| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7: Virenfund (win32.trojan.* NSIS.Application.*)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.07.2014, 12:00
| #1 |
| |  Windows 7: Virenfund (win32.trojan.* NSIS.Application.*) Hallo Nachdem mein Emailkonto zum senden von Spam benutzt wurde, fand ich mit G data mehrere Viren auf meinem Rechner. Ist es mögliche diese vollständig zu entfernen ohene den Rechner zu formatieren? Anbei die logfiles von g data, Defogger, Frst und Gmer Vielen dank für eure hilfe im vorraus G data logfile Code:
ATTFilter Virenprüfung mit G Data InternetSecurity
Version 25.0.1.4 (11.06.2014)
Virensignaturen vom 24.07.2014
Startzeit: 24.07.2014 09:38:07
Engine(s): Engine A (AVA 24.3311), Engine B (GD 25.3637)
Heuristik: Ein
Archive: Ein
Systembereiche: Ein
RootKits prüfen: Ein
Prüfung der Systembereiche...
Prüfung aller im Speicher befindlichen Prozesse und Verweise im Autostart...
Prüfung auf RootKits...
Prüfung aller lokalen Festplatten...
Analyse vollständig durchgeführt: 24.07.2014 11:47:41
235457 Dateien überprüft
9 infizierte Dateien gefunden
0 verdächtige Dateien gefunden
Objekt: DTHelper.exe
Pfad: C:\Program Files (x86)\DAEMON Tools Lite
Status: Datei in Quarantäne verschoben
Virus: Win32.Trojan.Banki.A (Engine B)
Objekt: nsprotector.js
Pfad: C:\Program Files (x86)\Mozilla Firefox
Status: Datei in Quarantäne verschoben
Virus: Script.Application.SearchProtect.Q (Engine B)
Objekt: Launcher.exe
Pfad: C:\Windows
Status: Datei in Quarantäne verschoben
Virus: Win32.Application.SimplyTech.A (Engine B)
Archiv: AstroburnLite180-0182.exe
Pfad: C:\Users\egal\AppData\Local\Temp
Status: Datei in Quarantäne verschoben
Virus: NSIS.Application.OpenCandy.B (Engine B)
Objekt: [NSIS].nsi
In Archiv: C:\Users\egal\AppData\Local\Temp\AstroburnLite180-0182.exe
Status: Virus gefunden
Virus: NSIS.Application.OpenCandy.B
Archiv: pricealarm.exe
Pfad: C:\Users\me\AppData\Local\DownloadGuide\Offers
Status: Datei in Quarantäne verschoben
Virus: Script.Trojan-Spy.VIS.B (Engine B)
Objekt: data/ff/chrome/content/pricealarm.js
In Archiv: C:\Users\me\AppData\Local\DownloadGuide\Offers\pricealarm.exe
Status: Virus gefunden
Virus: Script.Trojan-Spy.VIS.B
Archiv: DTLite4491-0356.exe
Pfad: C:\Users\me\AppData\Local\Temp
Status: Datei in Quarantäne verschoben
Virus: NSIS.Application.OpenCandy.B (Engine B)
Objekt: [NSIS].nsi
In Archiv: C:\Users\me\AppData\Local\Temp\DTLite4491-0356.exe
Status: Virus gefunden
Virus: NSIS.Application.OpenCandy.B
Archiv: DTLite4471-0333.exe
Pfad: C:\Users\me\Downloads
Status: Datei in Quarantäne verschoben
Virus: Win32.Trojan.Banki.A, NSIS.Application.OpenCandy.B (Engine B)
Objekt: $INSTDIR\DTHelper.exe
In Archiv: C:\Users\me\Downloads\DTLite4471-0333.exe
Status: Virus gefunden
Virus: Win32.Trojan.Banki.A
Objekt: [NSIS].nsi
In Archiv: C:\Users\me\Downloads\DTLite4471-0333.exe
Status: Virus gefunden
Virus: NSIS.Application.OpenCandy.B
Archiv: DTLite4454-0314.exe
Pfad: D:\backup\programme
Status: Datei in Quarantäne verschoben
Virus: NSIS.Application.OpenCandy.B (Engine B)
Objekt: [NSIS].nsi
In Archiv: D:\backup\programme\DTLite4454-0314.exe
Status: Virus gefunden
Virus: NSIS.Application.OpenCandy.B
Archiv: DTLite4461-0327.exe
Pfad: D:\Users\me\Downloads
Status: Datei in Quarantäne verschoben
Virus: NSIS.Application.OpenCandy.B (Engine B)
Objekt: [NSIS].nsi
In Archiv: D:\Users\me\Downloads\DTLite4461-0327.exe
Status: Virus gefunden
Virus: NSIS.Application.OpenCandy.B
Der Zugriff auf die folgenden Dateien wurde verweigert:
D:\betriebssysteme\iPhone3G_Normal_WD6\__MACOSX\._READ_ME.txt:Zone.Identifier
D:\Users\me\Downloads\iPhone3G_Normal_WD6\__MACOSX\._READ_ME.txt:Zone.Identifier
C:\Windows\CSC\v2.0.6\pq
C:\Windows\CSC\v2.0.6\temp\ea-{576f94a1-1ee1-11e3-83b0-dc4c348a742b}
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession7.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTUBPM.etl
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat.LOG2
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat.LOG1
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat{255b9507-1f6a-11e3-a132-14feb5c55e8f}.TM.blf
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat{255b9507-1f6a-11e3-a132-14feb5c55e8f}.TMContainer00000000000000000002.regtrans-ms
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0f6f9445a5848657806bcdc71e7e8df2_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\18860b65a58235275844d72e6f9d0e89_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0a77fba3c7e0ac1ff94625556e5c9c41_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\1a006425bc1731962d18c73ca2c0afa8_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\273101a01233a07d31a8b462944fe594_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\27c0968e7a336b4751eff1a578c02c53_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\289cae905d2e45ddf9a496cd6b3f7c48_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\367357769c1e297869be08dbfab7e9a7_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\39e541f125bf6b014dd1ef837da1b045_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\2ec5a003bc73228206a2e062ccbda4cd_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3e08f3f52cf1d94c53131619f8285e60_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\33d1c2a2ccb98bc7da1b97fcf522088d_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\40f6146ef87bdaeece87929fb6009608_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3b0095f819d55825a4aaffc4fa600822_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4a8d99983ab7c93a15d17899721612f9_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4e66880e2815dcb5f66d6808b80c4706_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4aa8ab302bf8f96804aab031e7eae5c5_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\44934bcb3b034ee949dff7a7b26e0834_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5c2484084f8cc28514d8afea77cd3532_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5b3340cf9f8d0a6c0ea7771f29032ff6_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\62308cbc5b3275e8a5ce02af1fc43cea_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\526e0503eadb53733e0852c251cf08b3_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6583f8a2f9e8a8a93cd8ba823651cbd2_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\662bcfa6b2f921552cb383f47f4fd814_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\62ea08f843e9d90d8cb43a48f356a578_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\69021f6809f6bec031e205a53d40f5cc_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6a76823756172a9f36d7abae16ca4242_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\845fc8ebc7de226db9037dd9e90de9c4_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7e1558601c0b50fe4ae3e0f533ed0866_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6b611d5c3a1df19f80947b81ec503670_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\81811cfde21c1e5bbb0fd873a018a80a_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8cb2dc930042135ef6f6cbeefa6b9dff_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\87ab25eb989f6f6405a024b2e41a195b_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8c49dc95d1fa6d39c6e983b8ef01e13c_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\92633aa2dcd704c4fe376c0c34901b26_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\906b4506e07d8653afd761ee11d34889_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\90ee6934daf0db731e85033e02eb71a2_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\93009359def1b1ada248fa17579c5cc8_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\95b6c0e1464f0cc23054d236fabd86b4_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a1b1476521dcd48b13ecd33bf627d420_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9e79bd935088ff3facf3b7eacfade697_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a5c4a9b7edc5659081454b388dc0a6bf_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ac24286bc4cb75a46e89f97d9c6c2161_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a6d6524cf5fa818b82052b5c452670ae_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ab808cbc8161288fb3c75f572451b6fb_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b455cb7e25b3fe5a5702abc4c4d4db3f_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b7998e24adee06e1d72c90d3caf89b43_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b46e50ebc98a00de39d6decedbc84c9a_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c3ef1872efcc256ef045fd4561f7a7f5_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b4bbe77e9c674c67ca93d67c189c9b54_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d1f1b0a8c53e2422a000f35347ac2e46_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c46faf8916807c65382b2552c9429c49_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d9aac2075d2a021caa609375cf475328_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c605bfb1a3345c58409aa6be2c27d236_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d58896110ae420ef9461494a4b179936_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\dc1f814b93073e577453c0f58d7c216e_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\db9fab0b5855165812861aeab5160d89_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e49780c04951d46d2c020dea85977efa_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e20dfccc3b8abc7001b88b72982f53ed_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e1033a3bf7513f06f118c5efcbccf24c_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f6ebe4083aff08dc993c755e8169b583_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e865ca644f828aba930a038bff963e45_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f73dfebb5ef912b0301a95731eae2ad5_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fdd601cb5b5cb659a38d9d7fa939b9fe_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f8ab6fed42e5d0ee8d55e9e59854d1c9_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fa36c989541f1402465b1c9645999b2a_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fed214d225fa762cc7c2868b8fb8f02c_2373e354-cf37-44ec-a701-979871415445
C:\System Volume Information\Syscache.hve
C:\System Volume Information\Syscache.hve.LOG2
