 01:49 - 00124416 _____ () C:\Program Files (x86)\Steam\bin\avutil-51.dll
2013-06-14 15:49 - 2013-06-15 01:49 - 00192000 _____ () C:\Program Files (x86)\Steam\bin\avformat-53.dll
2014-06-18 15:49 - 2014-06-18 15:50 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-06-12 14:55 - 2014-06-12 14:55 - 01481040 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\CoreUI.dll
2014-02-24 18:37 - 2014-02-24 18:37 - 00174416 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\ZUnZip.dll
2014-02-24 18:36 - 2014-02-24 18:36 - 00568552 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\sqlite3.dll
2014-05-20 15:06 - 2014-05-20 15:06 - 00174416 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOverlayStub.dll
2014-02-24 18:36 - 2014-02-24 18:36 - 24984912 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\libcef.dll
2014-02-24 18:36 - 2014-02-24 18:36 - 00742736 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\libglesv2.dll
2014-02-24 18:36 - 2014-02-24 18:36 - 00136528 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\libegl.dll
2014-06-17 15:37 - 2014-06-17 15:37 - 17024688 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll
2013-11-22 11:59 - 2014-05-22 15:10 - 04580184 _____ () C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\ElementSkill.dll
2012-12-26 13:16 - 2012-12-26 13:16 - 00454792 _____ () C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\SpeedTreeRT.dll
2012-12-26 13:16 - 2012-12-26 13:16 - 00147456 _____ () C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\FTDriver.dll
2012-12-26 13:16 - 2012-12-26 13:16 - 00024712 _____ () C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\ImmWrapper.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SecureAssist => ""="service"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
MSCONFIG\startupfolder: C:^Users^Crue^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.1.lnk => C:\Windows\pss\OpenOffice.org 3.4.1.lnk.Startup
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Crue\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: ApnTBMon => "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: EADM => "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent
MSCONFIG\startupreg: XboxStat => "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 30%
Total physical RAM: 14327.18 MB
Available physical RAM: 10006.86 MB
Total Pagefile: 28652.53 MB
Available Pagefile: 24117.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (BOOT) (Fixed) (Total:576.17 GB) (Free:101.63 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:19.99 GB) (Free:15.91 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: F98D6E74)
Partition 1: (Active) - (Size=576 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=20 GB) - (Type=OF Extended)
==================== End Of Log ============================
Geändert von Crue (01.07.2014 um 14:59 Uhr) |
|
01.07.2014, 14:53
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst Hallo und
__________________  Hinweis: Registry CleanerIch sehe, dass du sogenannte Registry Cleaner installiert hast. In deinem Fall Wise Registry Cleaner durchlaufen lassen. Wir raten von der Verwendung jeglicher Art von Registry Cleaner ab. Der Grund ist ganz einfach: Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich. Man sollte nicht unnötigerweise an der Registry rumbasteln. Schon ein kleiner Fehler kann gravierende Folgen haben und auch Programme machen manchmal Fehler. Zerstörst du die Registry, zerstörst du Windows. Zudem ist der Nutzen zur Performancesteigerung umstritten und meist kaum im wahrnehmbaren Bereich. Ich würde dir empfehlen, Registry Cleaner nicht weiterhin zu verwenden und über Start --> Systemsteuerung --> Software (bei Windows XP)zu deinstallieren. Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
01.07.2014, 17:44
| #3 |
| | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst FRST Logs rest in den 1. Post editiert.
__________________FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2014
Ran by Crue (administrator) on CRUE on 01-07-2014 15:56:14
Running from C:\Users\Crue\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Saitek) C:\Program Files\SmartTechnology\Software\ProfilerU.exe
(Saitek) C:\Program Files\SmartTechnology\Software\SaiMfd.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Perfect World Entertainment Inc) C:\Program Files (x86)\Perfect World Entertainment\Arc\Arc.exe
() C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOSBrowser.exe
() C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\pem.exe
() C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOSOverlay.exe
(Greenshot) C:\Program Files\Greenshot\Greenshot.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ProfilerU] => C:\Program Files\SmartTechnology\Software\ProfilerU.exe [454144 2013-01-31] (Saitek)
HKLM\...\Run: [SaiMfd] => C:\Program Files\SmartTechnology\Software\SaiMfd.exe [158208 2013-01-31] (Saitek)
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-01] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\MountPoints2: {183eea12-e319-11e2-ad19-00261849d16c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\MountPoints2: {65e60307-1166-11e3-99b6-00261849d16c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\MountPoints2: {6a675b5c-b86e-11e2-89cc-806e6f6e6963} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\MountPoints2: {a7cae9aa-b86c-11e2-88d4-00261849d16c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\MountPoints2: {bc1ecacf-0b04-11e3-aebc-00261849d16c} - F:\HTC_Sync_Manager_PC.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE10DEDE/WOL_WCP
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class - {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npnxgameEU.dll (Nexon)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: MEGA - C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\Extensions\firefox@mega.co.nz.xpi [2014-05-02]
FF Extension: Adblock Plus - C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-19]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2013-05-02]
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (No Name) - C:\Users\Crue\AppData\Local\Google\Chrome\User Data\Default\Extensions\opjickaaceffhmedhkibfclfegpofdac [2014-05-19]
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx [2013-10-23]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-07-01] (Avira Operations GmbH & Co. KG)
S4 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] () [File not signed]
S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-05-20] (Perfect World Entertainment Inc)
U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-11-13] ()
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-08] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-30] (Disc Soft Ltd)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 SaiK0CD5; C:\Windows\System32\DRIVERS\SaiK0CD5.sys [180584 2012-09-20] (Saitek)
R3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [25120 2013-02-01] (Saitek)
R3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [52640 2013-02-01] (Saitek)
R3 SaiU0CD5; C:\Windows\System32\DRIVERS\SaiU0CD5.sys [47208 2012-09-20] (Saitek)
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-07-01 15:56 - 2014-07-01 15:57 - 00012007 _____ () C:\Users\Crue\Desktop\FRST.txt
2014-07-01 15:56 - 2014-07-01 15:56 - 00000000 ____D () C:\FRST
2014-07-01 15:55 - 2014-07-01 15:55 - 02083328 _____ (Farbar) C:\Users\Crue\Desktop\FRST64.exe
2014-07-01 15:06 - 2014-07-01 15:37 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\systweak
2014-07-01 15:02 - 2014-07-01 15:03 - 00001790 _____ () C:\sc-cleaner.txt
2014-07-01 15:02 - 2014-07-01 15:02 - 00001048 _____ () C:\Users\Crue\Desktop\JRT.txt
2014-07-01 14:57 - 2014-07-01 14:57 - 00000000 ____D () C:\Windows\ERUNT
2014-07-01 14:53 - 2014-07-01 14:53 - 00002850 _____ () C:\Users\Crue\Desktop\Malewarebytes.txt
2014-07-01 14:42 - 2014-07-01 15:25 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-01 14:42 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-01 14:42 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-01 14:42 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-01 14:35 - 2013-12-13 17:53 - 00019544 _____ (System Speedup) C:\Windows\system32\roboot64.exe
2014-07-01 14:24 - 2014-07-01 14:55 - 00001426 _____ () C:\Windows\PFRO.log
2014-07-01 14:24 - 2014-07-01 14:55 - 00000336 _____ () C:\Windows\setupact.log
2014-07-01 14:24 - 2014-07-01 14:24 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-30 17:01 - 2014-07-01 15:38 - 00000000 ____D () C:\Program Files (x86)\Deeal
2014-06-30 17:01 - 2014-07-01 15:05 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\betadeeal
2014-06-30 17:01 - 2014-06-30 17:01 - 00667648 _____ () C:\Users\Crue\AppData\Roaming\~bobtsxu.exe
2014-06-30 17:01 - 2014-06-30 17:01 - 00003182 _____ () C:\Windows\System32\Tasks\WIN-fdfEfEfAfC
2014-06-30 14:54 - 2014-06-30 14:54 - 00003234 _____ () C:\Windows\System32\Tasks\WIN-statsSystem
2014-06-30 14:54 - 2014-06-30 14:54 - 00003208 _____ () C:\Windows\System32\Tasks\WIN-statsAdmin
2014-06-30 14:54 - 2014-06-30 14:54 - 00001993 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-24 17:54 - 2014-06-24 17:55 - 00000000 ____D () C:\Users\Crue\Desktop\Praktikum
2014-06-23 22:34 - 2014-06-23 22:40 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Wise Registry Cleaner
2014-06-23 22:28 - 2014-06-23 22:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
2014-06-23 22:28 - 2014-06-23 22:28 - 00000000 ____D () C:\Program Files (x86)\Wise
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-06-21 08:00 - 2014-07-01 15:51 - 00248028 _____ () C:\Windows\WindowsUpdate.log
2014-06-18 15:49 - 2014-06-30 17:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-17 15:55 - 2014-06-17 15:55 - 00000722 _____ () C:\Users\Crue\Documents\cc_20140617_155539.reg
2014-06-17 15:38 - 2014-06-17 15:37 - 00000030 _____ () C:\AVScanner.ini
2014-06-17 15:37 - 2014-06-17 15:37 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-12 18:09 - 2014-06-13 16:20 - 00431104 _____ () C:\ProgramData\uninstall_Deeal.exe
