| |
| |||||||
Log-Analyse und Auswertung: E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
05.08.2014, 19:50
| #1 |
| |  E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. Servus. Jetzt hat es auch mal meinen PC erwischt, leider. Es wurde ein E-Mail Anhang einer angeblich von Paypal stammenden E-Mail direkt aus Thunderbird in 7zip geöffnet (.zip archiv). Das Fenster wurde danach sofort wieder geschlossen und kein Inhalt des Archivs geöffnet oder angeklickt (es befand sich die selbe zip Datei nochmals in dem Archiv) Der Scan mittels VirusTotal brachte direkt 9 Ergebnisse, heute schon 19 Scanner die meinen das wäre eine böse Datei  (Screenshot in VT.jpg)Ich habe den PC schon über Nacht mittels Avira und Bitdefender gescannt (auf der ct desinfect 2014 CD ), sowie mit Malwarebytes, aber die haben nichts gefunden. Im Betrieb habe ich bis jetzt keine Besonderheiten festgestellt. Alles ist gleich schnell wie vorher, keine Verbindung dir plötzlich nach draußen will, aber ich dachte mir, gehst du mal lieber auf Nummer sicher und fragst jemanden, der sich damit besser auskennt. Ich bedanke mich schon einmal im Vorraus für die Hilfe.  Geändert von Thunder2001 (05.08.2014 um 20:15 Uhr) |
|
05.08.2014, 20:13
| #2 |
| /// the machine /// TB-Ausbilder    | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
05.08.2014, 20:19
| #3 |
| | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. Tut mir Leid, blöde Angewohnheit
__________________defogger log: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:17 on 05/08/2014 (Thunderhawk)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed
Checking for services/drivers...
SPTD -> Disabled (Service running -> reboot required)
-=E.O.F=-
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014 Ran by Thunderhawk (administrator) on THUNDER-PC on 05-08-2014 20:22:17 Running from C:\Users\Thunderhawk\Desktop Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe (REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe () C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe (ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe (Hi-Rez Studios) E:\Spiele\Hi-Rez Studios\HiPatchService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe (Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe (ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe (Secomba GmbH) C:\Program Files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe (Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe (Spotify Ltd) C:\Users\Thunderhawk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Dropbox, Inc.) C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe (Creative Technology Ltd) C:\Windows\SysWOW64\Ctxfihlp.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Samsung Electronics.) C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe (Creative Technology Ltd) C:\Windows\SysWOW64\CTxfispi.exe () C:\Users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe (Beepa P/L) C:\Program Files (x86)\Fraps\fraps.exe (Beepa P/L) C:\Program Files (x86)\Fraps\fraps64.dat (Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10464536 2014-07-02] (Logitech Inc.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET) HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe [241789 2010-02-18] (Creative Technology Ltd) HKLM-x32\...\Run: [CTxfiHlp] => CTXFIHLP.EXE HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl) HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Plantronics MyHeadset Updater] => C:\Program Files (x86)\Plantronics\MyHeadsetUpdater\MyHeadsetUpdater.exe [79872 2014-04-29] (Plantronics) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.) HKLM-x32\...\Run: [PLTSpokes.exe] => C:\Program Files (x86)\Plantronics\Spokes3G\PLTSpokes.exe -min HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [BoxcryptorClassic.exe] => C:\Program Files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe [2249472 2014-07-11] (Secomba GmbH) HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [KeePass Password Safe 2] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl) HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [Spotify Web Helper] => C:\Users\Thunderhawk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-29] (Spotify Ltd) HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [RocketDock] => "C:\Program Files (x86)\RocketDock\RocketDock.exe" HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [SteelSeries Engine] => C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe [252928 2014-04-15] (SteelSeries ApS) IFEO\utilman.exe: [Debugger] c:\windows\system32\cmd.exe Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation) Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (No File) Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\starteFraps.bat () SSODL: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation) SSODL-x32: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation) ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation) ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x020D68C2C09FCF01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc) BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\..\Interfaces\{A97AC00F-2870-476B-9163-CCCDC2AA2E83}: [NameServer]192.168.179.1 FireFox: ======== FF ProfilePath: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default FF Homepage: http://www.trojaner-board.de/69886-a...-beachten.html FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*'))%20%7B%20return%20'PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us09.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D" FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "type", 2 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\idealode.xml FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\youtube.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: CLEO - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\CLEO@guid.customsoftwareconsult.com [2014-07-01] FF Extension: HTTPS-Everywhere - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\https-everywhere@eff.org [2014-06-28] FF Extension: Pocket - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\isreaditlater@ideashower.com [2014-07-04] FF Extension: KeeFox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\keefox@chris.tomlinson [2014-06-11] FF Extension: NetVideoHunter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\netvideohunter@netvideohunter.com [2014-07-30] FF Extension: FEBE - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2014-06-11] FF Extension: Converter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{8B72860F-C5F8-4286-865E-D2C2DB98A9E6} [2014-03-26] FF Extension: DownloadHelper - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-26] FF Extension: ImageHost Grabber - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} [2014-03-26] FF Extension: about:addons-memory - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\about-addons-memory@tn123.org.xpi [2014-03-26] FF Extension: Adblock Plus Pop-up Addon - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-03-26] FF Extension: Brief - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\brief@mozdev.org.xpi [2014-03-26] FF Extension: FurAffinity Extender - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\faextender@neocodenetworks.com.xpi [2014-03-26] FF Extension: Firebug - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firebug@software.joehewitt.com.xpi [2014-03-26] FF Extension: Grooveshark Remote - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefox@gsremote.com.xpi [2014-03-26] FF Extension: Bookmarks Checker - check for bad links - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefoxbookmarkchecker@everhelper.me.xpi [2014-03-26] FF Extension: Furaffinity Download extension for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\fuerholz@gmx.net.xpi [2014-03-26] FF Extension: BetterTTV - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid0-OeCFXKAPh2tC0bN3Li9ajRAZx6c@jetpack.xpi [2014-05-25] FF Extension: Magic Actions for YouTube™ - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi [2014-03-26] FF Extension: ProxMate - Proxy on steroids! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-03-26] FF Extension: Dict.cc Translation - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\searchdictcc@roughael.xpi [2014-03-26] FF Extension: ShareMeNot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\sharemenot@franziroesner.com.xpi [2014-03-26] FF Extension: Smart Referer - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\smart-referer@meh.paranoid.pk.xpi [2014-03-26] FF Extension: Lyrics Here by Rob W - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\youtube-lyrics-by-rob-w@jetpack.xpi [2014-03-26] FF Extension: Locator - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{05f6a7ea-896b-11da-8bde-f66bad1e3fff}.xpi [2014-03-26] FF Extension: FlashGot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-03-26] FF Extension: Cookie Monster - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{45d8ff86-d909-11db-9705-005056c00008}.xpi [2014-03-26] FF Extension: eBay Sidebar for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}.xpi [2014-03-26] FF Extension: NoScript - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-03-26] FF Extension: Tab Mix Plus - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-03-26] FF Extension: DownThemAll! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-03-26] FF Extension: Greasemonkey - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-03-26] FF Extension: Adblock Edge - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-03-26] FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-05] FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-06-26] (Perfect World Entertainment Inc) R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin) S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [345984 2014-07-14] () R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin) R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT) S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-01-25] (Creative Labs) [File not signed] S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-01-25] (Creative Labs) [File not signed] R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [294912 2010-09-30] (Creative Technology Ltd) [File not signed] S3 DAUpdaterSvc; E:\Spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2011-05-04] (BioWare) R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2135232 2014-05-21] () R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET) U2 HiPatchService; E:\Spiele\Hi-Rez Studios\HiPatchService.exe [9216 2014-07-18] (Hi-Rez Studios) [File not signed] S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] () R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation) R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin) S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2014-06-05] (The OpenVPN Project) S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP1a\RpcAgentSrv.exe [72344 2008-02-17] (SiSoftware) [File not signed] R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation) S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT) S3 CSRBC; C:\Windows\System32\Drivers\csrbcx64.sys [38400 2014-04-04] (CSR plc.) R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-28] (Disc Soft Ltd) R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET) U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET) R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET) R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET) R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET) R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-05] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation) R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin) R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia) S3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39080 2014-04-09] (Razer Inc) R3 SAlphamHid; C:\Windows\System32\DRIVERS\SAlpham64.sys [38016 2013-05-31] (SteelSeries Corporation) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-05-27] (Duplex Secure Ltd.) S3 SteelSeriesDriver; C:\Windows\System32\DRIVERS\ssengine.sys [24064 2013-11-14] () [File not signed] S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.) U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () R3 vpnpbus; C:\Windows\System32\DRIVERS\vpnpbus.sys [18624 2013-11-15] (EldoS Corporation) S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X] S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-05 20:21 - 2014-08-05 20:22 - 00030465 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt 2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable 2014-08-05 19:57 - 2014-08-05 20:22 - 00000000 ____D () C:\FRST 2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe 2014-08-05 19:57 - 2014-08-02 11:06 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe 2014-08-05 19:03 - 2014-08-05 20:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-05 19:02 - 2014-08-05 19:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-05 19:02 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-08-05 19:02 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE 2014-08-05 18:54 - 2014-08-05 19:02 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE 2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET 2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET 2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET 2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk 2014-08-03 21:20 - 2014-08-04 18:24 - 00006970 _____ () C:\Windows\PFRO.log 2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball 2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball 2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI 2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock 2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock 2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock 2014-08-03 18:39 - 2014-08-03 18:39 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PackageAware 2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom 2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps 2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician 2014-08-02 17:18 - 2014-08-02 17:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA 2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2014-08-02 17:18 - 2014-07-25 16:01 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll 2014-08-02 17:18 - 2014-07-25 16:01 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll 2014-08-02 17:18 - 2014-07-25 16:01 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2014-08-02 17:18 - 2014-07-25 16:01 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2014-08-02 17:16 - 2014-07-02 22:48 - 00075040 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll 2014-08-02 17:16 - 2014-07-02 22:48 - 00061912 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll 2014-08-02 17:16 - 2014-07-02 20:55 - 06783776 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll 2014-08-02 17:16 - 2014-07-02 20:55 - 03522392 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll 2014-08-02 17:16 - 2014-07-02 20:55 - 02559960 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2014-08-02 17:16 - 2014-07-02 20:55 - 00935368 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe 2014-08-02 17:16 - 2014-07-02 20:55 - 00386520 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll 2014-08-02 17:16 - 2014-07-02 20:55 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2014-08-02 17:16 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2014-08-02 17:16 - 2014-07-02 12:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin 2014-08-02 17:15 - 2014-07-02 23:29 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll 2014-08-02 17:15 - 2014-07-02 23:29 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2014-08-02 17:15 - 2014-07-02 23:29 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2014-08-02 17:15 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 03196816 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00965312 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00502232 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00418760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2014-08-02 17:15 - 2014-07-02 22:48 - 00026353 _____ () C:\Windows\system32\nvinfo.pb 2014-08-02 17:15 - 2014-03-31 18:42 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2014-08-02 17:15 - 2014-03-31 18:42 - 00037320 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2014-08-02 17:15 - 2014-03-31 18:42 - 00034760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2014-08-02 15:43 - 2014-08-02 16:22 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub 2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk 2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly 2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly 2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking 2014-08-02 14:04 - 2014-08-05 20:18 - 00002359 _____ () C:\Windows\setupact.log 2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log 2014-07-30 20:32 - 2014-07-30 21:04 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge 2014-07-27 19:32 - 2014-07-27 19:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk 2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph 2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios 2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-21 21:50 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-21 21:50 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-21 21:50 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-21 21:50 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-19 18:10 - 2014-07-21 22:20 - 00000000 ____D () C:\Program Files (x86)\SpeedFan 2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo 2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan 2014-07-19 17:00 - 2014-07-19 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3 2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios 2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView 2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft 2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic 2014-07-15 17:32 - 2014-07-27 01:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2 2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP 2014-07-14 19:43 - 2014-07-14 19:44 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse 2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios 2014-07-14 16:23 - 2014-07-14 16:27 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA 2014-07-14 16:18 - 2014-07-14 16:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive 2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander 2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios 2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe 2014-07-14 15:26 - 2014-08-03 13:24 - 00000000 ____D () C:\Users\Thunderhawk\.junique 2014-07-13 00:23 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-07-13 00:23 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-07-13 00:23 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-07-13 00:23 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-07-13 00:23 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-07-13 00:23 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-07-13 00:23 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-07-13 00:23 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-07-13 00:23 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-07-13 00:23 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-07-13 00:23 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-07-13 00:23 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-07-13 00:23 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-07-13 00:23 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-07-13 00:23 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-07-13 00:23 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-07-13 00:23 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-07-13 00:23 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-07-13 00:23 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-07-13 00:23 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-07-13 00:23 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-07-13 00:23 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-07-13 00:23 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-07-13 00:23 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-07-13 00:23 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-07-13 00:23 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-07-13 00:23 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-07-13 00:23 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-07-13 00:23 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-07-13 00:23 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-07-13 00:23 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-07-13 00:23 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-07-13 00:23 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-07-13 00:23 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-07-13 00:23 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-07-13 00:23 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-07-13 00:23 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-07-13 00:23 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-07-13 00:23 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-07-13 00:23 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-07-13 00:23 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-07-13 00:23 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-07-13 00:23 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-07-13 00:23 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-07-13 00:23 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-07-13 00:23 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-07-13 00:23 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-07-13 00:23 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-07-13 00:23 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-07-13 00:23 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-07-13 00:23 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-07-13 00:23 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-07-13 00:23 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-07-13 00:23 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-07-13 00:23 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-07-13 00:23 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-07-13 00:23 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe 2014-07-13 00:23 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe 2014-07-13 00:23 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-07-13 00:23 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-07-13 00:23 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-07-13 00:23 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-07-13 00:23 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-07-13 00:23 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-07-13 00:23 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-07-13 00:23 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-07-13 00:23 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-07-13 00:23 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-07-13 00:23 