C:\System Volume Information\MountPointManagerRemoteDatabase
C:\System Volume Information\Syscache.hve.LOG1
D:\betriebssysteme\iPhone3G_Normal_WD6\__MACOSX\._READ_ME.txt
D:\Users\me\Downloads\iPhone3G_Normal_WD6\__MACOSX\._READ_ME.txt
Die folgenden Dateien sind Passwortgeschützt:
D:\backup\programme\betriebssysteme\ubcd511.iso
D:\betriebssysteme\ubcd511.iso
D:\Users\me\AppData\Local\Adobe\AIH.a973aa170539461b9d48ac9a54f81d01ee53dbe6\downloader.bundle
D:\Users\me\AppData\Local\Adobe\AIH.a973aa170539461b9d48ac9a54f81d01ee53dbe6\launcher.bundle
D:\Users\me\Downloads\WHDCdU1Aa.part1.rar
D:\Users\me\Downloads\dell\R261284.exe
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:31 on 24/07/2014 (egal)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by me (ATTENTION: The logged in user is not administrator) on ME-PC on 24-07-2014 12:34:36
Running from C:\Users\me\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM\...\RunOnce: [BrandClearStubs] => RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{F0DC35EF-6A04-4B5A-AC80-7653D02E21E9}
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-18] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-12-18] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:tabs
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:tabs
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=
SearchScopes: HKLM-x32 - DefaultScope {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKLM-x32 - {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKCU - DefaultScope {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKCU - {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3297265&CUI=UN28251651208448154&UM=2
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default
FF SearchEngineOrder.1: Web Search
FF Homepage: hxxp://www.zeit.de/index
FF Keyword.URL: hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\me\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF user.js: detected! => C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\babylon1.xml
FF SearchPlugin: C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FireJump - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\firejump@firejump.net [2013-09-16]
FF Extension: ProxTube - Unblock YouTube - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\ich@maltegoetz.de [2013-12-13]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2013-09-16]
FF Extension: WOT - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-30]
FF Extension: Download Statusbar - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} [2013-09-16]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\adblockpopups@jessehakanen.net.xpi [2013-09-16]
FF Extension: WebConnect - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\firefox@webconnect.co.xpi [2013-09-16]
FF Extension: Personas Plus - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\personas@christopher.beard.xpi [2013-09-16]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2013-09-16]
FF Extension: NoScript - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-09-16]
FF Extension: FireFTP - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi [2013-09-16]
FF Extension: Adblock Plus - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-09-16]
FF Extension: Download Statusbar - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2013-09-16]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R2 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3203392 2014-05-20] (G Data Software AG)
R2 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2000-01-01] (Realtek Semiconductor)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-19] (DT Soft Ltd)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-09] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-09] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-09] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-09] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-09] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-23] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-09] (G Data Software AG)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99800 2013-05-09] (Intel Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-18] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-07-08] ()
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-07-24 12:34 - 2014-07-24 12:35 - 00017375 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-24 12:34 - 2014-07-24 12:34 - 00000000 ____D () C:\FRST
2014-07-24 12:30 - 2014-07-24 12:31 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:21 - 2014-07-24 11:22 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:55 - 2014-07-24 09:57 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-09 13:16 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-09 13:16 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-09 13:16 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 13:16 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 13:16 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 13:16 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 13:16 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 13:16 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 13:16 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 13:16 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 13:16 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 13:16 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 13:16 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 13:16 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 13:16 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 13:16 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 13:16 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 13:16 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 13:16 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 13:16 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 13:16 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 13:16 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-09 13:16 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 13:16 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-09 13:16 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 13:16 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 13:16 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-09 13:16 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 13:14 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 13:14 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-09 13:14 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
2014-06-25 01:15 - 2014-06-25 01:15 - 00000328 _____ () C:\Windows\PFRO.log
2014-06-25 01:12 - 2014-06-25 01:14 - 00000000 ____D () C:\Program Files\Canon
2014-06-25 01:12 - 2012-10-04 00:00 - 00660992 _____ (CANON INC.) C:\Windows\system32\CNAC8EMD.DLL
2014-06-25 01:12 - 2012-09-03 00:00 - 00486400 _____ (CANON INC.) C:\Windows\system32\CNAP2LMD.DLL
2014-06-25 01:12 - 2011-03-08 00:00 - 01289728 _____ (CANON INC.) C:\Windows\system32\CNAP1NSD.DLL
2014-06-25 01:10 - 2014-06-25 01:10 - 00000000 ____D () C:\Users\me\Downloads\LBP5050_5050N_R150_V110_W64_uk_EN_1
2014-06-25 01:07 - 2014-06-25 01:08 - 15011392 _____ () C:\Users\me\Downloads\LBP5050_5050N_R150_V110_W64_uk_EN_1.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-07-24 12:35 - 2014-07-24 12:34 - 00017375 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-24 12:34 - 2014-07-24 12:34 - 00000000 ____D () C:\FRST
2014-07-24 12:31 - 2014-07-24 12:30 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:30 - 2013-09-21 20:25 - 00000000 ____D () C:\Users\egal
2014-07-24 12:18 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-24 12:18 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-24 12:14 - 2013-09-16 17:20 - 01548661 _____ () C:\Windows\WindowsUpdate.log
2014-07-24 12:11 - 2014-01-23 14:02 - 00003408 _____ () C:\Windows\setupact.log
2014-07-24 12:11 - 2013-09-16 22:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-24 12:11 - 2013-09-16 20:56 - 00000404 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2014-07-24 12:11 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 12:05 - 2013-09-17 15:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-24 11:55 - 2014-06-18 06:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-24 11:55 - 2013-09-19 20:48 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:22 - 2014-07-24 11:21 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:57 - 2014-07-24 09:55 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-24 09:39 - 2013-09-17 16:28 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-14 03:00 - 2013-09-19 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 03:24 - 2009-07-14 06:45 - 00343896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 03:22 - 2014-05-07 06:51 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 03:22 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 03:05 - 2013-09-16 22:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 03:03 - 2013-09-16 22:09 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-09 00:30 - 2014-05-23 09:24 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-07-09 00:30 - 2014-05-23 09:24 - 00001978 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-09 00:29 - 2014-05-23 09:23 - 00004114 _____ () C:\Windows\DPINST.LOG
2014-07-09 00:29 - 2013-09-16 20:23 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-09 00:29 - 2013-09-16 20:23 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-08 15:52 - 2014-05-26 16:08 - 00000276 _____ () C:\Users\me\Desktop\Neues Textdokument.txt
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 15:11 - 2013-10-12 00:17 - 00000000 ____D () C:\Users\egal\AppData\Roaming\DAEMON Tools Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:39 - 2013-10-09 14:06 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 14:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-08 10:43 - 2014-01-23 14:02 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-06 09:04 - 2013-09-16 22:48 - 00068776 _____ () C:\Users\me\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