2014-06-11 13:38 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 13:38 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 13:38 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-11 13:38 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 13:38 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 13:38 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 13:38 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-11 13:38 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 13:38 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 13:38 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 13:38 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 13:38 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-11 13:38 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-11 13:38 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-11 13:38 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-11 13:38 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 13:38 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 13:38 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-11 13:38 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-11 13:38 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 13:38 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 13:38 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-11 13:38 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 13:38 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-11 13:38 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-11 13:38 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-11 13:38 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 13:38 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-11 13:38 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-11 13:38 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-11 13:38 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 13:38 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-11 13:38 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-11 13:38 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-11 13:38 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 13:38 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-11 13:38 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-11 13:38 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-11 13:38 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-11 13:38 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-11 13:38 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-11 13:38 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 13:38 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-11 13:38 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-11 13:38 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-11 13:38 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 13:38 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-11 13:38 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 13:38 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-11 13:38 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-11 13:38 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 13:38 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-11 13:38 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 13:38 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-06-11 13:38 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 13:38 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-11 13:38 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 13:38 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-11 13:38 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 13:38 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 13:38 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-11 13:38 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-11 13:38 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-11 13:38 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-11 13:38 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-11 13:38 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-11 13:37 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-11 13:37 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-07 07:58 - 2014-06-07 07:59 - 00040198 _____ () C:\Users\Crue\Documents\cc_20140607_075857.reg
2014-06-01 13:19 - 2014-06-01 13:19 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cossacks 2 - Battle for Europe
2014-06-01 13:19 - 2014-06-01 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks 2 - Battle for Europe
2014-06-01 12:31 - 2014-06-01 13:19 - 00000000 ____D () C:\Program Files (x86)\Cossacks 2 - Battle for Europe
==================== One Month Modified Files and Folders =======
2014-07-01 15:57 - 2014-07-01 15:56 - 00012007 _____ () C:\Users\Crue\Desktop\FRST.txt
2014-07-01 15:56 - 2014-07-01 15:56 - 00000000 ____D () C:\FRST
2014-07-01 15:55 - 2014-07-01 15:55 - 02083328 _____ (Farbar) C:\Users\Crue\Desktop\FRST64.exe
2014-07-01 15:51 - 2014-06-21 08:00 - 00248028 _____ () C:\Windows\WindowsUpdate.log
2014-07-01 15:48 - 2013-09-04 13:13 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-07-01 15:38 - 2014-06-30 17:01 - 00000000 ____D () C:\Program Files (x86)\Deeal
2014-07-01 15:37 - 2014-07-01 15:06 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\systweak
2014-07-01 15:25 - 2014-07-01 14:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 15:22 - 2013-05-01 14:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-01 15:05 - 2014-06-30 17:01 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\betadeeal
2014-07-01 15:04 - 2013-09-21 11:25 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-01 15:04 - 2009-07-14 06:45 - 00026512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-01 15:04 - 2009-07-14 06:45 - 00026512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-01 15:03 - 2014-07-01 15:02 - 00001790 _____ () C:\sc-cleaner.txt
2014-07-01 15:02 - 2014-07-01 15:02 - 00001048 _____ () C:\Users\Crue\Desktop\JRT.txt
2014-07-01 15:02 - 2013-05-01 02:08 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2014-07-01 15:02 - 2013-05-01 02:08 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2014-07-01 15:02 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-01 14:57 - 2014-07-01 14:57 - 00000000 ____D () C:\Windows\ERUNT
2014-07-01 14:55 - 2014-07-01 14:24 - 00001426 _____ () C:\Windows\PFRO.log
2014-07-01 14:55 - 2014-07-01 14:24 - 00000336 _____ () C:\Windows\setupact.log
2014-07-01 14:55 - 2013-05-01 15:19 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-01 14:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-01 14:54 - 2010-01-31 10:52 - 00000000 ____D () C:\temp
2014-07-01 14:53 - 2014-07-01 14:53 - 00002850 _____ () C:\Users\Crue\Desktop\Malewarebytes.txt
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-01 14:24 - 2014-07-01 14:24 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-01 14:23 - 2013-09-04 15:08 - 00000000 ____D () C:\AdwCleaner
2014-07-01 14:03 - 2013-05-01 14:50 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Skype
2014-06-30 17:01 - 2014-06-30 17:01 - 00667648 _____ () C:\Users\Crue\AppData\Roaming\~bobtsxu.exe
2014-06-30 17:01 - 2014-06-30 17:01 - 00003182 _____ () C:\Windows\System32\Tasks\WIN-fdfEfEfAfC
2014-06-30 17:01 - 2014-06-18 15:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-30 14:54 - 2014-06-30 14:54 - 00003234 _____ () C:\Windows\System32\Tasks\WIN-statsSystem
2014-06-30 14:54 - 2014-06-30 14:54 - 00003208 _____ () C:\Windows\System32\Tasks\WIN-statsAdmin
2014-06-30 14:54 - 2014-06-30 14:54 - 00001993 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-30 14:54 - 2014-05-31 09:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks - The Art Of War
2014-06-30 14:54 - 2014-05-31 09:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks - Back To War
2014-06-30 14:54 - 2013-05-01 14:46 - 00001961 _____ () C:\Users\Crue\Desktop\Mozilla Firefox.lnk
2014-06-30 14:54 - 2013-04-30 17:35 - 00001769 _____ () C:\Users\Crue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-24 17:55 - 2014-06-24 17:54 - 00000000 ____D () C:\Users\Crue\Desktop\Praktikum
2014-06-23 22:40 - 2014-06-23 22:34 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Wise Registry Cleaner
2014-06-23 22:32 - 2014-05-30 12:54 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\DAEMON Tools Lite
2014-06-23 22:28 - 2014-06-23 22:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
2014-06-23 22:28 - 2014-06-23 22:28 - 00000000 ____D () C:\Program Files (x86)\Wise
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-06-20 20:27 - 2013-09-21 22:29 - 00000000 ____D () C:\Users\Crue\Documents\My Games
2014-06-19 08:40 - 2014-03-01 16:23 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Arc
2014-06-19 08:38 - 2013-05-01 14:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-17 17:41 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-17 17:39 - 2013-10-22 17:50 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-06-17 17:37 - 2013-10-22 17:43 - 00000000 ____D () C:\ProgramData\Origin
2014-06-17 17:37 - 2013-10-22 17:43 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-06-17 15:55 - 2014-06-17 15:55 - 00000722 _____ () C:\Users\Crue\Documents\cc_20140617_155539.reg
2014-06-17 15:37 - 2014-06-17 15:38 - 00000030 _____ () C:\AVScanner.ini
2014-06-17 15:37 - 2014-06-17 15:37 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-17 15:37 - 2013-05-01 14:56 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-06-17 15:37 - 2013-05-01 14:56 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-06-17 15:37 - 2013-05-01 14:56 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-06-14 20:42 - 2013-05-14 17:01 - 00000000 ____D () C:\Users\Crue\Documents\DVDVideoSoft
2014-06-13 16:20 - 2014-06-12 18:09 - 00431104 _____ () C:\ProgramData\uninstall_Deeal.exe
2014-06-12 20:12 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-11 22:47 - 2013-08-15 02:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 22:45 - 2013-05-07 07:52 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-11 22:43 - 2014-05-06 21:15 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-10 20:37 - 2013-05-01 16:07 - 00000000 ____D () C:\Users\Crue\Desktop\Meine Daten
2014-06-08 16:21 - 2013-09-04 13:13 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-08 16:01 - 2014-04-21 14:33 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Tropico 4
2014-06-08 11:41 - 2014-05-02 19:51 - 00000000 ____D () C:\Users\Crue\Documents\GTA San Andreas User Files
2014-06-08 11:13 - 2014-06-11 13:37 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-11 13:37 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-07 12:52 - 2013-09-21 21:42 - 00000000 ____D () C:\Users\Crue\Documents\Square Enix
2014-06-07 08:18 - 2013-05-17 16:54 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\TS3Client
2014-06-07 07:59 - 2014-06-07 07:58 - 00040198 _____ () C:\Users\Crue\Documents\cc_20140607_075857.reg
2014-06-01 13:19 - 2014-06-01 13:19 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cossacks 2 - Battle for Europe
2014-06-01 13:19 - 2014-06-01 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks 2 - Battle for Europe
2014-06-01 13:19 - 2014-06-01 12:31 - 00000000 ____D () C:\Program Files (x86)\Cossacks 2 - Battle for Europe
Files to move or delete:
====================
C:\ProgramData\uninstall_Deeal.exe
C:\Users\Crue\Combatarms_eu.exe
Some content of TEMP:
====================
C:\Users\Crue\AppData\Local\Temp\avgnt.exe
C:\Users\Crue\AppData\Local\Temp\Quarantine.exe
C:\Users\Crue\AppData\Local\Temp\unzip.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-29 20:47
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- €: hxxp://www.directupload.net/file/d/3670/eic7edxw_png.htm hxxp://www.directupload.net/file/d/3670/nlgbgt3p_png.htm hxxp://www.directupload.net/file/d/3670/zhpesjz9_png.htm Sry für den Doppelpost aber avira hat zu lange gebraucht als das ich es in den letzen Post einfügen konnte. Avira logs: Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 1. Juli 2014 15:49
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : CRUE
Versionsinformationen:
BUILD.DAT : 14.0.5.450 91868 Bytes 24.06.2014 20:39:00
AVSCAN.EXE : 14.0.5.396 1042512 Bytes 01.07.2014 13:48:20
AVSCANRC.DLL : 14.0.5.364 62544 Bytes 01.07.2014 13:48:20
LUKE.DLL : 14.0.5.336 57936 Bytes 01.07.2014 13:48:26
AVSCPLR.DLL : 14.0.5.376 89680 Bytes 01.07.2014 13:48:20
AVREG.DLL : 14.0.5.356 261200 Bytes 01.07.2014 13:48:19
avlode.dll : 14.0.5.396 588368 Bytes 01.07.2014 13:48:19
avlode.rdf : 14.0.4.28 65096 Bytes 30.06.2014 13:48:14
XBV00008.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00009.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00010.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00011.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00012.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00013.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00014.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00015.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00016.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00017.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00018.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00019.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00020.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00021.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:55