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-07-13 00:23 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-07-13 00:23 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-07-13 00:23 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2014-07-13 00:23 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-07-13 00:23 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-07-13 00:23 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-07-13 00:23 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2014-07-13 00:22 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-07-13 00:22 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-07-13 00:22 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-07-08 18:06 - 2014-07-08 18:06 - 00001098 _____ () C:\Users\Thunderhawk\Desktop\World of Warcraft - Rising Gods.lnk ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-05 20:22 - 2014-08-05 20:21 - 00030465 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt 2014-08-05 20:22 - 2014-08-05 19:57 - 00000000 ____D () C:\FRST 2014-08-05 20:22 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\NetSpeedMonitor 2014-08-05 20:21 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-05 20:21 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-05 20:19 - 2014-08-05 19:03 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-05 20:19 - 2014-05-12 01:28 - 00000000 ___RD () C:\Users\Thunderhawk\Dropbox 2014-08-05 20:19 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Dropbox 2014-08-05 20:18 - 2014-08-02 14:04 - 00002359 _____ () C:\Windows\setupact.log 2014-08-05 20:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable 2014-08-05 20:17 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\KeePass 2014-08-05 20:17 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\Thunderhawk 2014-08-05 20:17 - 2014-01-25 21:06 - 01354467 _____ () C:\Windows\WindowsUpdate.log 2014-08-05 20:08 - 2014-01-25 23:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-05 20:01 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\vlc 2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe 2014-08-05 19:40 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-08-05 19:40 - 2014-03-23 14:04 - 00000000 ____D () C:\Program Files\WinRAR 2014-08-05 19:36 - 2011-04-12 09:43 - 00709786 _____ () C:\Windows\system32\perfh007.dat 2014-08-05 19:36 - 2011-04-12 09:43 - 00154116 _____ () C:\Windows\system32\perfc007.dat 2014-08-05 19:35 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\VMware 2014-08-05 19:34 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\VMware 2014-08-05 19:08 - 2014-03-08 23:24 - 00000000 ____D () C:\TEMP 2014-08-05 19:07 - 2014-04-19 19:25 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Networking Course 2014-08-05 19:03 - 2014-08-05 19:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-05 19:03 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Malwarebytes 2014-08-05 19:02 - 2014-08-05 18:54 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE 2014-08-05 19:02 - 2009-07-14 07:13 - 01657044 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-05 18:58 - 2014-01-31 14:43 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0 2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE 2014-08-05 01:24 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\TS3Client 2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET 2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET 2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET 2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk 2014-08-04 18:24 - 2014-08-03 21:20 - 00006970 _____ () C:\Windows\PFRO.log 2014-08-04 00:57 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\JDownloader v2.0 2014-08-03 21:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources 2014-08-03 20:52 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Free Download Manager 2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball 2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball 2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI 2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock 2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock 2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock 2014-08-03 18:39 - 2014-08-03 18:39 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PackageAware 2014-08-03 17:30 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Deployment 2014-08-03 17:00 - 2014-03-26 14:45 - 00002240 ____H () C:\Users\Thunderhawk\Documents\Default.rdp 2014-08-03 16:48 - 2014-02-23 18:19 - 00000000 ____D () C:\Program Files (x86)\Origin 2014-08-03 14:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom 2014-08-03 13:24 - 2014-07-14 15:26 - 00000000 ____D () C:\Users\Thunderhawk\.junique 2014-08-03 13:24 - 2014-04-06 15:27 - 00000000 ____D () C:\Users\Thunderhawk\.minion 2014-08-03 13:10 - 2014-01-31 13:06 - 00000000 ____D () C:\Program Files\Logitech Gaming Software 2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps 2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician 2014-08-02 18:12 - 2014-03-26 16:14 - 00000000 ____D () C:\Program Files (x86)\Samsung Magician 2014-08-02 18:01 - 2014-03-09 16:05 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab 2014-08-02 17:22 - 2014-08-02 17:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA 2014-08-02 17:22 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA Corporation 2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2014-08-02 17:18 - 2014-01-25 22:39 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-08-02 17:18 - 2014-01-25 22:38 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-08-02 16:22 - 2014-08-02 15:43 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub 2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk 2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly 2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly 2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking 2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log 2014-08-02 11:06 - 2014-08-05 19:57 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe 2014-08-01 19:09 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\DAEMON Tools Lite 2014-07-31 15:24 - 2014-02-04 21:13 - 00000000 ____D () C:\Program Files\CCleaner 2014-07-30 21:04 - 2014-07-30 20:32 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge 2014-07-30 19:26 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Thunderbird 2014-07-30 19:18 - 2014-01-25 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-07-27 19:41 - 2014-07-27 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2014-07-27 01:28 - 2014-07-15 17:32 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2 2014-07-26 21:26 - 2014-03-26 14:46 - 00581038 _____ () C:\Users\Thunderhawk\Documents\Thunder.kdbx 2014-07-26 21:25 - 2014-03-26 14:46 - 00000000 ____D () C:\Users\Thunderhawk\Documents\my games 2014-07-26 20:20 - 2014-04-13 14:24 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Roaming\winscp.rnd 2014-07-26 19:40 - 2014-03-26 14:41 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Local\PUTTY.RND 2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk 2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph 2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios 2014-07-26 01:10 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-07-25 16:01 - 2014-08-02 17:18 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll 2014-07-25 16:01 - 2014-08-02 17:18 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll 2014-07-25 16:01 - 2014-08-02 17:18 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2014-07-25 16:01 - 2014-08-02 17:18 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-07-21 22:20 - 2014-07-19 18:10 - 00000000 ____D () C:\Program Files (x86)\SpeedFan 2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-21 