2014-07-01 05:00 - 2013-09-17 08:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-06-30 04:09 - 2014-07-09 13:16 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-09 13:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-25 01:15 - 2014-06-25 01:15 - 00000328 _____ () C:\Windows\PFRO.log
2014-06-25 01:14 - 2014-06-25 01:12 - 00000000 ____D () C:\Program Files\Canon
2014-06-25 01:10 - 2014-06-25 01:10 - 00000000 ____D () C:\Users\me\Downloads\LBP5050_5050N_R150_V110_W64_uk_EN_1
2014-06-25 01:08 - 2014-06-25 01:07 - 15011392 _____ () C:\Users\me\Downloads\LBP5050_5050N_R150_V110_W64_uk_EN_1.exe
Some content of TEMP:
====================
C:\Users\me\AppData\Local\Temp\RSPUpgradeInstaller.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
--- --- --- Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2014
Ran by me at 2014-07-24 12:35:46
Running from C:\Users\me\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: G Data InternetSecurity (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G Data InternetSecurity (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.11.22 - STMicroelectronics)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.05 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Astroburn Lite (HKLM-x32\...\Astroburn Lite) (Version: 1.8.0.0182 - Disc Soft Ltd)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon LBP5050 (HKLM\...\Canon LBP5050) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.04072 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04072 - Cisco Systems, Inc.) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0333 - Disc Soft Ltd)
Definition Update for Microsoft Office 2013 (KB2760587) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{65480649-2AA6-4C5C-AAE8-DB35335D98A7}) (Version: - Microsoft)
Dell Digital Delivery (HKLM-x32\...\{D850CB7E-72BC-4510-BA4F-48932BFAB295}) (Version: 2.9.901.0 - Dell Products, LP)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.87 - DivX, LLC)
G Data InternetSecurity (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.1.4 - G Data Software AG)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.3.1520 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
Intel® Watchdog Timer Driver (Intel® WDT) (HKLM-x32\...\{3FD0C489-0F02-481a-A3E1-9754CD396761}) (Version: - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
iTunes (HKLM\...\{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}) (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.400 - Oracle)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Kalkules 1.9.3.22 (HKLM-x32\...\{6541EA45-0665-4485-ABAA-417BC83AC92F}_is1) (Version: - Jardo)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 64-bit Components 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Korrekturhilfen 2013 - Deutsch (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office OSM MUI (German) 2013 (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2013 (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - English (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - Italiano (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2013 (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visio MUI (German) 2013 (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Visio Professional 2013 (HKLM-x32\...\Office15.VISPROR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visio Professional 2013 (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version: - Pavel Cvrcek)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MultiBit 0.5.15 (HKLM-x32\...\MultiBit 0.5.15) (Version: 0.5.15 - )
No23 Recorder (HKLM-x32\...\{22B0E143-2B0B-435B-9F56-136A3D16065F}) (Version: 2.1.0.3 - No23)
NVIDIA 3D Vision Treiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.65 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.7 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.7 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.140.952 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3165 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.65 (Version: 331.65 - NVIDIA Corporation) Hidden
NVIDIA Update 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.9 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.9 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PC Remote (HKLM-x32\...\{A9364C10-E23A-4598-8B56-790461B983C0}) (Version: 3.48 - PC Remote)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6788 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
Secure Download Manager (HKLM-x32\...\{7709C9B0-AD83-4F7C-A153-B956BC3C3B0A}) (Version: 3.1.10 - Kivuto Solutions Inc.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{8D2E04ED-3350-4ECE-9D6E-3BC9A9A93A47}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (x32 Version: - Microsoft) Hidden
SHIELD Streaming (Version: 1.6.34 - NVIDIA Corporation) Hidden
SlimDrivers (HKLM-x32\...\{3CF3DEF4-ED15-4F7B-9320-C3E1081EA4DA}) (Version: 2.2.30877 - SlimWare Utilities, Inc.)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.6.1032 - SUPERAntiSpyware.com)
TeXnicCenter Version 2.0 Stable (HKLM-x32\...\TeXnicCenter_is1) (Version: 2.0 Stable - The TeXnicCenter Team)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
Update for Microsoft Excel 2013 (KB2881085) 32-Bit Edition (HKLM-x32\...\{90150000-006E-0407-0000-0000000FF1CE}_Office15.VISPROR_{122B0E69-64AF-41BE-B3F6-D387A7E7E687}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2760344) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{A7610F07-E844-4444-8E1D-D5BC8AD0B4C5}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2768012) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{66421820-D3CA-450A-898C-78D7E40108E6}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2826040) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{B7EA8070-C37F-4617-82F4-52CF3304595A}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2863843) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.VISPROR_{AD7045B8-1D75-4B4C-8120-12F045D206C7}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2863843) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{AD7045B8-1D75-4B4C-8120-12F045D206C7}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880457) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{D27F6360-AE1E-4C8C-8ECD-C0375E20B923}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880462) 32-Bit Edition (HKLM-x32\...\{90150000-006E-0407-0000-0000000FF1CE}_Office15.VISPROR_{5D6439FF-D651-4B13-B52E-2508AB9DE19D}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880462) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{5D6439FF-D651-4B13-B52E-2508AB9DE19D}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880464) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{06EF2BF7-7351-4D70-A0D5-588FCCF9808D}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880478) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{7C5CEE0F-6823-4BB7-A28F-76FEC14EB6AC}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880987) 32-Bit Edition (HKLM-x32\...\{90150000-006E-0407-0000-0000000FF1CE}_Office15.VISPROR_{07017577-FBD6-45E2-A796-659E8F428057}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880987) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{07017577-FBD6-45E2-A796-659E8F428057}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2881074) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{B23AED0C-4813-4B49-9870-2F0968824E87}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2881084) 32-Bit Edition (HKLM-x32\...\{90150000-001F-0407-0000-0000000FF1CE}_Office15.VISPROR_{E249DF0B-9318-47AC-A6C2-A860FF1BEC3C}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2881084) 32-Bit Edition (HKLM-x32\...\{90150000-001F-0409-0000-0000000FF1CE}_Office15.VISPROR_{56962EB1-4DD3-48BB-934B-EA4C4516D89A}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2881084) 32-Bit Edition (HKLM-x32\...\{90150000-001F-040C-0000-0000000FF1CE}_Office15.VISPROR_{63AED158-0508-4738-A811-840B2053EF3B}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2881084) 32-Bit Edition (HKLM-x32\...\{90150000-001F-0410-0000-0000000FF1CE}_Office15.VISPROR_{AE4413A8-4182-4883-B0BB-AC34CDFB56BC}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2881086) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.VISPROR_{02DB183E-6F67-4906-A391-325874C5DA87}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2881086) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{02DB183E-6F67-4906-A391-325874C5DA87}) (Version: - Microsoft)
Update for Microsoft OneDrive for Business (KB2881087) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.VISPROR_{FC6618D2-F75D-4FDD-B396-E4B0C0D757B6}) (Version: - Microsoft)
Update for Microsoft OneDrive for Business (KB2881087) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0407-1000-0000000FF1CE}_Office15.VISPROR_{FC6618D2-F75D-4FDD-B396-E4B0C0D757B6}) (Version: - Microsoft)
Update for Microsoft OneNote 2013 (KB2881082) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.VISPROR_{CA0F0611-10FB-47D4-A642-E3BABCC73393}) (Version: - Microsoft)
Update for Microsoft Outlook 2013 (KB2880470) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{1BCA67A6-5329-48D0-A088-C097AC7A14BD}) (Version: - Microsoft)
Update for Microsoft Visio 2013 (KB2878322) 32-Bit Edition (HKLM-x32\...\{90150000-0054-0407-0000-0000000FF1CE}_Office15.VISPROR_{99298FA5-31E3-4F40-A6AF-021459F6F37D}) (Version: - Microsoft)
Update for Microsoft Visio 2013 (KB2878322) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{99298FA5-31E3-4F40-A6AF-021459F6F37D}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2817301) 32-Bit Edition (HKLM-x32\...\{90150000-006E-0407-0000-0000000FF1CE}_Office15.VISPROR_{25C61889-2E44-4BE1-9E96-9364BFDCF501}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2817301) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{25C61889-2E44-4BE1-9E96-9364BFDCF501}) (Version: - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
==================== Custom CLSID entries: ==========================
(Only entries are listed that could be exploited by malware. If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
Could not list Restore Points. Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\SlimDrivers Startup.job => ?