XBV00022.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00023.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00024.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00025.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00026.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00027.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00028.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00029.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00030.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00031.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00032.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00033.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00034.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00035.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00036.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00037.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00038.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00039.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:56
XBV00040.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:57
XBV00041.VDF : 8.11.153.142 2048 Bytes 06.06.2014 13:47:57
XBV00179.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00180.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00181.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00182.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00183.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00184.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00185.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00186.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00187.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00188.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00189.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:00
XBV00190.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00191.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00192.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00193.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00194.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00195.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00196.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00197.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00198.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00199.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00200.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00201.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00202.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00203.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00204.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00205.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00206.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00207.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00208.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00209.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00210.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00211.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00212.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00213.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00214.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00215.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00216.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00217.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00218.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00219.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00220.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00221.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00222.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00223.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00224.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00225.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00226.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00227.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00228.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00229.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00230.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00231.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00232.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00233.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00234.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00235.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00236.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00237.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00238.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00239.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00240.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00241.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00242.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00243.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00244.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00245.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00246.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00247.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00248.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00249.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00250.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00251.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00252.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00253.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00254.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:01
XBV00255.VDF : 8.11.155.44 2048 Bytes 16.06.2014 13:48:02
XBV00000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 11:11:21
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 11:11:24
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 11:11:28
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 11:11:31
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 11:11:37
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 11:11:42
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 14:34:30
XBV00007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 13:01:23
XBV00042.VDF : 8.11.153.142 710656 Bytes 06.06.2014 13:47:57
XBV00043.VDF : 8.11.155.44 1013760 Bytes 16.06.2014 13:47:58
XBV00044.VDF : 8.11.155.46 3072 Bytes 16.06.2014 13:47:58
XBV00045.VDF : 8.11.155.52 38912 Bytes 16.06.2014 13:47:58
XBV00046.VDF : 8.11.155.54 29696 Bytes 16.06.2014 13:47:58
XBV00047.VDF : 8.11.155.58 13824 Bytes 16.06.2014 13:47:58
XBV00048.VDF : 8.11.155.62 20480 Bytes 17.06.2014 13:47:58
XBV00049.VDF : 8.11.155.64 5632 Bytes 17.06.2014 13:47:58
XBV00050.VDF : 8.11.155.66 139264 Bytes 17.06.2014 13:47:58
XBV00051.VDF : 8.11.155.68 2048 Bytes 17.06.2014 13:47:58
XBV00052.VDF : 8.11.155.70 6144 Bytes 17.06.2014 13:47:58
XBV00053.VDF : 8.11.155.74 180224 Bytes 17.06.2014 13:47:55
XBV00054.VDF : 8.11.155.78 18432 Bytes 17.06.2014 13:47:55
XBV00055.VDF : 8.11.155.80 6144 Bytes 17.06.2014 13:47:55
XBV00056.VDF : 8.11.155.82 4608 Bytes 18.06.2014 13:47:55
XBV00057.VDF : 8.11.155.86 17408 Bytes 18.06.2014 13:47:55
XBV00058.VDF : 8.11.155.100 144896 Bytes 18.06.2014 13:47:55
XBV00059.VDF : 8.11.155.114 25088 Bytes 18.06.2014 13:47:55
XBV00060.VDF : 8.11.155.128 2048 Bytes 18.06.2014 13:47:55
XBV00061.VDF : 8.11.155.146 27648 Bytes 18.06.2014 13:47:57
XBV00062.VDF : 8.11.155.148 2048 Bytes 18.06.2014 13:47:57
XBV00063.VDF : 8.11.155.150 148992 Bytes 18.06.2014 13:47:57
XBV00064.VDF : 8.11.155.152 5120 Bytes 18.06.2014 13:47:57
XBV00065.VDF : 8.11.155.156 12800 Bytes 18.06.2014 13:47:57
XBV00066.VDF : 8.11.155.158 2048 Bytes 18.06.2014 13:47:57
XBV00067.VDF : 8.11.155.160 2048 Bytes 18.06.2014 13:47:57
XBV00068.VDF : 8.11.155.164 7680 Bytes 18.06.2014 13:47:57
XBV00069.VDF : 8.11.155.168 18432 Bytes 19.06.2014 13:47:57
XBV00070.VDF : 8.11.155.172 2048 Bytes 19.06.2014 13:47:57
XBV00071.VDF : 8.11.155.174 7680 Bytes 19.06.2014 13:47:57
XBV00072.VDF : 8.11.155.176 2048 Bytes 19.06.2014 13:47:57
XBV00073.VDF : 8.11.155.178 7680 Bytes 19.06.2014 13:47:57
XBV00074.VDF : 8.11.155.180 5120 Bytes 19.06.2014 13:47:57
XBV00075.VDF : 8.11.155.182 4608 Bytes 19.06.2014 13:47:58
XBV00076.VDF : 8.11.155.184 6144 Bytes 19.06.2014 13:47:58
XBV00077.VDF : 8.11.155.186 4608 Bytes 19.06.2014 13:47:58
XBV00078.VDF : 8.11.155.188 5632 Bytes 19.06.2014 13:47:58
XBV00079.VDF : 8.11.155.190 5120 Bytes 19.06.2014 13:47:58
XBV00080.VDF : 8.11.155.192 2048 Bytes 19.06.2014 13:47:58
XBV00081.VDF : 8.11.155.196 17408 Bytes 19.06.2014 13:47:58
XBV00082.VDF : 8.11.155.200 2048 Bytes 19.06.2014 13:47:58
XBV00083.VDF : 8.11.155.202 5632 Bytes 20.06.2014 13:47:58
XBV00084.VDF : 8.11.155.204 14848 Bytes 20.06.2014 13:47:58
XBV00085.VDF : 8.11.155.206 3072 Bytes 20.06.2014 13:47:58
XBV00086.VDF : 8.11.155.208 2048 Bytes 20.06.2014 13:47:58
XBV00087.VDF : 8.11.155.210 11264 Bytes 20.06.2014 13:47:58
XBV00088.VDF : 8.11.155.214 4608 Bytes 20.06.2014 13:47:58
XBV00089.VDF : 8.11.155.218 8704 Bytes 20.06.2014 13:47:59
XBV00090.VDF : 8.11.155.222 2048 Bytes 20.06.2014 13:47:59
XBV00091.VDF : 8.11.155.224 2048 Bytes 20.06.2014 13:47:59
XBV00092.VDF : 8.11.155.228 151552 Bytes 20.06.2014 13:47:59
XBV00093.VDF : 8.11.155.242 13312 Bytes 21.06.2014 13:47:59
XBV00094.VDF : 8.11.156.2 12800 Bytes 21.06.2014 13:47:59
XBV00095.VDF : 8.11.156.4 58368 Bytes 21.06.2014 13:47:59
XBV00096.VDF : 8.11.156.18 146944 Bytes 21.06.2014 13:47:59
XBV00097.VDF : 8.11.156.20 2048 Bytes 21.06.2014 13:48:01
XBV00098.VDF : 8.11.156.22 49152 Bytes 22.06.2014 13:48:01
XBV00099.VDF : 8.11.156.24 2048 Bytes 22.06.2014 13:48:01
XBV00100.VDF : 8.11.156.26 9216 Bytes 22.06.2014 13:48:01
XBV00101.VDF : 8.11.156.30 2048 Bytes 22.06.2014 13:48:01
XBV00102.VDF : 8.11.156.32 12800 Bytes 22.06.2014 13:48:01
XBV00103.VDF : 8.11.156.34 36352 Bytes 23.06.2014 13:48:04
XBV00104.VDF : 8.11.156.36 2560 Bytes 23.06.2014 13:48:04
XBV00105.VDF : 8.11.156.38 2048 Bytes 23.06.2014 13:48:04
XBV00106.VDF : 8.11.156.40 7168 Bytes 23.06.2014 13:48:04
XBV00107.VDF : 8.11.156.52 8704 Bytes 23.06.2014 13:48:04
XBV00108.VDF : 8.11.156.72 204288 Bytes 23.06.2014 13:48:04
XBV00109.VDF : 8.11.156.76 2048 Bytes 23.06.2014 13:48:04
XBV00110.VDF : 8.11.156.88 2048 Bytes 23.06.2014 13:48:04
XBV00111.VDF : 8.11.156.100 2048 Bytes 23.06.2014 13:48:04
XBV00112.VDF : 8.11.156.114 37376 Bytes 24.06.2014 13:48:04
XBV00113.VDF : 8.11.156.126 2048 Bytes 24.06.2014 13:48:04
XBV00114.VDF : 8.11.156.144 28160 Bytes 24.06.2014 13:48:04
XBV00115.VDF : 8.11.156.146 2048 Bytes 24.06.2014 13:48:04
XBV00116.VDF : 8.11.156.150 145408 Bytes 24.06.2014 13:48:04
XBV00117.VDF : 8.11.156.152 13824 Bytes 24.06.2014 13:48:04
XBV00118.VDF : 8.11.156.154 2048 Bytes 24.06.2014 13:48:04
XBV00119.VDF : 8.11.156.158 35328 Bytes 24.06.2014 13:48:03
XBV00120.VDF : 8.11.156.160 18432 Bytes 24.06.2014 13:48:03
XBV00121.VDF : 8.11.156.162 5632 Bytes 24.06.2014 13:48:03
XBV00122.VDF : 8.11.156.166 10240 Bytes 24.06.2014 13:48:03
XBV00123.VDF : 8.11.156.180 21504 Bytes 25.06.2014 13:48:03
XBV00124.VDF : 8.11.156.190 3072 Bytes 25.06.2014 13:48:03
XBV00125.VDF : 8.11.156.206 147968 Bytes 25.06.2014 13:48:04
XBV00126.VDF : 8.11.156.208 2048 Bytes 25.06.2014 13:48:04
XBV00127.VDF : 8.11.156.220 2048 Bytes 25.06.2014 13:48:04
XBV00128.VDF : 8.11.156.232 29696 Bytes 25.06.2014 13:48:04
XBV00129.VDF : 8.11.156.242 2048 Bytes 25.06.2014 13:48:04
XBV00130.VDF : 8.11.157.0 181248 Bytes 26.06.2014 13:48:04
XBV00131.VDF : 8.11.157.4 15872 Bytes 26.06.2014 13:48:04
XBV00132.VDF : 8.11.157.6 2560 Bytes 26.06.2014 13:48:04
XBV00133.VDF : 8.11.157.24 151552 Bytes 26.06.2014 13:48:04
XBV00134.VDF : 8.11.157.26 9728 Bytes 26.06.2014 13:48:05
XBV00135.VDF : 8.11.157.28 5632 Bytes 26.06.2014 13:48:05
XBV00136.VDF : 8.11.157.30 2048 Bytes 26.06.2014 13:48:05