21:50 - 2014-01-25 23:39 - 00000000 ____D () C:\Program Files (x86)\Java 2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo 2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan 2014-07-19 17:11 - 2014-07-19 17:00 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3 2014-07-19 17:01 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Arma 3 2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios 2014-07-19 12:30 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\.minecraft 2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView 2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft 2014-07-17 13:02 - 2014-04-13 14:21 - 00000986 _____ () C:\Users\Public\Desktop\WinSCP.lnk 2014-07-17 13:02 - 2014-04-13 14:21 - 00000000 ____D () C:\Program Files (x86)\WinSCP 2014-07-17 13:01 - 2014-01-25 21:59 - 01677000 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic 2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP 2014-07-15 16:10 - 2014-01-31 13:10 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client 2014-07-14 19:44 - 2014-07-14 19:43 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse 2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios 2014-07-14 16:27 - 2014-07-14 16:23 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA 2014-07-14 16:23 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArmA 2 2014-07-14 16:22 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive 2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander 2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios 2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe 2014-07-14 15:34 - 2014-05-27 20:22 - 00000058 _____ () C:\Users\Thunderhawk\Desktop\Neues Textdokument.txt 2014-07-13 21:02 - 2009-07-14 06:45 - 00394536 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism 2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism 2014-07-13 00:33 - 2014-01-25 22:54 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-13 00:30 - 2014-01-25 22:54 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-07-11 03:02 - 2014-07-21 21:50 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-11 02:56 - 2014-07-21 21:50 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-11 02:56 - 2014-07-21 21:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-11 02:55 - 2014-07-21 21:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-09 15:39 - 2014-03-23 18:45 - 00000000 ____D () C:\Program Files (x86)\RocketDock 2014-07-09 15:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-07-09 15:26 - 2014-01-25 23:42 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-09 15:26 - 2014-01-25 23:42 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-09 15:26 - 2014-01-25 23:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-07-08 20:08 - 2014-05-14 13:08 - 05659136 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2014-07-08 18:06 - 2014-07-08 18:06 - 00001098 _____ () C:\Users\Thunderhawk\Desktop\World of Warcraft - Rising Gods.lnk 2014-07-08 17:53 - 2014-01-25 23:57 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2 Some content of TEMP: ==================== C:\Users\Thunderhawk\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpopswjk.dll C:\Users\Thunderhawk\AppData\Local\Temp\InstHelper.exe C:\Users\Thunderhawk\AppData\Local\Temp\nv3DVStreaming.dll C:\Users\Thunderhawk\AppData\Local\Temp\nvSCPAPI.dll C:\Users\Thunderhawk\AppData\Local\Temp\nvSCPAPI64.dll C:\Users\Thunderhawk\AppData\Local\Temp\nvStereoApiI.dll C:\Users\Thunderhawk\AppData\Local\Temp\nvStInst.exe C:\Users\Thunderhawk\AppData\Local\Temp\proxy_vole5180237192143850281.dll C:\Users\Thunderhawk\AppData\Local\Temp\r9umkqjc.dll C:\Users\Thunderhawk\AppData\Local\Temp\Samsung_Magician_Setup_v44.exe C:\Users\Thunderhawk\AppData\Local\Temp\tap-windows.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-31 15:01 ==================== End Of Log ============================ --- --- --- |
|
05.08.2014, 20:23
| #4 |
| | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. Additions.log: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-08-2014
Ran by Thunderhawk at 2014-08-05 20:22:42
Running from C:\Users\Thunderhawk\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: ESET Smart Security 7.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: ESET Smart Security 7.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personal Firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.32 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0932-000001000000}) (Version: 9.32.00.0 - Igor Pavlov)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\{BCFB58FF-181E-472F-A9DB-827B75C1EDF7}) (Version: 12.0.4.144 - Adobe Systems, Inc)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.)
Allgemeine Runtime Files (x86) (HKLM\...\{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1) (Version: 1.0.3.6 - Sereby Corporation)
Antichamber (HKLM-x32\...\Steam App 219890) (Version: - Alexander Bruce)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arc (HKLM-x32\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.9668 - Perfect World Entertainment)
Archeage Beta (HKLM-x32\...\Glyph Archeage Beta) (Version: - Trion Worlds, Inc.)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 4.5.2.0 - Auslogics Labs Pty Ltd)
AutoIt v3.3.10.2 (HKLM-x32\...\AutoItv3) (Version: 3.3.10.2 - AutoIt Team)
Banking 4W (HKLM-x32\...\TopBanking) (Version: - Subsembly GmbH)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version: - )
BattlEye Uninstall (HKLM-x32\...\BattlEye for A2) (Version: - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bound By Flame (HKLM-x32\...\Bound By Flame_is1) (Version: - )
Boxcryptor Classic 1.7 (HKLM-x32\...\{89380595-CE5F-4C32-A8BE-E5D1079FC701}) (Version: 1.7.407.129 - Secomba GmbH)
Canon MP Navigator EX 5.1 (HKLM-x32\...\MP Navigator EX 5.1) (Version: - )
Canon MX710 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX710_series) (Version: - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Cheat Engine 6.3 (HKLM-x32\...\Cheat Engine 6.3_is1) (Version: - Cheat Engine)
CM Installer (HKLM-x32\...\{681544C2-FFA2-4CFD-A9AD-2A3D25DF8D22}) (Version: 1.0.0.0 - Cyanogen Inc.)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 33.1.0.0 - COMODO)
CONSORTIUM Update v1.1 (HKLM-x32\...\Q09OU09SVElVTQ==_is1) (Version: 1 - )
Creative ALchemy (HKLM-x32\...\ALchemy) (Version: 1.43 - Creative Technology Limited)
Creative Audio-Systemsteuerung (HKLM-x32\...\AudioCS) (Version: 3.00 - Creative Technology Limited)
Creative AutoMode Switcher (HKLM-x32\...\Creative AutoMode Switcher) (Version: 1.00 - Creative Technology Limited)
Creative Konsole Starter (HKLM-x32\...\Console Launcher) (Version: 2.61 - Creative Technology Limited)
Creative Software AutoUpdate (HKLM-x32\...\Creative Software AutoUpdate) (Version: 1.40 - Creative Technology Limited)
Creative Sound Blaster Properties x64 Edition (HKLM-x32\...\Creative Sound Blaster Properties x64 Edition) (Version: - )
Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.810 - Curse)
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.10.7 - REINER SCT)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
DayZ Commander (HKLM-x32\...\{B3653588-3AC0-4A1D-950F-D96531E84374}) (Version: 0.92.91 - Dotjosh Studios)
DC Universe Online (HKLM-x32\...\Steam App 24200) (Version: - Sony Online Entertainment)
Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version: - Stunlock Studios)
Dogecoin (HKCU\...\Dogecoin) (Version: 1.6.0.0 - Dogecoin)
Dragons Prophet (HKCU\...\SOE-Dragons Prophet) (Version: - Sony Online Entertainment)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)
Dust: An Elysian Tail (HKLM-x32\...\Steam App 236090) (Version: - Humble Hearts LLC)
ESET Smart Security (HKLM\...\{23234C01-F6B0-40FE-A583-B66840B28445}) (Version: 7.0.317.4 - ESET, spol s r. o.)