==================== Loaded Modules (whitelisted) =============
2013-09-16 23:32 - 2010-12-17 10:25 - 00686704 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
2013-09-16 21:02 - 2000-01-01 02:00 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-08-29 02:23 - 2013-08-29 02:23 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\me\Downloads\Spam-email.eml:OECustomProperty
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Cisco AnyConnect Secure Mobility Agent for Windows => "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
MSCONFIG\startupreg: CNAP2 Launcher => C:\Windows\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
==================== Faulty Device Manager Devices =============
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/24/2014 00:12:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10312
Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10312
Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9110
Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9110
Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8112
Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8112
Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (07/24/2014 00:10:10 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (07/23/2014 10:52:25 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (07/22/2014 04:23:56 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (07/21/2014 05:45:00 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (07/19/2014 04:57:13 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (07/18/2014 09:45:22 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (07/18/2014 10:19:59 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (07/17/2014 00:26:19 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (07/16/2014 05:38:38 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (07/16/2014 08:13:20 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Microsoft Office Sessions:
=========================
Error: (07/24/2014 00:12:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10312
Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10312
Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9110
Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9110
Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8112
Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8112
Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
==================== Memory info ===========================
Percentage of memory in use: 30%
Total physical RAM: 8086.17 MB
Available physical RAM: 5608.69 MB
Total Pagefile: 16170.52 MB
Available Pagefile: 13371.7 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:107.69 GB) (Free:7.3 GB) NTFS
Drive d: () (Fixed) (Total:488.28 GB) (Free:197.54 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
Geändert von Danielll (24.07.2014 um 12:20 Uhr) Grund: Anhang entfernen |
|
24.07.2014, 12:21
| #2 |
| | Windows 7: Virenfund (win32.trojan.* NSIS.Application.*) und noch die gmer.txt
__________________Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-24 12:56:54
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK6461GSY rev.MC001D 596,17GB
Running: kij71fkq.exe; Driver: C:\Users\egal\AppData\Local\Temp\pxldypoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000778fa400 7 bytes JMP 000000016fff0260
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077903f20 5 bytes JMP 000000016fff01b8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007791ffb0 5 bytes JMP 000000016fff01f0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007792f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077959a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077969630 5 bytes JMP 000000016fff0110
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779887e0 7 bytes JMP 000000016fff0228
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefda72db0 5 bytes JMP 000007fffda60180
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefda737d0 7 bytes JMP 000007fffda600d8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda78ef0 6 bytes JMP 000007fffda60148
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefda8af60 5 bytes JMP 000007fffda60110
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff147490 11 bytes JMP 000007fffda60228
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff15bf00 7 bytes JMP 000007fffda60260
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff3389e0 8 bytes JMP 000007fffda601f0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff33be40 8 bytes JMP 000007fffda601b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000778fa400 7 bytes JMP 000000016fff0260
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077903f20 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007791ffb0 5 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007792f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077959a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077969630 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779887e0 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefda72db0 5 bytes JMP 000007fffda60180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefda737d0 7 bytes JMP 000007fffda600d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda78ef0 6 bytes JMP 000007fffda60148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefda8af60 5 bytes JMP 000007fffda60110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff3389e0 8 bytes JMP 000007fffda601f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff33be40 8 bytes JMP 000007fffda601b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff147490 11 bytes JMP 000007fffda60228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff15bf00 7 bytes JMP 000007fffda60260
.text C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefda72db0 5 bytes JMP 000007fffda60180
.text C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefda737d0 7 bytes JMP 000007fffda600d8
.text C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda78ef0 6 bytes JMP 000007fffda60148
.text C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefda8af60 5 bytes JMP 000007fffda60110
.text C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff3389e0 8 bytes JMP 000007fffda601f0
.text C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff33be40 8 bytes JMP 000007fffda601b8
.text C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef7eadc88 5 bytes JMP 000007fff7ca00d8
.text C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef7eade10 5 bytes JMP 000007fff7ca0110
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000778fa400 7 bytes JMP 000000016fff0260
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077903f20 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007791ffb0 5 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007792f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077959a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077969630 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779887e0 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefda72db0 5 bytes JMP 000007fffda60180
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefda737d0 7 bytes JMP 000007fffda600d8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda78ef0 6 bytes JMP 000007fffda60148
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefda8af60 5 bytes JMP 000007fffda60110
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff3389e0 8 bytes JMP 000007fffda601f0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff33be40 8 bytes JMP 000007fffda601b8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\d3d9.dll!Direct3DCreate9Ex 000007fef85e2460 5 bytes JMP 000007fefda602d0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\d3d9.dll!Direct3DCreate9 000007fef86196b0 6 bytes JMP 000007fefda60298
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefda72db0 5 bytes JMP 000007fffda60180
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefda737d0 7 bytes JMP 000007fffda600d8
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda78ef0 6 bytes JMP 000007fffda60148
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefda8af60 5 bytes JMP 000007fffda60110
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff3389e0 8 bytes JMP 000007fffda601f0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff33be40 8 bytes JMP 000007fffda601b8
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075741f0e 7 bytes JMP 00000001708f168b
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075745bad 7 bytes JMP 00000001708f11a4
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075751409 7 bytes JMP 00000001708f1280
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007575ea45 7 bytes JMP 00000001708f123a
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007576b21b 5 bytes JMP 00000001708f15a0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000757e8e24 7 bytes JMP 00000001708f132f
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000757e91ff 1 byte JMP 00000001708f1703
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2 00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075871d29 5 bytes JMP 00000001708f11bd
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075871dd7 5 bytes JMP 00000001708f1014
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075872ab1 5 bytes JMP 00000001708f154b
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075872d17 5 bytes JMP 00000001708f1267
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076348a29 5 bytes JMP 00000001708f171c
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076354572 5 bytes JMP 00000001708f10a0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007636e567 5 bytes JMP 00000001708f140b
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007608e96b 5 bytes JMP 00000001708f15b9
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007608eba5 5 bytes JMP 00000001708f1181
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076219d0b 5 bytes JMP 00000001708f1217
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000778fa400 7 bytes JMP 000000016fff0260
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077903f20 5 bytes JMP 000000016fff01b8
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007791ffb0 5 bytes JMP 000000016fff01f0
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007792f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077959a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077969630 5 bytes JMP 000000016fff0110
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779887e0 7 bytes JMP 000000016fff0228
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefda72db0 5 bytes JMP 000007fffda60180
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefda737d0 7 bytes JMP 000007fffda600d8
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda78ef0 6 bytes JMP 000007fffda60148
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefda8af60 5 bytes JMP 000007fffda60110
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff3389e0 8 bytes JMP 000007fffda601f0
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff33be40 8 bytes JMP 000007fffda601b8
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff147490 11 bytes JMP 000007fffda60228
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff15bf00 7 bytes JMP 000007fffda60260
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000778fa400 7 bytes JMP 000000016fff0260
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077903f20 5 bytes JMP 000000016fff01b8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007791ffb0 5 bytes JMP 000000016fff01f0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007792f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077959a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077969630 5 bytes JMP 000000016fff0110
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779887e0 7 bytes JMP 000000016fff0228
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefda72db0 5 bytes JMP 000007fffda60180
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefda737d0 7 bytes JMP 000007fffda600d8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda78ef0 6 bytes JMP 000007fffda60148
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefda8af60 5 bytes JMP 000007fffda60110
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff147490 11 bytes JMP 000007fffda60228
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff15bf00 7 bytes JMP 000007fffda60260
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff3389e0 8 bytes JMP 000007fffda601f0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff33be40 8 bytes JMP 000007fffda601b8
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075741f0e 7 bytes JMP 00000001708f168b
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075745bad 7 bytes JMP 00000001708f11a4
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075751409 7 bytes JMP 00000001708f1280
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007575ea45 7 bytes JMP 00000001708f123a
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007576b21b 5 bytes JMP 00000001708f15a0
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000757e8e24 7 bytes JMP 00000001708f132f
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000757e91ff 1 byte JMP 00000001708f1703
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2 00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075871d29 5 bytes JMP 00000001708f11bd
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075871dd7 5 bytes JMP 00000001708f1014
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075872ab1 5 bytes JMP 00000001708f154b
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075872d17 5 bytes JMP 00000001708f1267
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076348a29 5 bytes JMP 00000001708f171c
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076354572 5 bytes JMP 00000001708f10a0