XBV00137.VDF : 8.11.157.32 25600 Bytes 26.06.2014 13:48:05
XBV00138.VDF : 8.11.157.38 42496 Bytes 26.06.2014 13:48:05
XBV00139.VDF : 8.11.157.46 2048 Bytes 27.06.2014 13:48:05
XBV00140.VDF : 8.11.157.50 15360 Bytes 27.06.2014 13:48:05
XBV00141.VDF : 8.11.157.76 2048 Bytes 27.06.2014 13:48:05
XBV00142.VDF : 8.11.157.78 166400 Bytes 27.06.2014 13:48:06
XBV00143.VDF : 8.11.157.88 2048 Bytes 27.06.2014 13:48:06
XBV00144.VDF : 8.11.157.98 17408 Bytes 27.06.2014 13:48:06
XBV00145.VDF : 8.11.157.100 2048 Bytes 27.06.2014 13:48:06
XBV00146.VDF : 8.11.157.110 158208 Bytes 27.06.2014 13:48:05
XBV00147.VDF : 8.11.157.112 166912 Bytes 27.06.2014 13:48:05
XBV00148.VDF : 8.11.157.114 2048 Bytes 27.06.2014 13:48:05
XBV00149.VDF : 8.11.157.118 11264 Bytes 27.06.2014 13:48:05
XBV00150.VDF : 8.11.157.120 2048 Bytes 27.06.2014 13:48:05
XBV00151.VDF : 8.11.157.126 156160 Bytes 28.06.2014 13:48:05
XBV00152.VDF : 8.11.157.128 2048 Bytes 28.06.2014 13:48:05
XBV00153.VDF : 8.11.157.130 6144 Bytes 28.06.2014 13:48:14
XBV00154.VDF : 8.11.157.132 14336 Bytes 28.06.2014 13:48:14
XBV00155.VDF : 8.11.157.134 2048 Bytes 28.06.2014 13:48:14
XBV00156.VDF : 8.11.157.138 3584 Bytes 29.06.2014 13:48:14
XBV00157.VDF : 8.11.157.140 2048 Bytes 29.06.2014 13:48:14
XBV00158.VDF : 8.11.157.142 26624 Bytes 29.06.2014 13:48:14
XBV00159.VDF : 8.11.157.144 2048 Bytes 29.06.2014 13:48:14
XBV00160.VDF : 8.11.157.146 2048 Bytes 29.06.2014 13:48:14
XBV00161.VDF : 8.11.157.148 12800 Bytes 29.06.2014 13:48:14
XBV00162.VDF : 8.11.157.150 55808 Bytes 30.06.2014 13:48:14
XBV00163.VDF : 8.11.157.152 2048 Bytes 30.06.2014 13:48:14
XBV00164.VDF : 8.11.157.162 10240 Bytes 30.06.2014 13:48:14
XBV00165.VDF : 8.11.157.170 2048 Bytes 30.06.2014 13:48:14
XBV00166.VDF : 8.11.157.178 5632 Bytes 30.06.2014 13:48:14
XBV00167.VDF : 8.11.157.186 2048 Bytes 30.06.2014 13:48:14
XBV00168.VDF : 8.11.157.196 37888 Bytes 30.06.2014 13:48:28
XBV00169.VDF : 8.11.157.202 8192 Bytes 30.06.2014 13:48:28
XBV00170.VDF : 8.11.157.204 2048 Bytes 30.06.2014 13:48:28
XBV00171.VDF : 8.11.157.208 7168 Bytes 30.06.2014 13:48:28
XBV00172.VDF : 8.11.157.210 16384 Bytes 30.06.2014 13:48:28
XBV00173.VDF : 8.11.157.214 2048 Bytes 30.06.2014 13:48:28
XBV00174.VDF : 8.11.157.218 162304 Bytes 01.07.2014 13:48:28
XBV00175.VDF : 8.11.157.220 2048 Bytes 01.07.2014 13:48:28
XBV00176.VDF : 8.11.157.222 18432 Bytes 01.07.2014 13:48:29
XBV00177.VDF : 8.11.157.224 2048 Bytes 01.07.2014 13:48:29
XBV00178.VDF : 8.11.157.226 2048 Bytes 01.07.2014 13:48:29
LOCAL000.VDF : 8.11.157.226 107566592 Bytes 01.07.2014 13:48:43
Engineversion : 8.3.20.26
AEVDF.DLL : 8.3.0.4 118976 Bytes 21.03.2014 13:51:35
AESCRIPT.DLL : 8.1.4.216 528584 Bytes 27.06.2014 13:48:05
AESCN.DLL : 8.3.1.2 135360 Bytes 29.05.2014 13:00:55
AESBX.DLL : 8.2.20.24 1409224 Bytes 09.05.2014 13:04:30
AERDL.DLL : 8.2.0.138 704888 Bytes 02.12.2013 13:51:21
AEPACK.DLL : 8.4.0.40 786632 Bytes 30.06.2014 13:48:14
AEOFFICE.DLL : 8.3.0.6 205000 Bytes 30.06.2014 13:48:13
AEHEUR.DLL : 8.1.4.1132 6820040 Bytes 27.06.2014 13:48:05
AEHELP.DLL : 8.3.1.0 278728 Bytes 29.05.2014 13:00:53
AEGEN.DLL : 8.1.7.28 450752 Bytes 08.06.2014 14:21:44
AEEXP.DLL : 8.4.2.6 237760 Bytes 27.06.2014 13:48:05
AEEMU.DLL : 8.1.3.2 393587 Bytes 04.09.2013 11:12:33
AEDROID.DLL : 8.4.2.24 442568 Bytes 08.06.2014 14:21:46
AECORE.DLL : 8.3.1.4 241864 Bytes 08.06.2014 14:21:44
AEBB.DLL : 8.1.1.4 53619 Bytes 04.09.2013 11:12:32
AVWINLL.DLL : 14.0.5.320 24144 Bytes 01.07.2014 13:48:17
AVPREF.DLL : 14.0.5.320 50256 Bytes 01.07.2014 13:48:19
AVREP.DLL : 14.0.5.320 219216 Bytes 01.07.2014 13:48:19
AVARKT.DLL : 14.0.5.368 226384 Bytes 01.07.2014 13:48:18
AVEVTLOG.DLL : 14.0.5.320 182352 Bytes 01.07.2014 13:48:19
SQLITE3.DLL : 14.0.5.320 452176 Bytes 01.07.2014 13:48:27
AVSMTP.DLL : 14.0.5.320 76368 Bytes 01.07.2014 13:48:20
NETNT.DLL : 14.0.5.320 13392 Bytes 01.07.2014 13:48:26
RCIMAGE.DLL : 14.0.5.320 4998224 Bytes 01.07.2014 13:48:17
RCTEXT.DLL : 14.0.5.322 73808 Bytes 01.07.2014 13:48:18
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files (x86)\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Auszulassende Dateien.................: C:\Users\Crue\Desktop\Meine Daten\Programme\M2Bob - Version 3.0.0.1, C:\Users\Crue\Desktop\Server\Multi Tool V1.2,
Beginn des Suchlaufs: Dienstag, 1. Juli 2014 15:49
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, D:)'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '145' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSCamS64.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'NvNetworkService.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvstreamsvc.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'PassThruSvr.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'PnkBstrA.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '109' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvstreamsvc.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'NvBackend.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'itype.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'ipoint.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskmgr.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'ProfilerU.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SaiMfd.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'NvTmru.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'explorer.exe' - '182' Modul(e) wurden durchsucht
Durchsuche Prozess 'Steam.exe' - '142' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '146' Modul(e) wurden durchsucht
Durchsuche Prozess 'Arc.exe' - '93' Modul(e) wurden durchsucht
Durchsuche Prozess 'ArcOSBrowser.exe' - '104' Modul(e) wurden durchsucht
Durchsuche Prozess 'PEM.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'ArcOSOverlay.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'Greenshot.exe' - '138' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '107' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'FRST64.exe' - '93' Modul(e) wurden durchsucht
Durchsuche Prozess 'notepad.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'notepad.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '3667' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\' <BOOT>
C:\AdwCleaner\Quarantine\C\Program Files\003\xmkysecqun64.exe.vir
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
Beginne mit der Suche in 'D:\' <RECOVER>
Beginne mit der Desinfektion:
C:\AdwCleaner\Quarantine\C\Program Files\003\xmkysecqun64.exe.vir
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
[WARNUNG] Die Datei wurde ignoriert.
Ende des Suchlaufs: Dienstag, 1. Juli 2014 18:41
Benötigte Zeit: 2:51:21 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
57649 Verzeichnisse wurden überprüft
2051569 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
2051568 Dateien ohne Befall
18835 Archive wurden durchsucht
1 Warnungen
0 Hinweise
1014766 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden
Geändert von Crue (01.07.2014 um 16:05 Uhr) |
|
01.07.2014, 19:23
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst Adware/Junkware/Toolbars entfernen adwCleaner und JRT bitte vorher neu runterladen! 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
01.07.2014, 19:52
| #5 |
| | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbstCode:
ATTFilter # AdwCleaner v3.214 - Bericht erstellt am 01/07/2014 um 20:49:24
# Aktualisiert 29/06/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Crue - CRUE
# Gestartet von : C:\Users\Crue\Desktop\adwcleaner_3.214.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gelöscht : C:\Windows\System32\roboot64.exe
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17126
-\\ Mozilla Firefox v30.0 (de)
[ Datei : C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\Crue\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [6742 octets] - [04/09/2013 15:09:00]
AdwCleaner[R1].txt - [12385 octets] - [19/03/2014 13:40:25]
AdwCleaner[R2].txt - [16213 octets] - [19/05/2014 19:52:47]
AdwCleaner[R3].txt - [1325 octets] - [01/06/2014 21:43:16]
AdwCleaner[R4].txt - [8387 octets] - [17/06/2014 20:05:04]
AdwCleaner[R5].txt - [1580 octets] - [17/06/2014 20:12:14]
AdwCleaner[R6].txt - [1589 octets] - [22/06/2014 20:40:04]
AdwCleaner[R7].txt - [6001 octets] - [01/07/2014 14:18:22]
AdwCleaner[R8].txt - [1825 octets] - [01/07/2014 20:49:05]
AdwCleaner[S0].txt - [4556 octets] - [04/09/2013 15:09:41]
AdwCleaner[S1].txt - [10759 octets] - [19/03/2014 13:42:10]
AdwCleaner[S2].txt - [14141 octets] - [19/05/2014 19:53:13]
AdwCleaner[S3].txt - [8387 octets] - [17/06/2014 20:05:23]
AdwCleaner[S4].txt - [1641 octets] - [17/06/2014 20:17:00]
AdwCleaner[S5].txt - [6011 octets] - [01/07/2014 14:23:46]
AdwCleaner[S6].txt - [1746 octets] - [01/07/2014 20:49:24]
########## EOF - C:\AdwCleaner\AdwCleaner[S6].txt - [1806 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Crue on 01.07.2014 at 20:31:15,22
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\systweak
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Crue\AppData\Roaming\systweak"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.07.2014 at 20:36:01,30
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2014
Ran by Crue (administrator) on CRUE on 01-07-2014 20:36:30
Running from C:\Users\Crue\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Saitek) C:\Program Files\SmartTechnology\Software\ProfilerU.exe
(Saitek) C:\Program Files\SmartTechnology\Software\SaiMfd.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Perfect World Entertainment Inc) C:\Program Files (x86)\Perfect World Entertainment\Arc\Arc.exe
() C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOSBrowser.exe
() C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\pem.exe
() C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOSOverlay.exe
(Greenshot) C:\Program Files\Greenshot\Greenshot.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ProfilerU] => C:\Program Files\SmartTechnology\Software\ProfilerU.exe [454144 2013-01-31] (Saitek)
HKLM\...\Run: [SaiMfd] => C:\Program Files\SmartTechnology\Software\SaiMfd.exe [158208 2013-01-31] (Saitek)
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-01] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\MountPoints2: {183eea12-e319-11e2-ad19-00261849d16c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\MountPoints2: {65e60307-1166-11e3-99b6-00261849d16c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\MountPoints2: {6a675b5c-b86e-11e2-89cc-806e6f6e6963} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\MountPoints2: {a7cae9aa-b86c-11e2-88d4-00261849d16c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3555799456-2816562778-17666758-1000\...\MountPoints2: {bc1ecacf-0b04-11e3-aebc-00261849d16c} - F:\HTC_Sync_Manager_PC.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE10DEDE/WOL_WCP
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class - {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npnxgameEU.dll (Nexon)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: MEGA - C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\Extensions\firefox@mega.co.nz.xpi [2014-05-02]
FF Extension: Adblock Plus - C:\Users\Crue\AppData\Roaming\Mozilla\Firefox\Profiles\kl9finm7.default-1395228883835\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-19]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2013-05-02]
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (No Name) - C:\Users\Crue\AppData\Local\Google\Chrome\User Data\Default\Extensions\opjickaaceffhmedhkibfclfegpofdac [2014-05-19]
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx [2013-10-23]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-07-01] (Avira Operations GmbH & Co. KG)
S4 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] () [File not signed]