Far Cry 3 (HKLM-x32\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.05 - Ubisoft)
Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - )
Free Download Manager 3.9.4 (HKLM-x32\...\Free Download Manager_is1) (Version: - FreeDownloadManager.ORG)
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FRITZ!Fernzugang (HKLM\...\{DD57CC22-8864-4CCA-94D4-600D024C1207}) (Version: 1.3.1 - AVM Berlin)
Gameforge Live 1.10.0 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.10.0 - Gameforge)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.)
HD Tune Pro 5.50 (HKLM-x32\...\HD Tune Pro_is1) (Version: - EFD Software)
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
InfiniteCrisis_EA652746A1A8 (HKLM-x32\...\InfiniteCrisis_EA652746A1A8) (Version: - Turbine, Inc)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
Intel® SSD Toolbox (HKLM-x32\...\{06D085C8-1F00-11B2-96A7-8f0CE39193ED}) (Version: 3.2.1.400 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.650 - Oracle)
Java Auto Updater (x32 Version: 2.1.65.20 - Oracle, Inc.) Hidden
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
KeePass Password Safe 2.27 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.27 - Dominik Reichl)
Kingdoms of Amalur: Reckoning™ (HKLM-x32\...\Steam App 102500) (Version: - Big Huge Games)
Lautstärkefenster (HKLM-x32\...\Creative Volume Panel) (Version: 2.21 - Creative Technology Limited)
LibreOffice 4.2 Help Pack (German) (HKLM-x32\...\{DA6AF414-24FA-4815-A4FB-5EFD6173E6F5}) (Version: 4.2.4.2 - The Document Foundation)
LibreOffice 4.2.5.2 (HKLM-x32\...\{8D8F47B2-0E03-4C50-9803-A01120878F96}) (Version: 4.2.5.2 - The Document Foundation)
Livestreamer 1.7.3 (HKLM-x32\...\Livestreamer) (Version: - )
Loadout (HKLM-x32\...\Steam App 208090) (Version: - Edge of Reality)
Logitech Gaming Software (Version: 8.45.88 - Logitech Inc.) Hidden
Logitech Gaming Software 8.53 (HKLM\...\Logitech Gaming Software) (Version: 8.53.186 - Logitech Inc.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.0.0.1036 - Marvell)
Marvell Miniport Driver (HKLM-x32\...\Marvell Miniport Driver) (Version: 11.45.4.3 - Marvell)
Mass Effect™ 3 (HKLM-x32\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.05.0.0 - Electronic Arts)
Metro Last Light (HKLM-x32\...\Metro Last Light_is1) (Version: 2.0.0.0 - )
Metro Last Light Update 12 (v1.0.0.14) Plus limited First Edition DLCs Plus Chronicles Pack DLC v1.0.0.14 (HKLM-x32\...\Metro Last Light Update 12 (v1.0.0.14) Plus limited First Edition DLCs Plus Chronicles Pack DLC v1.0.0.14) (Version: - )
Microsoft .NET Compact Framework 3.5 (HKLM-x32\...\{291B3A3B-F808-45B8-8113-DF232FCB6C82}) (Version: 3.5.7283 - Microsoft Corporation)
Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM-x32\...\M2698023) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM-x32\...\M2833941) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM-x32\...\M979906) (Version: - )
Microsoft .NET Framework 1.1 SP1 (HKLM\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: - )
Microsoft .NET Framework 1.1 SP1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61186 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (HKLM\...\{BBBE35B2-9349-3C48-BD3D-F574B17C7924}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60830 (HKLM-x32\...\{9dba0447-b749-41ea-90bc-2aa19a9eb580}) (Version: 11.0.60830.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60830 (x32 Version: 11.0.60830 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60830 (x32 Version: 11.0.60830 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{90ffcee5-8608-4e94-8c18-a4feb4f83fb8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version: - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (Version: 2.0.50728 - Microsoft Corporation) Hidden
Microsoft Windows Performance Toolkit (HKLM\...\{E7F9E526-2324-437B-A609-E8C5309465CB}) (Version: 4.8.0 - Microsoft Corporation)
Microsoft Windows SDK for Windows 7 (7.1) (HKLM\...\SDKSetup_7.1.7600.0.30514) (Version: 7.1.7600.0.30514 - Microsoft Corporation)
Microsoft Windows SDK for Windows 7 (7.1) (Version: 7.1.30514 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Might and Magic X Legacy (HKLM-x32\...\TWlnaHRhbmRNYWdpY1hMZWdhY3k=_is1) (Version: 1 - )
Minion (HKCU\...\{Minion}}_is1) (Version: 2.0 - ZAM Network LLC)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mozilla Thunderbird 31.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.0 (x86 de)) (Version: 31.0 - Mozilla)
MusicBee 2.3 (HKLM-x32\...\MusicBee) (Version: 2.3 - Steven Mayall)
My Game Long Name (HKLM\...\UDK-7648aaf4-ab93-444c-a725-b455cf914f7a) (Version: - Epic Games, Inc.)