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007636e567 5 bytes JMP 00000001708f140b
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007608e96b 5 bytes JMP 00000001708f15b9
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007608eba5 5 bytes JMP 00000001708f1181
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076219d0b 5 bytes JMP 00000001708f1217
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075741f0e 7 bytes JMP 00000001708f168b
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075745bad 7 bytes JMP 00000001708f11a4
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075751409 7 bytes JMP 00000001708f1280
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007575ea45 7 bytes JMP 00000001708f123a
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007576b21b 5 bytes JMP 00000001708f15a0
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000757e8e24 7 bytes JMP 00000001708f132f
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000757e91ff 1 byte JMP 00000001708f1703
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2 00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075871d29 5 bytes JMP 00000001708f11bd
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075871dd7 5 bytes JMP 00000001708f1014
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075872ab1 5 bytes JMP 00000001708f154b
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075872d17 5 bytes JMP 00000001708f1267
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007608e96b 5 bytes JMP 00000001708f15b9
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007608eba5 5 bytes JMP 00000001708f1181
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076348a29 5 bytes JMP 00000001708f171c
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076354572 5 bytes JMP 00000001708f10a0
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007636e567 5 bytes JMP 00000001708f140b
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076219d0b 5 bytes JMP 00000001708f1217
.text C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefda72db0 5 bytes JMP 000007fffda60180
.text C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefda737d0 7 bytes JMP 000007fffda600d8
.text C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda78ef0 6 bytes JMP 000007fffda60148
.text C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefda8af60 5 bytes JMP 000007fffda60110
.text C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff3389e0 8 bytes JMP 000007fffda601f0
.text C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff33be40 8 bytes JMP 000007fffda601b8
.text C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff147490 11 bytes JMP 000007fffda60228
.text C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff15bf00 7 bytes JMP 000007fffda60260
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075741f0e 7 bytes JMP 00000001708f168b
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075745bad 7 bytes JMP 00000001708f11a4
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075751409 7 bytes JMP 00000001708f1280
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007575ea45 7 bytes JMP 00000001708f123a
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007576b21b 5 bytes JMP 00000001708f15a0
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000757e8e24 7 bytes JMP 00000001708f132f
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000757e91ff 1 byte JMP 00000001708f1703
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2 00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075871d29 5 bytes JMP 00000001708f11bd
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075871dd7 5 bytes JMP 00000001708f1014
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075872ab1 5 bytes JMP 00000001708f154b
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075872d17 5 bytes JMP 00000001708f1267
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076348a29 5 bytes JMP 00000001708f171c
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076354572 5 bytes JMP 00000001708f10a0
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007636e567 5 bytes JMP 00000001708f140b
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007608e96b 5 bytes JMP 00000001708f15b9
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007608eba5 5 bytes JMP 00000001708f1181
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076219d0b 5 bytes JMP 00000001708f1217
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000756f1465 2 bytes [6F, 75]
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000756f14bb 2 bytes [6F, 75]
.text ... * 2
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075741f0e 7 bytes JMP 00000001708f168b
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075745bad 7 bytes JMP 00000001708f11a4
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075751409 7 bytes JMP 00000001708f1280
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007575ea45 7 bytes JMP 00000001708f123a
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007576b21b 5 bytes JMP 00000001708f15a0
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000757e8e24 7 bytes JMP 00000001708f132f
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000757e91ff 1 byte JMP 00000001708f1703
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2 00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075871d29 5 bytes JMP 00000001708f11bd
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075871dd7 5 bytes JMP 00000001708f1014
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075872ab1 5 bytes JMP 00000001708f154b
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075872d17 5 bytes JMP 00000001708f1267
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007608e96b 5 bytes JMP 00000001708f15b9
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007608eba5 5 bytes JMP 00000001708f1181
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076348a29 5 bytes JMP 00000001708f171c
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076354572 5 bytes JMP 00000001708f10a0
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007636e567 5 bytes JMP 00000001708f140b
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000763a7a5c 5 bytes JMP 00000001708f15c8
? C:\Windows\system32\mssprxy.dll [4548] entry point in ".rdata" section 00000000729671e6
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075741f0e 7 bytes JMP 00000001708f168b
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075745bad 7 bytes JMP 00000001708f11a4
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075751409 7 bytes JMP 00000001708f1280
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007575ea45 7 bytes JMP 00000001708f123a
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007576b21b 5 bytes JMP 00000001708f15a0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000757e8e24 7 bytes JMP 00000001708f132f
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000757e91ff 1 byte JMP 00000001708f1703
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2 00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075871d29 5 bytes JMP 00000001708f11bd
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075871dd7 5 bytes JMP 00000001708f1014
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075872ab1 5 bytes JMP 00000001708f154b
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075872d17 5 bytes JMP 00000001708f1267
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007608e96b 5 bytes JMP 00000001708f15b9
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007608eba5 5 bytes JMP 00000001708f1181
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076348a29 5 bytes JMP 00000001708f171c
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076354572 5 bytes JMP 00000001708f10a0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007636e567 5 bytes JMP 00000001708f140b
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076219d0b 5 bytes JMP 00000001708f1217
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075741f0e 7 bytes JMP 00000001708f168b
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075745bad 7 bytes JMP 00000001708f11a4
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075751409 7 bytes JMP 00000001708f1280
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007575ea45 7 bytes JMP 00000001708f123a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007576b21b 5 bytes JMP 00000001708f15a0
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000757e8e24 7 bytes JMP 00000001708f132f
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000757e91ff 1 byte JMP 00000001708f1703
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2 00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075871d29 5 bytes JMP 00000001708f11bd
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075871dd7 5 bytes JMP 00000001708f1014
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075872ab1 5 bytes JMP 00000001708f154b
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075872d17 5 bytes JMP 00000001708f1267
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007608e96b 5 bytes JMP 00000001708f15b9
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007608eba5 5 bytes JMP 00000001708f1181
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076348a29 5 bytes JMP 00000001708f171c
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076354572 5 bytes JMP 00000001708f10a0
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007636e567 5 bytes JMP 00000001708f140b
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076219d0b 5 bytes JMP 00000001708f1217
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000778fa400 7 bytes JMP 000000016fff0260
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077903f20 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007791ffb0 5 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007792f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077959a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000779694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077969630 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000779887e0 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefda72db0 5 bytes JMP 000007fffda60180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefda737d0 7 bytes JMP 000007fffda600d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefda78ef0 6 bytes JMP 000007fffda60148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefda8af60 5 bytes JMP 000007fffda60110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff3389e0 8 bytes JMP 000007fffda601f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff33be40 8 bytes JMP 000007fffda601b8
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075741f0e 7 bytes JMP 00000001708f168b
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075745bad 7 bytes JMP 00000001708f11a4
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000075751409 7 bytes JMP 00000001708f1280
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007575ea45 7 bytes JMP 00000001708f123a
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007576b21b 5 bytes JMP 00000001708f15a0
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000757e8e24 7 bytes JMP 00000001708f132f
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000757e91ff 1 byte JMP 00000001708f1703
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2 00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075871d29 5 bytes JMP 00000001708f11bd
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075871dd7 5 bytes JMP 00000001708f1014
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075872ab1 5 bytes JMP 00000001708f154b
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075872d17 5 bytes JMP 00000001708f1267
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007608e96b 5 bytes JMP 00000001708f15b9
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007608eba5 5 bytes JMP 00000001708f1181
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076348a29 5 bytes JMP 00000001708f171c
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076354572 5 bytes JMP 00000001708f10a0
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007636e567 5 bytes JMP 00000001708f140b
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076219d0b 5 bytes JMP 00000001708f1217
---- EOF - GMER 2.1 ----
|
|
28.07.2014, 18:37
| #3 |
| /// the machine /// TB-Ausbilder    | Windows 7: Virenfund (win32.trojan.* NSIS.Application.*) Hi,
__________________FRST bitte nochmal. Unsere Tools brauchen immer Adminrechte.
__________________ |
|
28.07.2014, 19:56
| #4 |
| | Windows 7: Virenfund (win32.trojan.* NSIS.Application.*) Oh sry das hatte ich übersehen. Hier die FRST.txt. Die Addition.txt hänge wegen der Grösse als archiv an. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by egal (administrator) on ME-PC on 28-07-2014 20:46:13
Running from C:\Users\me\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM\...\RunOnce: [BrandClearStubs] => RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{F0DC35EF-6A04-4B5A-AC80-7653D02E21E9}
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1003\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1004\...\MountPoints2: {255b9757-1f6a-11e3-a132-14feb5c55e8f} - F:\setup.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-18] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-12-18] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?ocid=U218DHP&pc=U218
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:tabs
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=
SearchScopes: HKLM-x32 - DefaultScope {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKLM-x32 - {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\egal\AppData\Roaming\Mozilla\Firefox\Profiles\fjkx3l8o.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R2 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3203392 2014-05-20] (G Data Software AG)