S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-05-20] (Perfect World Entertainment Inc)
U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-11-13] ()
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-08] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-30] (Disc Soft Ltd)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 SaiK0CD5; C:\Windows\System32\DRIVERS\SaiK0CD5.sys [180584 2012-09-20] (Saitek)
R3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [25120 2013-02-01] (Saitek)
R3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [52640 2013-02-01] (Saitek)
R3 SaiU0CD5; C:\Windows\System32\DRIVERS\SaiU0CD5.sys [47208 2012-09-20] (Saitek)
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-07-01 20:36 - 2014-07-01 20:36 - 00011766 _____ () C:\Users\Crue\Desktop\FRST.txt
2014-07-01 20:36 - 2014-07-01 20:36 - 00000850 _____ () C:\Users\Crue\Desktop\JRT.txt
2014-07-01 20:30 - 2014-07-01 20:30 - 02083328 _____ (Farbar) C:\Users\Crue\Desktop\FRST64.exe
2014-07-01 20:30 - 2014-07-01 20:30 - 01016261 _____ (Thisisu) C:\Users\Crue\Desktop\JRT.exe
2014-07-01 20:29 - 2014-07-01 20:29 - 01346519 _____ () C:\Users\Crue\Desktop\adwcleaner_3.214.exe
2014-07-01 15:56 - 2014-07-01 20:36 - 00000000 ____D () C:\FRST
2014-07-01 15:02 - 2014-07-01 15:03 - 00001790 _____ () C:\sc-cleaner.txt
2014-07-01 14:57 - 2014-07-01 14:57 - 00000000 ____D () C:\Windows\ERUNT
2014-07-01 14:42 - 2014-07-01 15:25 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-01 14:42 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-01 14:42 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-01 14:42 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-01 14:35 - 2013-12-13 17:53 - 00019544 _____ (System Speedup) C:\Windows\system32\roboot64.exe
2014-07-01 14:24 - 2014-07-01 14:55 - 00001426 _____ () C:\Windows\PFRO.log
2014-07-01 14:24 - 2014-07-01 14:55 - 00000336 _____ () C:\Windows\setupact.log
2014-07-01 14:24 - 2014-07-01 14:24 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-30 17:01 - 2014-07-01 15:38 - 00000000 ____D () C:\Program Files (x86)\Deeal
2014-06-30 17:01 - 2014-07-01 15:05 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\betadeeal
2014-06-30 17:01 - 2014-06-30 17:01 - 00667648 _____ () C:\Users\Crue\AppData\Roaming\~bobtsxu.exe
2014-06-30 17:01 - 2014-06-30 17:01 - 00003182 _____ () C:\Windows\System32\Tasks\WIN-fdfEfEfAfC
2014-06-30 14:54 - 2014-06-30 14:54 - 00003234 _____ () C:\Windows\System32\Tasks\WIN-statsSystem
2014-06-30 14:54 - 2014-06-30 14:54 - 00003208 _____ () C:\Windows\System32\Tasks\WIN-statsAdmin
2014-06-30 14:54 - 2014-06-30 14:54 - 00001993 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-24 17:54 - 2014-06-24 17:55 - 00000000 ____D () C:\Users\Crue\Desktop\Praktikum
2014-06-23 22:34 - 2014-06-23 22:40 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Wise Registry Cleaner
2014-06-23 22:28 - 2014-06-23 22:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
2014-06-23 22:28 - 2014-06-23 22:28 - 00000000 ____D () C:\Program Files (x86)\Wise
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-06-21 08:00 - 2014-07-01 15:51 - 00248028 _____ () C:\Windows\WindowsUpdate.log
2014-06-18 15:49 - 2014-06-30 17:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-17 15:55 - 2014-06-17 15:55 - 00000722 _____ () C:\Users\Crue\Documents\cc_20140617_155539.reg
2014-06-17 15:38 - 2014-06-17 15:37 - 00000030 _____ () C:\AVScanner.ini
2014-06-17 15:37 - 2014-06-17 15:37 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-12 18:09 - 2014-06-13 16:20 - 00431104 _____ () C:\ProgramData\uninstall_Deeal.exe
2014-06-11 13:38 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 13:38 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 13:38 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-11 13:38 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 13:38 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 13:38 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 13:38 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-11 13:38 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 13:38 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 13:38 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 13:38 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 13:38 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-11 13:38 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-11 13:38 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-11 13:38 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-11 13:38 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 13:38 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 13:38 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-11 13:38 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-11 13:38 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 13:38 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 13:38 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-11 13:38 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 13:38 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-11 13:38 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-11 13:38 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-11 13:38 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 13:38 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-11 13:38 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-11 13:38 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-11 13:38 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 13:38 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-11 13:38 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-11 13:38 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-11 13:38 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 13:38 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-11 13:38 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-11 13:38 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-11 13:38 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-11 13:38 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-11 13:38 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-11 13:38 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 13:38 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-11 13:38 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-11 13:38 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-11 13:38 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 13:38 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-11 13:38 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 13:38 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-11 13:38 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-11 13:38 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 13:38 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-11 13:38 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 13:38 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-06-11 13:38 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 13:38 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-11 13:38 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 13:38 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-11 13:38 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 13:38 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 13:38 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-11 13:38 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-11 13:38 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-11 13:38 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-11 13:38 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-11 13:38 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-11 13:37 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-11 13:37 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-07 07:58 - 2014-06-07 07:59 - 00040198 _____ () C:\Users\Crue\Documents\cc_20140607_075857.reg
2014-06-01 13:19 - 2014-06-01 13:19 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cossacks 2 - Battle for Europe
2014-06-01 13:19 - 2014-06-01 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks 2 - Battle for Europe
2014-06-01 12:31 - 2014-06-01 13:19 - 00000000 ____D () C:\Program Files (x86)\Cossacks 2 - Battle for Europe
==================== One Month Modified Files and Folders =======
2014-07-01 20:36 - 2014-07-01 20:36 - 00011766 _____ () C:\Users\Crue\Desktop\FRST.txt
2014-07-01 20:36 - 2014-07-01 20:36 - 00000850 _____ () C:\Users\Crue\Desktop\JRT.txt
2014-07-01 20:36 - 2014-07-01 15:56 - 00000000 ____D () C:\FRST
2014-07-01 20:30 - 2014-07-01 20:30 - 02083328 _____ (Farbar) C:\Users\Crue\Desktop\FRST64.exe
2014-07-01 20:30 - 2014-07-01 20:30 - 01016261 _____ (Thisisu) C:\Users\Crue\Desktop\JRT.exe
2014-07-01 20:29 - 2014-07-01 20:29 - 01346519 _____ () C:\Users\Crue\Desktop\adwcleaner_3.214.exe
2014-07-01 20:25 - 2013-05-01 14:50 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Skype
2014-07-01 20:22 - 2013-05-01 14:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-01 15:51 - 2014-06-21 08:00 - 00248028 _____ () C:\Windows\WindowsUpdate.log
2014-07-01 15:48 - 2013-09-04 13:13 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-07-01 15:38 - 2014-06-30 17:01 - 00000000 ____D () C:\Program Files (x86)\Deeal
2014-07-01 15:25 - 2014-07-01 14:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 15:05 - 2014-06-30 17:01 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\betadeeal
2014-07-01 15:04 - 2013-09-21 11:25 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-01 15:04 - 2009-07-14 06:45 - 00026512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-01 15:04 - 2009-07-14 06:45 - 00026512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-01 15:03 - 2014-07-01 15:02 - 00001790 _____ () C:\sc-cleaner.txt
2014-07-01 15:02 - 2013-05-01 02:08 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2014-07-01 15:02 - 2013-05-01 02:08 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2014-07-01 15:02 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-01 14:57 - 2014-07-01 14:57 - 00000000 ____D () C:\Windows\ERUNT
2014-07-01 14:55 - 2014-07-01 14:24 - 00001426 _____ () C:\Windows\PFRO.log
2014-07-01 14:55 - 2014-07-01 14:24 - 00000336 _____ () C:\Windows\setupact.log
2014-07-01 14:55 - 2013-05-01 15:19 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-01 14:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-01 14:54 - 2010-01-31 10:52 - 00000000 ____D () C:\temp
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-01 14:42 - 2014-07-01 14:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-01 14:24 - 2014-07-01 14:24 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-01 14:23 - 2013-09-04 15:08 - 00000000 ____D () C:\AdwCleaner
2014-06-30 17:01 - 2014-06-30 17:01 - 00667648 _____ () C:\Users\Crue\AppData\Roaming\~bobtsxu.exe
2014-06-30 17:01 - 2014-06-30 17:01 - 00003182 _____ () C:\Windows\System32\Tasks\WIN-fdfEfEfAfC
2014-06-30 17:01 - 2014-06-18 15:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-30 14:54 - 2014-06-30 14:54 - 00003234 _____ () C:\Windows\System32\Tasks\WIN-statsSystem
2014-06-30 14:54 - 2014-06-30 14:54 - 00003208 _____ () C:\Windows\System32\Tasks\WIN-statsAdmin
2014-06-30 14:54 - 2014-06-30 14:54 - 00001993 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-30 14:54 - 2014-05-31 09:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks - The Art Of War
2014-06-30 14:54 - 2014-05-31 09:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks - Back To War
2014-06-30 14:54 - 2013-05-01 14:46 - 00001961 _____ () C:\Users\Crue\Desktop\Mozilla Firefox.lnk
2014-06-30 14:54 - 2013-04-30 17:35 - 00001769 _____ () C:\Users\Crue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-24 17:55 - 2014-06-24 17:54 - 00000000 ____D () C:\Users\Crue\Desktop\Praktikum