My Game Long Name (HKLM\...\UDK-8d232e0e-ead5-4c80-b1a9-3dd4c68adb25) (Version: - Epic Games, Inc.)
NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.19.0 - NEC Electronics Corporation)
NetSpeedMonitor 2.5.4.0 x64 (HKLM\...\{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}) (Version: 2.5.4.0 - Florian Gilles)
NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version: - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.7 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden
NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
OpenVPN 2.3.4-I002 (HKLM-x32\...\OpenVPN) (Version: 2.3.4-I002 - )
Origin (HKLM-x32\...\Origin) (Version: 9.4.5.195 - Electronic Arts, Inc.)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.9.3 - pdfforge)
Peggle (HKLM-x32\...\{715AD72D-887A-459E-988B-D4F3E87FA24B}) (Version: 1.04.0.0 - PopCap Games)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
Plantronics CSR Driver (64-bit) (Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics CsrDfu Installer (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics HidDfu Installer (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater (HKLM-x32\...\{c76f0fe9-9e26-48ed-a55f-d12fea04cea8}) (Version: 3.1.48496.0 - Plantronics, Inc.)
Plantronics MyHeadset Updater (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater Device Handlers (32-bit) (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater DFU Handlers (32-bit) (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater Install Check (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater MLS (Version: 3.0.0.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater Runtime (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater Startup (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Rename Master (HKLM-x32\...\Rename Master_is1) (Version: - )
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.4.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.4.0 - Renesas Electronics Corporation) Hidden
roomeon 3D-Planer (HKLM-x32\...\{F33472D8-D8DD-402E-B0CF-110AA3477D4E}) (Version: 1.6.0 - roomeon GmbH)
Sacred 2 Gold (HKLM-x32\...\Steam App 225640) (Version: - Ascaron)
Samsung Data Migration (HKLM-x32\...\{D4DE3DB4-7734-47E5-8D92-B80146311406}) (Version: 2.6 - Samsung)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.4.0 - Samsung Electronics)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Secure Download Manager (HKLM-x32\...\{C58626D6-7EBD-460D-8B6C-75B3C3464879}) (Version: 3.1.60 - Kivuto Solutions Inc.)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
SimCity™ (HKLM-x32\...\{F70FDE4B-8F86-4eb6-8C8E-636EC89F6419}) (Version: 4.0.86.0859 - Electronic Arts)
SiSoftware Sandra Lite 2014.SP1a (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 20.21.2014.3 - SiSoftware)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2215.10 - Hi-Rez Studios)
Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version: - Rebellion)
Spacebase DF-9 Alpha 4b (HKLM-x32\...\Spacebase DF-9 Alpha 4b) (Version: 4.00 - Unterbilker)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
StarMoney (x32 Version: 4.0.3.24 - StarFinanz) Hidden
StarMoney 9.0 (HKLM-x32\...\{DA3DF6D6-5123-4DD6-98B9-865D79178CEB}) (Version: 9.0 - Star Finanz GmbH)
SteelSeries Engine (HKLM\...\SteelSeries Engine) (Version: 2.8.445.23476 - SteelSeries)
Supraball (HKLM-x32\...\Supraball) (Version: - Supra Games Gbr)
Sweet Home 3D version 4.3 (HKLM\...\Sweet Home 3D_is1) (Version: - eTeks)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab for Intel (HKLM-x32\...\{04C4B49D-45D9-4A28-9ED1-B45CBD99B8C7}) (Version: 4.5.24.0 - Husdawg, LLC)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
TeraCopy 2.3 (HKLM\...\TeraCopy_is1) (Version: - Code Sector)
The Bureau: XCOM Declassified (HKLM-x32\...\Steam App 65930) (Version: - 2K Marin)
The Walking Dead 400 Days (HKLM-x32\...\VGhlV2Fsa2luZ0RlYWQ=_is1) (Version: 1 - )
The Walking Dead: Season 2 (HKLM-x32\...\VGhlV2Fsa2luZ0RlYWRTZWFzb24y_is1) (Version: 1 - )
Thief (HKLM-x32\...\VGhpZWY=_is1) (Version: 1 - )
THX-Einrichtungskonsole (HKLM-x32\...\THX_Console_Unicode) (Version: - )
Tom Clancy's Splinter Cell® Blacklist™ (HKLM-x32\...\{A6356F2F-D3E1-4D83-9AA2-72871DD0C298}) (Version: 1.03 - Ubisoft)