R2 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2000-01-01] (Realtek Semiconductor)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-19] (DT Soft Ltd)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-09] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-09] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-09] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-09] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-09] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-23] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-09] (G Data Software AG)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99800 2013-05-09] (Intel Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-18] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-07-08] ()
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-07-28 20:46 - 2014-07-28 20:46 - 00016042 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-24 12:50 - 2014-07-24 12:57 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:34 - 2014-07-28 20:46 - 00000000 ____D () C:\FRST
2014-07-24 12:30 - 2014-07-24 12:31 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:21 - 2014-07-24 11:22 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:55 - 2014-07-24 09:57 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-09 13:16 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-09 13:16 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-09 13:16 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 13:16 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 13:16 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 13:16 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 13:16 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 13:16 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 13:16 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 13:16 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 13:16 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 13:16 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 13:16 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 13:16 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 13:16 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 13:16 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 13:16 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 13:16 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 13:16 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 13:16 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 13:16 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 13:16 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-09 13:16 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 13:16 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-09 13:16 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 13:16 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 13:16 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-09 13:16 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 13:14 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 13:14 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-09 13:14 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-07-28 20:46 - 2014-07-28 20:46 - 00016042 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-28 20:46 - 2014-07-24 12:34 - 00000000 ____D () C:\FRST
2014-07-28 20:15 - 2013-09-16 17:20 - 01655736 _____ () C:\Windows\WindowsUpdate.log
2014-07-28 20:05 - 2013-09-17 15:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-27 22:56 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-27 22:56 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-27 22:49 - 2014-01-23 14:02 - 00003800 _____ () C:\Windows\setupact.log
2014-07-27 22:49 - 2013-09-16 22:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-27 22:49 - 2013-09-16 20:56 - 00000404 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2014-07-27 22:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 19:08 - 2014-05-26 16:08 - 00062946 _____ () C:\Users\me\Desktop\Neues Textdokument.txt
2014-07-25 08:55 - 2014-01-21 23:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 12:57 - 2014-07-24 12:50 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:31 - 2014-07-24 12:30 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:30 - 2013-09-21 20:25 - 00000000 ____D () C:\Users\egal
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:55 - 2014-06-18 06:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-24 11:55 - 2013-09-19 20:48 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:22 - 2014-07-24 11:21 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:57 - 2014-07-24 09:55 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:52 - 2013-10-09 14:08 - 00068776 _____ () C:\Users\egal\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-24 09:39 - 2013-09-17 16:28 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-14 03:00 - 2013-09-19 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 03:24 - 2009-07-14 06:45 - 00343896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 03:22 - 2014-05-07 06:51 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 03:22 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 03:05 - 2013-09-16 22:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 03:03 - 2013-09-16 22:09 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 15:05 - 2013-09-17 15:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-09 00:30 - 2014-05-23 09:24 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-07-09 00:30 - 2014-05-23 09:24 - 00001978 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-09 00:29 - 2014-05-23 09:23 - 00004114 _____ () C:\Windows\DPINST.LOG
2014-07-09 00:29 - 2013-09-16 20:23 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-09 00:29 - 2013-09-16 20:23 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 15:11 - 2013-10-12 00:17 - 00000000 ____D () C:\Users\egal\AppData\Roaming\DAEMON Tools Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:39 - 2013-10-09 14:06 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-07-08 14:39 - 2013-09-16 20:56 - 00002828 _____ () C:\Windows\System32\Tasks\SlimDrivers Startup
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 14:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-08 10:43 - 2014-01-23 14:02 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-06 09:04 - 2013-09-16 22:48 - 00068776 _____ () C:\Users\me\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
2014-07-01 05:00 - 2013-09-17 08:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-06-30 04:09 - 2014-07-09 13:16 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-09 13:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
Some content of TEMP:
====================
C:\Users\egal\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\me\AppData\Local\Temp\RSPUpgradeInstaller.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-28 14:22
==================== End Of Log ============================
--- --- --- |
|
29.07.2014, 10:45
| #5 |
| /// the machine /// TB-Ausbilder | Windows 7: Virenfund (win32.trojan.* NSIS.Application.*) Hi, Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.07.2014, 09:56
| #6 |
| | Windows 7: Virenfund (win32.trojan.* NSIS.Application.*) Die Datei Addition.txt ist zu gross um sie im einem Thread zu posten. Falls es noch eine andere Möglichkeit als über Anhang gibt, klär mich bitte auf. Den Rest führe ich nun durch und poste die logs so hier die logs: mbam.txt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 30.07.2014 Scan Time: 09:54:29 Logfile: mbam.txt Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.07.30.03 Rootkit Database: v2014.07.17.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: egal Scan Type: Threat Scan Result: Completed Objects Scanned: 362274 Time Elapsed: 9 min, 27 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 1 PUP.Optional.Conduit.A, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\FF, Quarantined, [3a711293cab1b086edc3858d6e96758b], Registry Values: 4 PUP.Optional.SearchCertified.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCH|Search Bar, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Quarantined, [2b80485d66151c1a2a6892448181b34d] PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=%s, Quarantined, [515a6e3789f2b77f81eda72e2ed4d52b] PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|(Default), hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=%s, Quarantined, [2d7e8322fa81bd79de91dcf9f80a0cf4] PUP.Optional.SearchCertified.A, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Search Bar, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Quarantined, [cfdcf4b1027974c2cfc1f0e632d0eb15] Registry Data: 8 PUP.Optional.SimplyTech.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\ABOUTURLS|newtab, %appdata%\SimplyTech\home\home.htm, Good: (www.google.com), Bad: (%appdata%\SimplyTech\home\home.htm),Replaced,[8c1f1b8ae29954e205507b33f70d6d93] Hijack.SearchPage, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (hxxp://www.google.com), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[76354362daa170c61ca207b017ed24dc] Hijack.SearchPage, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (hxxp://www.google.com/), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[89224d586a11ed49fec2ebcca85cea16] PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCH|Search Page, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (www.google.com), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[03a88c194f2ccd695d130ba3659fda26] Hijack.SearchPage, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (hxxp://www.google.com), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[4e5d6540691201354676f7c033d1669a] Hijack.SearchPage, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (hxxp://www.google.com/), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[3378bbea3d3e37ffeed3f9be9e66b54b] PUP.Optional.CertifiedToolBar.A, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Search Page, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (www.google.com), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[a803dfc60576b185ed7f0f9fef156b95] PUP.Optional.SearchCertifiedTB.A, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=%s, Good: (www.google.com), Bad: (hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=%s),Replaced,[eac11c892a51989e01d14475b153db25] Folders: 0 (No malicious items detected) Files: 6 PUP.Optional.InstallBrain.A, C:\Users\me\Downloads\cbsidlm-tr1_15-RollerCoaster_Tycoon_2_28_patch-ORG-10236743.exe, Quarantined, [d6d53a6b3348eb4b100432453aca13ed], PUP.Optional.Babylon.A, C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\babylon1.xml, Quarantined, [4b60cdd8b5c6e3536484eff4a35fc040], PUP.Optional.Conduit.A, C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\conduit.xml, Quarantined, [2f7c7e277ffc83b382d90ede7290728e], PUP.Optional.WebConnect.A, C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\extensions\firefox@webconnect.co.xpi, Quarantined, [a506dec7532851e552e35a93a45edc24], PUP.Optional.WebSearch.A, C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\Web Search.xml, Quarantined, [1d8e970eb9c2280eb18a1bd2798933cd], PUP.Optional.CertifiedTB.A, C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\prefs.js, Good: (), Bad: (user_pref("keyword.URL", "hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=");), Replaced,[8922069f45360b2ba4e15d8ce51f56aa] Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.301 - Bericht erstellt am 30/07/2014 um 10:16:53
# Aktualisiert 28/07/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : egal - ME-PC
# Gestartet von : C:\Users\me\Downloads\adwcleaner_3.301.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Conduit
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater
Ordner Gelöscht : C:\Users\egal\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\me\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\me\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\me\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\me\AppData\LocalLow\SimplyTech
Ordner Gelöscht : C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\firejump@firejump.net
Datei Gelöscht : \END
Datei Gelöscht : C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\.autoreg
Datei Gelöscht : C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\user.js
***** [ Tasks ] *****
Task Gelöscht : FreeDriverScout
Task Gelöscht : Software Updater Ui
Task Gelöscht : Software Updater
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17207
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\egal\AppData\Roaming\Mozilla\Firefox\Profiles\fjkx3l8o.default\prefs.js ]
[ Datei : C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\prefs.js ]
Zeile gelöscht : user_pref("browser.search.defaultengine", "Web Search");
Zeile gelöscht : user_pref("browser.search.order.1", "Web Search");
*************************
AdwCleaner[R0].txt - [2843 octets] - [30/07/2014 10:14:27]
AdwCleaner[S0].txt - [2666 octets] - [30/07/2014 10:16:53]
########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [2726 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by egal on 30.07.2014 at 10:25:25,99
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{473F7730-783B-4B9A-9619-3D4A35CFF663}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
~~~ FireFox
Emptied folder: C:\Users\egal\AppData\Roaming\mozilla\firefox\profiles\fjkx3l8o.default\minidumps [2 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.07.2014 at 10:33:44,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by egal (administrator) on ME-PC on 30-07-2014 10:45:06
Running from C:\Users\me\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM\...\RunOnce: [BrandClearStubs] => RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{F0DC35EF-6A04-4B5A-AC80-7653D02E21E9}