2014-06-23 22:40 - 2014-06-23 22:34 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Wise Registry Cleaner
2014-06-23 22:32 - 2014-05-30 12:54 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\DAEMON Tools Lite
2014-06-23 22:28 - 2014-06-23 22:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
2014-06-23 22:28 - 2014-06-23 22:28 - 00000000 ____D () C:\Program Files (x86)\Wise
2014-06-22 20:02 - 2014-06-22 20:02 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-06-20 20:27 - 2013-09-21 22:29 - 00000000 ____D () C:\Users\Crue\Documents\My Games
2014-06-19 08:40 - 2014-03-01 16:23 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Arc
2014-06-19 08:38 - 2013-05-01 14:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-17 17:41 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-17 17:39 - 2013-10-22 17:50 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-06-17 17:37 - 2013-10-22 17:43 - 00000000 ____D () C:\ProgramData\Origin
2014-06-17 17:37 - 2013-10-22 17:43 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-06-17 15:55 - 2014-06-17 15:55 - 00000722 _____ () C:\Users\Crue\Documents\cc_20140617_155539.reg
2014-06-17 15:37 - 2014-06-17 15:38 - 00000030 _____ () C:\AVScanner.ini
2014-06-17 15:37 - 2014-06-17 15:37 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-17 15:37 - 2013-05-01 14:56 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-06-17 15:37 - 2013-05-01 14:56 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-06-17 15:37 - 2013-05-01 14:56 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-06-14 20:42 - 2013-05-14 17:01 - 00000000 ____D () C:\Users\Crue\Documents\DVDVideoSoft
2014-06-13 16:20 - 2014-06-12 18:09 - 00431104 _____ () C:\ProgramData\uninstall_Deeal.exe
2014-06-12 20:12 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-11 22:47 - 2013-08-15 02:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 22:45 - 2013-05-07 07:52 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-11 22:43 - 2014-05-06 21:15 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-10 20:37 - 2013-05-01 16:07 - 00000000 ____D () C:\Users\Crue\Desktop\Meine Daten
2014-06-08 16:21 - 2013-09-04 13:13 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-08 16:01 - 2014-04-21 14:33 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Tropico 4
2014-06-08 11:41 - 2014-05-02 19:51 - 00000000 ____D () C:\Users\Crue\Documents\GTA San Andreas User Files
2014-06-08 11:13 - 2014-06-11 13:37 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-11 13:37 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-07 12:52 - 2013-09-21 21:42 - 00000000 ____D () C:\Users\Crue\Documents\Square Enix
2014-06-07 08:18 - 2013-05-17 16:54 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\TS3Client
2014-06-07 07:59 - 2014-06-07 07:58 - 00040198 _____ () C:\Users\Crue\Documents\cc_20140607_075857.reg
2014-06-01 13:19 - 2014-06-01 13:19 - 00000000 ____D () C:\Users\Crue\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cossacks 2 - Battle for Europe
2014-06-01 13:19 - 2014-06-01 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks 2 - Battle for Europe
2014-06-01 13:19 - 2014-06-01 12:31 - 00000000 ____D () C:\Program Files (x86)\Cossacks 2 - Battle for Europe
Files to move or delete:
====================
C:\ProgramData\uninstall_Deeal.exe
C:\Users\Crue\Combatarms_eu.exe
Some content of TEMP:
====================
C:\Users\Crue\AppData\Local\Temp\avgnt.exe
C:\Users\Crue\AppData\Local\Temp\Quarantine.exe
C:\Users\Crue\AppData\Local\Temp\unzip.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-29 20:47
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-06-2014
Ran by Crue at 2014-07-01 21:12:50
Running from C:\Users\Crue\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.7.0.1530 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.7.0.1530 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Age of Mythology (HKLM-x32\...\Age of Mythology 1.0) (Version: - )
Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc)
Arc (HKLM-x32\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.9668 - Perfect World Entertainment)
AutoIt v3.3.8.0 (HKLM-x32\...\AutoItv3) (Version: - AutoIt Team)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.450 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0600}) (Version: 12.6.0.1900 - APN, LLC)
Bad Rats (HKLM-x32\...\Steam App 34900) (Version: - Invent4 Entertainment)
Banished (HKLM-x32\...\QmFuaXNoZWQ=_is1) (Version: 1 - )
Batman: Arkham Asylum GOTY Edition (HKLM-x32\...\Steam App 35140) (Version: - Rocksteady Studios)
BioShock (HKLM-x32\...\Steam App 7670) (Version: - 2K Boston)
BioShock 2 (HKLM-x32\...\Steam App 8850) (Version: - 2K Marin)
Blackwell Convergence (HKLM-x32\...\Steam App 80350) (Version: - Wadjet Eye Games)
Blackwell Deception (HKLM-x32\...\Steam App 80360) (Version: - Wadjet Eye Games)
Blackwell Unbound (HKLM-x32\...\Steam App 80340) (Version: - Wadjet Eye Games)
Borderlands (HKLM-x32\...\Steam App 8980) (Version: - Gearbox Software)
Burnout Paradise: The Ultimate Box (HKLM-x32\...\Steam App 24740) (Version: - Criterion Games)
CCleaner (HKLM\...\CCleaner) (Version: 4.01 - Piriform)
Cheat Engine 6.3 (HKLM-x32\...\Cheat Engine 6.3_is1) (Version: - Cheat Engine)
Combat Arms EU (HKLM-x32\...\Combat Arms EU) (Version: - )
Cossacks - Back To War (HKLM-x32\...\Cossacks : Back To War) (Version: - )
Cossacks - European Wars (HKLM-x32\...\EW : Cossacks) (Version: - )
Cossacks - The Art Of War (HKLM-x32\...\Cossacks : The Art Of War) (Version: - )
Crysis 2 Maximum Edition (HKLM-x32\...\Steam App 108800) (Version: - Crytek Studios)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Deponia (HKLM-x32\...\Steam App 214340) (Version: - Daedalic Entertainment)
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.63.5 - Electronic Arts)
Die Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.5.1 - Electronic Arts)
Die Sims™ 3 Luxus-Accessoires (HKLM-x32\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)
Die Sims™ 3 Stadt-Accessoires (HKLM-x32\...\{7B11296A-F894-449C-8DF6-6AAAA7D4D118}) (Version: 9.0.73 - Electronic Arts)
Dwarfs!? (HKLM-x32\...\Steam App 35480) (Version: - Power of 2)
Earth 2160 (HKLM-x32\...\Steam App 1900) (Version: - Reality Pump Studios)
Free Studio version 2013 (HKLM-x32\...\Free Studio_is1) (Version: 6.1.11.827 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.20.1230 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.20.1230 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.29.304 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.29.304 - DVDVideoSoft Ltd.)
Gameforge Live 1.9.0 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.9.0 - Gameforge)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION
Grand Theft Auto San Andreas (HKLM-x32\...\{2BB114DA-C718-45FE-8AB9-DEFFF0EA5569}_is1) (Version: v1.0/1.1 - Grosses_K)
Greenshot 1.0.6.2228 (HKLM\...\Greenshot_is1) (Version: 1.0.6.2228 - Greenshot)
Halo: Spartan Assault (HKLM-x32\...\Steam App 277430) (Version: - Vanguard Games)
Hotline Miami (HKLM-x32\...\Steam App 219150) (Version: - Dennaton Games)
HTC Driver Installer (HKLM-x32\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.3.0.001 - HTC Corporation)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
Java 7 Update 21 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417021FF}) (Version: 7.0.210 - Oracle)
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
Loadout (HKLM-x32\...\Steam App 208090) (Version: - Edge of Reality)
Magicka (HKLM-x32\...\Steam App 42910) (Version: - Arrowhead Game Studios)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Medal of Honor(TM) Multiplayer (HKLM-x32\...\Steam App 47830) (Version: - Electronic Arts)
Medal of Honor(TM) Single Player (HKLM-x32\...\Steam App 47790) (Version: - Electronic Arts)
Metin2 (HKLM-x32\...\Metin2_is1) (Version: - Gameforge 4D GmbH)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Corporation (Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft Corporation (x32 Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden
Mirror's Edge (HKLM-x32\...\Steam App 17410) (Version: - DICE)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML4 Parser (HKLM-x32\...\{01501EBA-EC35-4F9F-8889-3BE346E5DA13}) (Version: 1.0.0 - Microsoft Game Studios)
Natural Selection 2 (HKLM-x32\...\Steam App 4920) (Version: - Unknown Worlds Entertainment)
Neverwinter (HKLM-x32\...\Neverwinter) (Version: - Cryptic Studios)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.3 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 334.89 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 334.89 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.147.1067 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3489 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 334.89 (Version: 334.89 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.10.4710 - Electronic Arts, Inc.)
PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version: - OVERKILL - a Starbreeze Studio.)
PCSX2 - Playstation 2 Emulator (HKLM-x32\...\pcsx2-r4600) (Version: - )
Peggle (HKLM-x32\...\{715AD72D-887A-459E-988B-D4F3E87FA24B}) (Version: 1.04.0.0 - PopCap Games)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
PremiumSoft Navicat 8.1 for MySQL (HKLM-x32\...\PremiumSoft Navicat 8.1 for MySQL_is1) (Version: - PremiumSoft CyberTech Ltd.)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.989 - Even Balance, Inc.)
RollerCoaster Tycoon 3: Platinum! (HKLM-x32\...\Steam App 2700) (Version: - Frontier)
Serious Sam 2 (HKLM-x32\...\Steam App 204340) (Version: - Croteam)
Serious Sam 3: BFE (HKLM-x32\...\Steam App 41070) (Version: - Croteam)
Serious Sam HD: The First Encounter (HKLM-x32\...\Steam App 41000) (Version: - Croteam)
Serious Sam HD: The Second Encounter (HKLM-x32\...\Steam App 41010) (Version: - Croteam)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Smart Technology Programming Software 7.0.24.8 (HKLM\...\{F31F1F66-5685-4C21-906E-20CB74C7BCDF}) (Version: 7.0.24.8 - Mad Catz)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold 2 (HKLM-x32\...\{16D2C649-CBA8-44EE-B730-12584667D487}) (Version: 1.40.1000 - Firefly Studios)
Stronghold 3 (HKLM-x32\...\Steam App 47400) (Version: - FireFly Studios)
Stronghold Crusader Extreme (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: 1.20.0000 - Firefly Studios)
Stronghold Legends (HKLM-x32\...\{66A405D2-BA14-4594-BF36-B3B544F0754E}) (Version: 1.20.0000 - Firefly Studios)
SupraSavings (Version: 1.0.0.0 - SupraSavings) Hidden <==== ATTENTION
Syberia (HKLM-x32\...\Steam App 46500) (Version: - Anuman)
Syberia 2 (HKLM-x32\...\Steam App 46510) (Version: - Anuman / Microids)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.10 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.26297 - TeamViewer)
The Blackwell Legacy (HKLM-x32\...\Steam App 80330) (Version: - Wadjet Eye Games)
The Lord of the Rings: War in the North (HKLM-x32\...\Steam App 32800) (Version: - Snowblind Studios)
The Mighty Quest For Epic Loot (HKLM-x32\...\Steam App 239220) (Version: - Ubisoft Montreal)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED)
Titanfall™ (HKLM-x32\...\{347EE0C3-0690-48F6-A231-53853C2A80D6}) (Version: 1.0.3.7 - Electronic Arts)
Torchlight II (HKLM-x32\...\Steam App 200710) (Version: - Runic Games)
Tropico 4 (HKLM-x32\...\Steam App 57690) (Version: - Haemimont Games)
UltraISO Premium V9.6 (HKLM-x32\...\UltraISO_is1) (Version: - )
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
Warface Launcher (Beta) (HKLM-x32\...\{28D1723C-31C4-4A83-9799-DFFB3739026D}) (Version: 1.0.0 - Crytek GmbH)
Warframe (HKLM-x32\...\Steam App 230410) (Version: - Digital Extremes)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wise Registry Cleaner 8.12 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 8.12 - WiseCleaner.com, Inc.)