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-05-12] (Malwarebytes Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1003\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1004\...\MountPoints2: {255b9757-1f6a-11e3-a132-14feb5c55e8f} - F:\setup.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-18] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-12-18] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?ocid=U218DHP&pc=U218
HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE11DEDE/WOL_WCP
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:tabs
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\egal\AppData\Roaming\Mozilla\Firefox\Profiles\fjkx3l8o.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R2 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3203392 2014-05-20] (G Data Software AG)
R2 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
S4 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2000-01-01] (Realtek Semiconductor)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-19] (DT Soft Ltd)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-09] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-09] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-09] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-09] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-09] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-23] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-09] (G Data Software AG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99800 2013-05-09] (Intel Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-18] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-07-08] ()
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-07-30 10:45 - 2014-07-30 10:45 - 00015692 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-30 10:44 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\me\Downloads\JRT.txt
2014-07-30 10:35 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\egal\Downloads\JRT.txt
2014-07-30 10:33 - 2014-07-30 10:33 - 00000972 _____ () C:\Users\egal\Desktop\JRT.txt
2014-07-30 10:28 - 2014-07-30 10:28 - 00001425 _____ () C:\Users\egal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-07-30 10:25 - 2014-07-30 10:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-30 10:23 - 2014-07-30 10:23 - 01016261 _____ (Thisisu) C:\Users\me\Downloads\JRT.exe
2014-07-30 10:14 - 2014-07-30 10:17 - 00000000 ____D () C:\AdwCleaner
2014-07-30 10:13 - 2014-07-30 10:13 - 01365525 _____ () C:\Users\me\Downloads\adwcleaner_3.301.exe
2014-07-30 10:12 - 2014-07-30 10:12 - 00007694 _____ () C:\Users\me\Downloads\mbam.txt
2014-07-30 09:50 - 2014-07-30 09:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-30 09:49 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-30 09:49 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-30 09:48 - 2014-07-30 09:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\me\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-30 08:55 - 2014-07-30 08:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-28 20:55 - 2014-07-28 20:55 - 00011077 _____ () C:\Users\me\Downloads\Addition.zip
2014-07-24 12:50 - 2014-07-24 12:57 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:34 - 2014-07-30 10:45 - 00000000 ____D () C:\FRST
2014-07-24 12:30 - 2014-07-24 12:31 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:21 - 2014-07-24 11:22 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:55 - 2014-07-24 09:57 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-09 13:16 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-09 13:16 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-09 13:16 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 13:16 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 13:16 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 13:16 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 13:16 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 13:16 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 13:16 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 13:16 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 13:16 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 13:16 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 13:16 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 13:16 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 13:16 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 13:16 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 13:16 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 13:16 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 13:16 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 13:16 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 13:16 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 13:16 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-09 13:16 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 13:16 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-09 13:16 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 13:16 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 13:16 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-09 13:16 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 13:14 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 13:14 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-09 13:14 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-07-30 10:45 - 2014-07-30 10:45 - 00015692 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-30 10:45 - 2014-07-24 12:34 - 00000000 ____D () C:\FRST
2014-07-30 10:44 - 2013-09-16 17:20 - 01717468 _____ () C:\Windows\WindowsUpdate.log
2014-07-30 10:42 - 2013-09-16 20:56 - 00000404 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2014-07-30 10:41 - 2014-01-23 14:02 - 00004304 _____ () C:\Windows\setupact.log
2014-07-30 10:41 - 2013-09-16 22:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-30 10:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-30 10:35 - 2014-07-30 10:44 - 00000972 _____ () C:\Users\me\Downloads\JRT.txt
2014-07-30 10:35 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\egal\Downloads\JRT.txt
2014-07-30 10:33 - 2014-07-30 10:33 - 00000972 _____ () C:\Users\egal\Desktop\JRT.txt
2014-07-30 10:28 - 2014-07-30 10:28 - 00001425 _____ () C:\Users\egal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-07-30 10:26 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-30 10:26 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-30 10:25 - 2014-07-30 10:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-30 10:23 - 2014-07-30 10:23 - 01016261 _____ (Thisisu) C:\Users\me\Downloads\JRT.exe
2014-07-30 10:18 - 2014-06-25 01:15 - 00002406 _____ () C:\Windows\PFRO.log
2014-07-30 10:18 - 2013-09-16 20:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-30 10:17 - 2014-07-30 10:14 - 00000000 ____D () C:\AdwCleaner
2014-07-30 10:13 - 2014-07-30 10:13 - 01365525 _____ () C:\Users\me\Downloads\adwcleaner_3.301.exe
2014-07-30 10:12 - 2014-07-30 10:12 - 00007694 _____ () C:\Users\me\Downloads\mbam.txt
2014-07-30 10:07 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-07-30 10:05 - 2013-09-17 15:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-30 09:52 - 2014-07-30 09:50 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\me\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-30 08:56 - 2014-07-30 08:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-28 20:55 - 2014-07-28 20:55 - 00011077 _____ () C:\Users\me\Downloads\Addition.zip
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 19:08 - 2014-05-26 16:08 - 00062946 _____ () C:\Users\me\Desktop\Neues Textdokument.txt
2014-07-25 08:55 - 2014-01-21 23:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 12:57 - 2014-07-24 12:50 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:31 - 2014-07-24 12:30 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:30 - 2013-09-21 20:25 - 00000000 ____D () C:\Users\egal
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:55 - 2013-09-19 20:48 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:22 - 2014-07-24 11:21 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:57 - 2014-07-24 09:55 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:52 - 2013-10-09 14:08 - 00068776 _____ () C:\Users\egal\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-24 09:39 - 2013-09-17 16:28 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-14 03:00 - 2013-09-19 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 03:24 - 2009-07-14 06:45 - 00343896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 03:22 - 2014-05-07 06:51 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 03:22 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 03:05 - 2013-09-16 22:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 03:03 - 2013-09-16 22:09 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 15:05 - 2013-09-17 15:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-09 00:30 - 2014-05-23 09:24 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-07-09 00:30 - 2014-05-23 09:24 - 00001978 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-09 00:29 - 2014-05-23 09:23 - 00004114 _____ () C:\Windows\DPINST.LOG
2014-07-09 00:29 - 2013-09-16 20:23 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-09 00:29 - 2013-09-16 20:23 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 15:11 - 2013-10-12 00:17 - 00000000 ____D () C:\Users\egal\AppData\Roaming\DAEMON Tools Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:39 - 2013-10-09 14:06 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-07-08 14:39 - 2013-09-16 20:56 - 00002828 _____ () C:\Windows\System32\Tasks\SlimDrivers Startup
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 14:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-08 10:43 - 2014-01-23 14:02 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-06 09:04 - 2013-09-16 22:48 - 00068776 _____ () C:\Users\me\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
2014-07-01 05:00 - 2013-09-17 08:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-06-30 04:09 - 2014-07-09 13:16 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-09 13:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
Some content of TEMP:
====================
C:\Users\egal\AppData\Local\Temp\Quarantine.exe
C:\Users\egal\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\me\AppData\Local\Temp\RSPUpgradeInstaller.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-28 14:22
==================== End Of Log ============================
--- --- --- --- --- --- Die addition.txt ist wieder zu gross. Ich füge sie dewegen dem anhang bei. Falls es noch eine bessere Methode gibt, klär mich bitte auf. danke für deine Hilfe. Gruss Daniel Geändert von Danielll (30.07.2014 um 10:02 Uhr) |
|
30.07.2014, 15:19
| #7 |
| /// the machine /// TB-Ausbilder | Windows 7: Virenfund (win32.trojan.* NSIS.Application.*)ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.07.2014, 23:38
| #8 |
| | Windows 7: Virenfund (win32.trojan.* NSIS.Application.*) Hier die logs. Eset online: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=092b7fb13096a34f81b53315b4e15d27
# engine=19421
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-07-30 10:21:49
# local_time=2014-07-31 12:21:49 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 49826 158388759 0 0
# scanned=221584
# found=13
# cleaned=0
# scan_time=21697
sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\egal\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=FED7CAA2E24771B66065C8D30131FC8037B6BD2A ft=1 fh=b41296876ed186e5 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\egal\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=DEB9F64ABBF9425B70217747FEED6D2CF8BD9B6D ft=1 fh=a8b5d0d60197659c vn="Variante von MSIL/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\me\Downloads\DLG_free-driver-scout_chip_de-DE.exe"
sh=880E2A6F06E1174278C105DDFE86449E5BBA22E1 ft=1 fh=8276b7a7d9f0fc36 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe"
sh=7F559E33377FEC1DD2D3BF5F1618FA2F44F9E30D ft=0 fh=0000000000000000 vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="D:\Firefox 23.0.1 (de) - 2013-09-14.pcv"
sh=DEB9F64ABBF9425B70217747FEED6D2CF8BD9B6D ft=1 fh=a8b5d0d60197659c vn="Variante von MSIL/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="D:\backup\programme\DLG_free-driver-scout_chip_de-DE.exe"
sh=913E612DFDC1621C87B1951BF2DC249162A3E12C ft=0 fh=0000000000000000 vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\9e3bhg1j.default\extensions\firefox@webconnect.co.xpi"
sh=600A0295369F89C300038D770E5E114F2E25A3AF ft=1 fh=df0838ff15738a3a vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\Downloads\cbsidlm-tr1_9-Realtek_Drivers_Update_Utility-ORG2-75206690.exe"
sh=C50892AFB140D0DF96FA97EAF5E9DBE38F4D6763 ft=1 fh=2d5f71b798c9b785 vn="MSIL/Solimba evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\Downloads\jDownloader.exe"
sh=04BFBB304B5F01B2F15C9A78692D502673209625 ft=1 fh=2ada4f9e12d44172 vn="möglicherweise Variante von Win32/YourFileDownloader.A evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\Downloads\Patrick_Rothfuss_-_Die_Königsmörder-Chronik_Teil_1_-_Die_Furcht_des_Weisen_downloader_de_99251.exe"
sh=162E48A200E7BE135C61E792EF253530E034CFED ft=1 fh=36a8d984c1e7f819 vn="Win32/DriverBoss.B evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\Downloads\realtek-drivers-update-utility.exe"
sh=49ACAFACAAC62A745E69D71A58CC9453C41B15D0 ft=1 fh=b98f31ba52914450 vn="Variante von Win32/Toolbar.Conduit.I evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\Downloads\UBCD4WinV360.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.85
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
G Data InternetSecurity
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 40
Java version out of Date!
Adobe Flash Player 14.0.0.145
Adobe Reader XI
Mozilla Firefox (31.0)
````````Process Check: objlist.exe by Laurent````````
G Data InternetSecurity Firewall GDFwSvcx64.exe
G Data InternetSecurity Firewall GDFirewallTray.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by egal (administrator) on ME-PC on 31-07-2014 00:35:43
Running from C:\Users\me\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Microsoft Corp.) C:\Windows\System32\Defrag.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM\...\RunOnce: [BrandClearStubs] => RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{F0DC35EF-6A04-4B5A-AC80-7653D02E21E9}
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-05-12] (Malwarebytes Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1003\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1004\...\MountPoints2: {255b9757-1f6a-11e3-a132-14feb5c55e8f} - F:\setup.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-18] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-12-18] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?ocid=U218DHP&pc=U218
HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE11DEDE/WOL_WCP
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:tabs
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\egal\AppData\Roaming\Mozilla\Firefox\Profiles\fjkx3l8o.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R2 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3203392 2014-05-20] (G Data Software AG)
R2 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
S4 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2000-01-01] (Realtek Semiconductor)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-19] (DT Soft Ltd)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-09] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-09] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-09] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-09] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-09] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-23] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-09] (G Data Software AG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99800 2013-05-09] (Intel Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-18] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-07-08] ()
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-07-31 00:35 - 2014-07-31 00:36 - 00016070 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-31 00:31 - 2014-07-31 00:31 - 00000836 _____ () C:\Users\egal\Downloads\checkup.txt
2014-07-31 00:25 - 2014-07-31 00:26 - 00854390 _____ () C:\Users\me\Downloads\SecurityCheck.exe
2014-07-30 18:10 - 2014-07-30 18:10 - 02347384 _____ (ESET) C:\Users\me\Downloads\esetsmartinstaller_deu.exe
2014-07-30 10:44 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\me\Downloads\JRT.txt
2014-07-30 10:35 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\egal\Downloads\JRT.txt
2014-07-30 10:33 - 2014-07-30 10:33 - 00000972 _____ () C:\Users\egal\Desktop\JRT.txt
2014-07-30 10:28 - 2014-07-30 10:28 - 00001425 _____ () C:\Users\egal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-07-30 10:25 - 2014-07-30 10:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-30 10:23 - 2014-07-30 10:23 - 01016261 _____ (Thisisu) C:\Users\me\Downloads\JRT.exe
2014-07-30 10:14 - 2014-07-30 10:17 - 00000000 ____D () C:\AdwCleaner
2014-07-30 10:13 - 2014-07-30 10:13 - 01365525 _____ () C:\Users\me\Downloads\adwcleaner_3.301.exe
2014-07-30 10:12 - 2014-07-30 10:12 - 00007694 _____ () C:\Users\me\Downloads\mbam.txt
2014-07-30 09:50 - 2014-07-30 09:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-30 09:49 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-30 09:49 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-30 09:48 - 2014-07-30 09:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\me\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-30 08:55 - 2014-07-30 08:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-28 20:55 - 2014-07-30 11:00 - 00010076 _____ () C:\Users\me\Downloads\Addition.zip
2014-07-24 12:50 - 2014-07-24 12:57 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:34 - 2014-07-31 00:35 - 00000000 ____D () C:\FRST
2014-07-24 12:30 - 2014-07-24 12:31 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:21 - 2014-07-24 11:22 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:55 - 2014-07-24 09:57 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-09 13:16 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-09 13:16 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-09 13:16 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 13:16 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 13:16 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 13:16 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 13:16 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 13:16 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 13:16 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 13:16 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 13:16 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 13:16 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 13:16 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 13:16 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 13:16 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 13:16 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 13:16 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 13:16 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 13:16 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 13:16 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 13:16 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 13:16 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-09 13:16 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 13:16 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-09 13:16 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 13:16 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 13:16 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-09 13:16 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 13:14 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 13:14 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-09 13:14 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-07-31 00:36 - 2014-07-31 00:35 - 00016070 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-31 00:35 - 2014-07-24 12:34 - 00000000 ____D () C:\FRST
2014-07-31 00:31 - 2014-07-31 00:31 - 00000836 _____ () C:\Users\egal\Downloads\checkup.txt
2014-07-31 00:26 - 2014-07-31 00:25 - 00854390 _____ () C:\Users\me\Downloads\SecurityCheck.exe
2014-07-31 00:05 - 2013-09-17 15:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-30 23:05 - 2013-09-16 17:20 - 01719020 _____ () C:\Windows\WindowsUpdate.log
2014-07-30 18:10 - 2014-07-30 18:10 - 02347384 _____ (ESET) C:\Users\me\Downloads\esetsmartinstaller_deu.exe
2014-07-30 11:00 - 2014-07-28 20:55 - 00010076 _____ () C:\Users\me\Downloads\Addition.zip
2014-07-30 10:49 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-30 10:49 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-30 10:42 - 2013-09-16 20:56 - 00000404 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2014-07-30 10:41 - 2014-01-23 14:02 - 00004304 _____ () C:\Windows\setupact.log
2014-07-30 10:41 - 2013-09-16 22:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-30 10:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-30 10:35 - 2014-07-30 10:44 - 00000972 _____ () C:\Users\me\Downloads\JRT.txt
2014-07-30 10:35 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\egal\Downloads\JRT.txt
2014-07-30 10:33 - 2014-07-30 10:33 - 00000972 _____ () C:\Users\egal\Desktop\JRT.txt
2014-07-30 10:28 - 2014-07-30 10:28 - 00001425 _____ () C:\Users\egal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-07-30 10:25 - 2014-07-30 10:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-30 10:23 - 2014-07-30 10:23 - 01016261 _____ (Thisisu) C:\Users\me\Downloads\JRT.exe
2014-07-30 10:18 - 2014-06-25 01:15 - 00002406 _____ () C:\Windows\PFRO.log
2014-07-30 10:18 - 2013-09-16 20:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-30 10:17 - 2014-07-30 10:14 - 00000000 ____D () C:\AdwCleaner
2014-07-30 10:13 - 2014-07-30 10:13 - 01365525 _____ () C:\Users\me\Downloads\adwcleaner_3.301.exe
2014-07-30 10:12 - 2014-07-30 10:12 - 00007694 _____ () C:\Users\me\Downloads\mbam.txt
2014-07-30 10:07 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-07-30 09:52 - 2014-07-30 09:50 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\me\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-30 08:56 - 2014-07-30 08:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 19:08 - 2014-05-26 16:08 - 00062946 _____ () C:\Users\me\Desktop\Neues Textdokument.txt
2014-07-25 08:55 - 2014-01-21 23:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 12:57 - 2014-07-24 12:50 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:31 - 2014-07-24 12:30 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:30 - 2013-09-21 20:25 - 00000000 ____D () C:\Users\egal
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:55 - 2013-09-19 20:48 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:22 - 2014-07-24 11:21 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:57 - 2014-07-24 09:55 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:52 - 2013-10-09 14:08 - 00068776 _____ () C:\Users\egal\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-24 09:39 - 2013-09-17 16:28 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-14 03:00 - 2013-09-19 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 03:24 - 2009-07-14 06:45 - 00343896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 03:22 - 2014-05-07 06:51 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 03:22 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 03:05 - 2013-09-16 22:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 03:03 - 2013-09-16 22:09 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 15:05 - 2013-09-17 15:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-09 00:30 - 2014-05-23 09:24 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-07-09 00:30 - 2014-05-23 09:24 - 00001978 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-09 00:29 - 2014-05-23 09:23 - 00004114 _____ () C:\Windows\DPINST.LOG
2014-07-09 00:29 - 2013-09-16 20:23 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-09 00:29 - 2013-09-16 20:23 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 15:11 - 2013-10-12 00:17 - 00000000 ____D () C:\Users\egal\AppData\Roaming\DAEMON Tools Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:39 - 2013-10-09 14:06 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-07-08 14:39 - 2013-09-16 20:56 - 00002828 _____ () C:\Windows\System32\Tasks\SlimDrivers Startup
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 14:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-08 10:43 - 2014-01-23 14:02 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-06 09:04 - 2013-09-16 22:48 - 00068776 _____ () C:\Users\me\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
2014-07-01 05:00 - 2013-09-17 08:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
Some content of TEMP:
====================
C:\Users\egal\AppData\Local\Temp\Quarantine.exe
C:\Users\egal\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\me\AppData\Local\Temp\RSPUpgradeInstaller.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-28 14:22
==================== End Of Log ============================
--- --- --- --- --- --- und die additon ist wieder im Anhang. Gruss Daniel |
|
31.07.2014, 20:02
| #9 |
| /// the machine /// TB-Ausbilder | Windows 7: Virenfund (win32.trojan.* NSIS.Application.*) Java updaten. Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