Worms Revolution (HKLM-x32\...\Steam App 200170) (Version: - Team17 Digital Ltd.)
Worms Ultimate Mayhem (HKLM-x32\...\Steam App 70600) (Version: - Team17 Software Ltd.)
XAMPP (HKLM-x32\...\xampp) (Version: 1.8.3-2 - BitNami)
==================== Restore Points =========================
22-06-2014 19:19:22 Geplanter Prüfpunkt
24-06-2014 13:46:33 Windows Update
30-06-2014 12:56:32 Removed LogMeIn Hamachi
30-06-2014 15:06:03 Removed SupraSavings
01-07-2014 11:54:44 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {29D7C502-C1DB-4101-92CA-F9E77D1F0A11} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)
Task: {3DB47C9C-ABBB-4E79-9243-43CCFAB675F5} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-4 No Task File <==== ATTENTION
Task: {55414255-4CB3-4A2A-9D12-B7C14CB3221B} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files (x86)\IObit\Game Booster 3\AutoUpdate.exe <==== ATTENTION
Task: {5D0AA912-7A99-4B92-88B4-255E2711CED5} - \globalUpdateUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {616F2D8C-3B28-456F-B90F-66923DBB16B9} - System32\Tasks\WIN-fdfEfEfAfC => C:\Users\Crue\AppData\Roaming\~bobtsxu.exe [2014-06-30] ()
Task: {6F4D6BBA-24BB-420F-ADDF-983E438A3C80} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-17] (Adobe Systems Incorporated)
Task: {7466379E-920C-4B48-8D24-91BC3DCB1A64} - System32\Tasks\WIN-statsSystem => C:\Users\Crue\AppData\Local\Microsoft\WinU\~hkebvqx.exe [2014-06-30] ()
Task: {7CF0E93A-340A-4318-88A3-1514BB5F9497} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {85CF2311-CEC1-4C3D-A9F3-9A3EDA3D08B6} - System32\Tasks\WIN-statsAdmin => C:\Users\Crue\AppData\Local\Microsoft\WinU\~frwgdnm.exe [2014-06-30] ()
Task: {871AD24D-8D64-421E-B00D-4953FD186088} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {97D5559A-2250-46D7-9863-209F38FF0831} - \DealPlyLiveUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {A5EFC68B-4BB4-43BB-BF60-BDCF5AD1D5DA} - \DealPlyLiveUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {ACFDB62E-92BD-4E77-9182-24D570054B7E} - \DealPlyUpdate No Task File <==== ATTENTION
Task: {ADD8D483-7B92-4C2E-AE8F-7FDDAB0B820F} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-1 No Task File <==== ATTENTION
Task: {B04A14AB-4F9A-46A6-B9A2-0AC298BF0351} - \Lyrics Seeker Update No Task File <==== ATTENTION
Task: {B693F56A-25E6-4DC4-8B04-C7A49435F2D7} - \Dealply No Task File <==== ATTENTION
Task: {D5F272B6-2BCF-4D59-8BC7-D2C7344AA65B} - System32\Tasks\wp_update => C:\Users\Crue\AppData\Roaming\~zdyvexm.exe <==== ATTENTION
Task: {DD8191EB-EBD6-463E-BE5A-EEF62AA97740} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-3 No Task File <==== ATTENTION
Task: {FD25ECF2-EF85-4575-BE70-F7D2E36E2B52} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-05-01 15:18 - 2014-02-08 19:42 - 00117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-12-07 18:27 - 2012-12-07 18:27 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2013-11-13 17:10 - 2013-11-13 17:22 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-06-12 14:55 - 2014-06-12 14:55 - 00751952 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOSBrowser.exe
2014-05-08 14:41 - 2014-05-22 15:10 - 10701264 _____ () C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\PEM.exe
2014-06-12 14:55 - 2014-06-12 14:55 - 00698704 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOSOverlay.exe
2014-06-18 15:49 - 2014-06-18 15:50 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-06-12 14:55 - 2014-06-12 14:55 - 01481040 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\CoreUI.dll
2014-02-24 18:37 - 2014-02-24 18:37 - 00174416 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\ZUnZip.dll
2014-02-24 18:36 - 2014-02-24 18:36 - 00568552 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\sqlite3.dll
2014-05-20 15:06 - 2014-05-20 15:06 - 00174416 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOverlayStub.dll
2014-02-24 18:36 - 2014-02-24 18:36 - 24984912 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\libcef.dll
2014-02-24 18:36 - 2014-02-24 18:36 - 00742736 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\libglesv2.dll
2014-02-24 18:36 - 2014-02-24 18:36 - 00136528 _____ () C:\Program Files (x86)\Perfect World Entertainment\Arc\libegl.dll
2014-06-17 15:37 - 2014-06-17 15:37 - 17024688 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll
2013-11-22 11:59 - 2014-05-22 15:10 - 04580184 _____ () C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\ElementSkill.dll
2012-12-26 13:16 - 2012-12-26 13:16 - 00454792 _____ () C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\SpeedTreeRT.dll
2012-12-26 13:16 - 2012-12-26 13:16 - 00147456 _____ () C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\FTDriver.dll
2012-12-26 13:16 - 2012-12-26 13:16 - 00024712 _____ () C:\Program Files (x86)\Perfect World Entertainment\Forsaken World_de\update\ImmWrapper.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SecureAssist => ""="service"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
MSCONFIG\startupfolder: C:^Users^Crue^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.1.lnk => C:\Windows\pss\OpenOffice.org 3.4.1.lnk.Startup
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Crue\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: ApnTBMon => "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: EADM => "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent
MSCONFIG\startupreg: XboxStat => "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/01/2014 08:52:21 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Microsoft Office Sessions:
=========================
Error: (07/01/2014 08:52:21 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 26%
Total physical RAM: 14327.18 MB
Available physical RAM: 10488.86 MB
Total Pagefile: 28652.53 MB
Available Pagefile: 24623.88 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (BOOT) (Fixed) (Total:576.17 GB) (Free:101.49 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:19.99 GB) (Free:15.91 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: F98D6E74)
Partition 1: (Active) - (Size=576 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=20 GB) - (Type=OF Extended)
==================== End Of Log ============================
Geändert von Crue (01.07.2014 um 20:16 Uhr) |
|
01.07.2014, 20:06
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. 
__________________ --> System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst |
|
02.07.2014, 14:44
| #7 |
| | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst Addition.txt in den letzen Beitrag eingefügt. |
|
02.07.2014, 15:00
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Task: {3DB47C9C-ABBB-4E79-9243-43CCFAB675F5} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-4 No Task File <==== ATTENTION
Task: {55414255-4CB3-4A2A-9D12-B7C14CB3221B} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files (x86)\IObit\Game Booster 3\AutoUpdate.exe <==== ATTENTION
Task: {5D0AA912-7A99-4B92-88B4-255E2711CED5} - \globalUpdateUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {616F2D8C-3B28-456F-B90F-66923DBB16B9} - System32\Tasks\WIN-fdfEfEfAfC => C:\Users\Crue\AppData\Roaming\~bobtsxu.exe [2014-06-30] ()
Task: {7466379E-920C-4B48-8D24-91BC3DCB1A64} - System32\Tasks\WIN-statsSystem => C:\Users\Crue\AppData\Local\Microsoft\WinU\~hkebvqx.exe [2014-06-30] ()
Task: {85CF2311-CEC1-4C3D-A9F3-9A3EDA3D08B6} - System32\Tasks\WIN-statsAdmin => C:\Users\Crue\AppData\Local\Microsoft\WinU\~frwgdnm.exe [2014-06-30] ()
Task: {97D5559A-2250-46D7-9863-209F38FF0831} - \DealPlyLiveUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {A5EFC68B-4BB4-43BB-BF60-BDCF5AD1D5DA} - \DealPlyLiveUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {ACFDB62E-92BD-4E77-9182-24D570054B7E} - \DealPlyUpdate No Task File <==== ATTENTION
Task: {ADD8D483-7B92-4C2E-AE8F-7FDDAB0B820F} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-1 No Task File <==== ATTENTION
Task: {B04A14AB-4F9A-46A6-B9A2-0AC298BF0351} - \Lyrics Seeker Update No Task File <==== ATTENTION
Task: {B693F56A-25E6-4DC4-8B04-C7A49435F2D7} - \Dealply No Task File <==== ATTENTION
Task: {D5F272B6-2BCF-4D59-8BC7-D2C7344AA65B} - System32\Tasks\wp_update => C:\Users\Crue\AppData\Roaming\~zdyvexm.exe <==== ATTENTION
Task: {DD8191EB-EBD6-463E-BE5A-EEF62AA97740} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-3 No Task File <==== ATTENTION
Task: {FD25ECF2-EF85-4575-BE70-F7D2E36E2B52} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
C:\Users\Crue\AppData\Roaming\*.exe
C:\Program Files (x86)\IObit\Game Booster 3
C:\Users\Crue\AppData\Local\Microsoft\WinU
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.07.2014, 15:14
| #9 |
| | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbstCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-07-2014
Ran by Crue at 2014-07-02 16:13:41 Run:1
Running from C:\Users\Crue\Desktop\Meine Daten\Programme
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
Task: {3DB47C9C-ABBB-4E79-9243-43CCFAB675F5} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-4 No Task File <==== ATTENTION
Task: {55414255-4CB3-4A2A-9D12-B7C14CB3221B} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files (x86)\IObit\Game Booster 3\AutoUpdate.exe <==== ATTENTION
Task: {5D0AA912-7A99-4B92-88B4-255E2711CED5} - \globalUpdateUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {616F2D8C-3B28-456F-B90F-66923DBB16B9} - System32\Tasks\WIN-fdfEfEfAfC => C:\Users\Crue\AppData\Roaming\~bobtsxu.exe [2014-06-30] ()
Task: {7466379E-920C-4B48-8D24-91BC3DCB1A64} - System32\Tasks\WIN-statsSystem => C:\Users\Crue\AppData\Local\Microsoft\WinU\~hkebvqx.exe [2014-06-30] ()
Task: {85CF2311-CEC1-4C3D-A9F3-9A3EDA3D08B6} - System32\Tasks\WIN-statsAdmin => C:\Users\Crue\AppData\Local\Microsoft\WinU\~frwgdnm.exe [2014-06-30] ()
Task: {97D5559A-2250-46D7-9863-209F38FF0831} - \DealPlyLiveUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {A5EFC68B-4BB4-43BB-BF60-BDCF5AD1D5DA} - \DealPlyLiveUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {ACFDB62E-92BD-4E77-9182-24D570054B7E} - \DealPlyUpdate No Task File <==== ATTENTION
Task: {ADD8D483-7B92-4C2E-AE8F-7FDDAB0B820F} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-1 No Task File <==== ATTENTION
Task: {B04A14AB-4F9A-46A6-B9A2-0AC298BF0351} - \Lyrics Seeker Update No Task File <==== ATTENTION
Task: {B693F56A-25E6-4DC4-8B04-C7A49435F2D7} - \Dealply No Task File <==== ATTENTION
Task: {D5F272B6-2BCF-4D59-8BC7-D2C7344AA65B} - System32\Tasks\wp_update => C:\Users\Crue\AppData\Roaming\~zdyvexm.exe <==== ATTENTION
Task: {DD8191EB-EBD6-463E-BE5A-EEF62AA97740} - \fde639c5-a4cc-438e-8184-b9d525bc4d0f-3 No Task File <==== ATTENTION
Task: {FD25ECF2-EF85-4575-BE70-F7D2E36E2B52} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
C:\Users\Crue\AppData\Roaming\*.exe
C:\Program Files (x86)\IObit\Game Booster 3
C:\Users\Crue\AppData\Local\Microsoft\WinU
*****************
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3DB47C9C-ABBB-4E79-9243-43CCFAB675F5}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3DB47C9C-ABBB-4E79-9243-43CCFAB675F5}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\fde639c5-a4cc-438e-8184-b9d525bc4d0f-4' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{55414255-4CB3-4A2A-9D12-B7C14CB3221B}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{55414255-4CB3-4A2A-9D12-B7C14CB3221B}' => Key deleted successfully.
C:\Windows\System32\Tasks\Game_Booster_AutoUpdate => Moved successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Game_Booster_AutoUpdate' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5D0AA912-7A99-4B92-88B4-255E2711CED5}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5D0AA912-7A99-4B92-88B4-255E2711CED5}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\globalUpdateUpdateTaskMachineUA' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{616F2D8C-3B28-456F-B90F-66923DBB16B9}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{616F2D8C-3B28-456F-B90F-66923DBB16B9}' => Key deleted successfully.
C:\Windows\System32\Tasks\WIN-fdfEfEfAfC => Moved successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WIN-fdfEfEfAfC' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7466379E-920C-4B48-8D24-91BC3DCB1A64}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7466379E-920C-4B48-8D24-91BC3DCB1A64}' => Key deleted successfully.
C:\Windows\System32\Tasks\WIN-statsSystem => Moved successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WIN-statsSystem' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{85CF2311-CEC1-4C3D-A9F3-9A3EDA3D08B6}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{85CF2311-CEC1-4C3D-A9F3-9A3EDA3D08B6}' => Key deleted successfully.
C:\Windows\System32\Tasks\WIN-statsAdmin => Moved successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WIN-statsAdmin' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{97D5559A-2250-46D7-9863-209F38FF0831}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{97D5559A-2250-46D7-9863-209F38FF0831}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineCore' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A5EFC68B-4BB4-43BB-BF60-BDCF5AD1D5DA}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A5EFC68B-4BB4-43BB-BF60-BDCF5AD1D5DA}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineUA' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ACFDB62E-92BD-4E77-9182-24D570054B7E}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ACFDB62E-92BD-4E77-9182-24D570054B7E}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyUpdate' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{ADD8D483-7B92-4C2E-AE8F-7FDDAB0B820F}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ADD8D483-7B92-4C2E-AE8F-7FDDAB0B820F}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\fde639c5-a4cc-438e-8184-b9d525bc4d0f-1' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B04A14AB-4F9A-46A6-B9A2-0AC298BF0351}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B04A14AB-4F9A-46A6-B9A2-0AC298BF0351}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Lyrics Seeker Update' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B693F56A-25E6-4DC4-8B04-C7A49435F2D7}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B693F56A-25E6-4DC4-8B04-C7A49435F2D7}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dealply' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D5F272B6-2BCF-4D59-8BC7-D2C7344AA65B}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D5F272B6-2BCF-4D59-8BC7-D2C7344AA65B}' => Key deleted successfully.
C:\Windows\System32\Tasks\wp_update => Moved successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\wp_update' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DD8191EB-EBD6-463E-BE5A-EEF62AA97740}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DD8191EB-EBD6-463E-BE5A-EEF62AA97740}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\fde639c5-a4cc-438e-8184-b9d525bc4d0f-3' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FD25ECF2-EF85-4575-BE70-F7D2E36E2B52}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD25ECF2-EF85-4575-BE70-F7D2E36E2B52}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\globalUpdateUpdateTaskMachineCore' => Key deleted successfully.
C:\Users\Crue\AppData\Roaming\*.exe => Moved successfully.
C:\Program Files (x86)\IObit\Game Booster 3 => Moved successfully.
C:\Users\Crue\AppData\Local\Microsoft\WinU => Moved successfully.
==== End of Fixlog ====
|
|
02.07.2014, 15:23
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.07.2014, 21:45
| #11 |
| | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbstCode:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 02.07.2014 Suchlauf-Zeit: 16:39:07 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.07.02.03 Rootkit Datenbank: v2014.07.01.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Crue Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 272729 Verstrichene Zeit: 8 Min, 18 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Malewarebyte hatte keine Funde ESET dauert zu lange lief gestern 5h und war erst bei 45% und musste weg. Das gute ist aber dass sich heute als ich den Rechner gestartet habe die Viren weg waren. Ob sie nun komplett weg sind hab ich keine Ahnung aber die 2 Programme werden nicht mehr installiert. Ist ESET wirklich so wichtig? dafür müsste ich nämlich über Nacht oder wenn ich Arbeit bin laufen lassen so dauert es viel zu lange. Nach 6h auch fertig Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=70f5f442da144042bc40aa2762d8e052
# engine=18989
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-07-02 08:56:01
# local_time=2014-07-02 10:56:01 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 19037 26041409 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 25915 155964411 0 0
# scanned=311342
# found=6
# cleaned=0
# scan_time=17713
sh=277184DA3C9EA2978F906C19295EFB5C5B05312D ft=1 fh=e64c526704b4d97f vn="Variante von Win32/AdWare.Adpeak.I Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupraSavings\2rs3.dll.vir"
sh=DA5FB3EC9626A14CF284F51DEFDBC040D14854DC ft=1 fh=3ccc85b63cb510cb vn="Variante von Win32/AdWare.Adpeak.I Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupraSavings\CustomActionInstall.vir"
sh=F1BF41B871B373DA5582856271D7A35AF9C3D059 ft=1 fh=cecd9d37647e9ccd vn="Variante von Win32/AdWare.Adpeak.I Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupraSavings\CustomActionUninstall.vir"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe"
sh=283EB5950673B6392906E164AD7320C7573F7E34 ft=1 fh=a7887884f30b7fa9 vn="Variante von Win32/HackTool.Crack.BL potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Banished\steam_api.dll"
sh=C6D57FA193E6ACF34DF0E243A228179D2F7BA2F5 ft=1 fh=470efc78ccfd150b vn="Variante von Win32/Packed.Themida.AAN Trojaner" ac=I fn="C:\Users\Crue\Desktop\Meine Daten\Programme\Games\Online\Fusion-Network\core\switchbot.dll"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=70f5f442da144042bc40aa2762d8e052
# engine=19004
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-07-03 07:55:08
# local_time=2014-07-03 09:55:08 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 101784 26124156 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 23477 156047158 0 0
# scanned=417561
# found=10
# cleaned=0
# scan_time=23227
sh=277184DA3C9EA2978F906C19295EFB5C5B05312D ft=1 fh=e64c526704b4d97f vn="Variante von Win32/AdWare.Adpeak.I Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupraSavings\2rs3.dll.vir"
sh=DA5FB3EC9626A14CF284F51DEFDBC040D14854DC ft=1 fh=3ccc85b63cb510cb vn="Variante von Win32/AdWare.Adpeak.I Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupraSavings\CustomActionInstall.vir"
sh=F1BF41B871B373DA5582856271D7A35AF9C3D059 ft=1 fh=cecd9d37647e9ccd vn="Variante von Win32/AdWare.Adpeak.I Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupraSavings\CustomActionUninstall.vir"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe"
sh=283EB5950673B6392906E164AD7320C7573F7E34 ft=1 fh=a7887884f30b7fa9 vn="Variante von Win32/HackTool.Crack.BL potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Banished\steam_api.dll"
sh=C6D57FA193E6ACF34DF0E243A228179D2F7BA2F5 ft=1 fh=470efc78ccfd150b vn="Variante von Win32/Packed.Themida.AAN Trojaner" ac=I fn="C:\Users\Crue\Desktop\Meine Daten\Programme\Games\Online\Fusion-Network\core\switchbot.dll"
sh=F4B0FF4B42F223CF8338684906BCFFAD9AA2710E ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\Installer\1a34130.msi"
sh=9B229D45DAF8E42A9E5AB80B8A8F3C1DA28BE5D9 ft=1 fh=fc29e722f48e28ff vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\Installer\MSI4992.tmp"
sh=E44D062204C9698F5C95651F2E424D37A31F5B15 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[1].7z"
sh=E44D062204C9698F5C95651F2E424D37A31F5B15 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[1].7z"
|
|
04.07.2014, 09:20
| #12 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbstZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.07.2014, 11:43
| #13 |
| | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst C:\Program Files (x86)\Banished\steam_api.dll Ein Steam Spiel. C:\Users\Crue\Desktop\Meine Daten\Programme\Games\Online\Fusion-Network\core\switchbot.dll Eine Ingame Funktion eines Privat Servers. |
|
04.07.2014, 12:28
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst Dann sind das Fehlalarme. TFC - Temp File Cleaner Lade dir  TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.07.2014, 12:48
| #15 |
| | System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst Vielen Dank für die hilfe erstmal. Cookies werden bei mir schon gelöscht nach dem schließen des Browsers. Habe auch einen Ad Blocker also von Werbung kann nichts kommen. Höchstens von irgendwelchen Programmen die dann 1000 Sachen mit installieren obwohl ich die Häcken raus mache. Wies bei einer Freeware nunmal ist. Außerdem war es das 2. mal in 8 Jahren, dass ich ein ernsthaftes Problem mit Viren hatte also glaube ich nicht dass nochmal was passiert. Habe schon alle Sicherheitsmaßnahmen getroffen die ich kenne um sowas zu vermeiden. Dankeschön nochmal. |
|
| Themen zu System speedup und Advanced System Protection installieren sich nach dem deinstallieren von selbst |
| adware/adware.gen, beenden, dvdvideosoft ltd., internet explorer, microsoft, preferences, problem, programme, prozesse, pup.optional.adpeak.a, pup.optional.elex.a, pup.optional.mysearchdial.a, pup.optional.pricora.a, pup.optional.qone8, pup.optional.quickstart.a, pup.optional.suprasavings.a, quick_start, registrierungsdatenbank, software, system32, trojan.banker.kreapixel, windows |
Linear-Darstellung