TreeSize Free V2.7 (HKLM-x32\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)
Tribes Ascend (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}) (Version: 1.0.1268.1 - Hi-Rez Studios)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Uplay (HKLM-x32\...\Uplay) (Version: 4.3 - Ubisoft)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
WATCH_DOGS (HKLM-x32\...\Uplay Install 274) (Version: - Ubisoft)
WATCH_DOGS Hotfix (HKLM-x32\...\V0FUQ0hfRE9HUw==_is1) (Version: 1 - )
WildStar (HKLM-x32\...\WildStar) (Version: - NCSOFT)
Windows-Treiberpaket - Cambridge Silicon Radio (CSRBC) USB (10/26/2012 2.4.0.0) (HKLM\...\20C7EDA3129B3FF8F72F9BF59252B718B554FBDC) (Version: 10/26/2012 2.4.0.0 - Cambridge Silicon Radio)
WinRAR 5.10 beta 1 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.1 - win.rar GmbH)
WinSCP 5.5.4 (HKLM-x32\...\winscp3_is1) (Version: 5.5.4 - Martin Prikryl)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{47ad9950-5528-4257-bf21-5752c2fd38e9}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
02-08-2014 15:19:19 DirectX wurde installiert
02-08-2014 22:44:51 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
02-08-2014 23:01:03 Windows Modules Installer
03-08-2014 19:06:51 Gerätetreiber-Paketinstallation: Anchorfree Inc Netzwerkdienst
03-08-2014 19:07:56 Gerätetreiber-Paketinstallation: Anchorfree HSS VPN Adapter Netzwerkadapter
03-08-2014 19:14:28 Gerätetreiber-Paketinstallation: Anchorfree HSS VPN Adapter Netzwerkadapter
04-08-2014 23:01:44 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2014-08-02 18:44 - 00450709 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {08EED200-6BF1-4207-A7EE-BB2011D6A243} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {112A3638-A79E-4040-9232-F31FCDABF462} - System32\Tasks\Rocket => C:\Program Files (x86)\RocketDock\RocketDock.exe
Task: {22B3AE81-682B-42FA-97CB-9682305DB413} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {3283DF08-BD6A-44DD-BC86-AE5C4C2D7917} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {46B13C52-4B84-47D4-AC05-A9D626B95926} - System32\Tasks\Steam => E:\Spiele\Steam\Steam.exe [2014-07-30] (Valve Corporation)
Task: {513BBE4E-630C-482F-8DA1-83416500822C} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe [2014-05-19] (Samsung Electronics.)
Task: {57D59838-F36B-4E43-92EA-5D0082970E9E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {85EAEF9B-0586-4B3D-A036-4391530AE975} - System32\Tasks\Teamspeak => C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe [2014-07-15] (TeamSpeak Systems GmbH)
Task: {8AB95BE7-F922-4426-852C-E0055AF6E233} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {9190AB9B-52EC-418B-AB02-0402C0A76EBF} - System32\Tasks\lol => S:\League of Legends\lol.launcher.admin.exe [2011-04-26] ()
Task: {A1D60D55-A6B8-401B-BC05-2938E02DF2F2} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => d:\program files\windows defender\MpCmdRun.exe
Task: {BC62C5EB-773E-471F-9704-BBC16B2DE8E6} - System32\Tasks\Fraps => C:\Program Files (x86)\Fraps\fraps.exe [2013-02-26] (Beepa P/L)
Task: {CBAB4D57-4E11-4A8C-9804-B74FB10E98F5} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {D8BE420E-E4B5-48D9-BF48-3C8F91357C56} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {F8DC1622-48AE-4BC2-B6AC-2B4A9383DF58} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2014-08-02 17:16 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-05-21 12:22 - 2014-05-21 12:22 - 02135232 _____ () C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-07-15 06:44 - 2010-07-15 06:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2014-03-08 01:52 - 2012-01-20 15:55 - 00678400 _____ () C:\Program Files\TeraCopy\TeraCopyExt64.dll
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2014-07-02 23:54 - 2014-07-02 23:54 - 00866584 _____ () C:\Program Files\Logitech Gaming Software\libGLESv2.dll
2014-07-02 23:59 - 2014-07-02 23:59 - 01050904 _____ () C:\Program Files\Logitech Gaming Software\platforms\qwindows.dll
2014-07-02 23:54 - 2014-07-02 23:54 - 00059160 _____ () C:\Program Files\Logitech Gaming Software\libEGL.dll
2014-07-02 23:59 - 2014-07-02 23:59 - 00242456 _____ () C:\Program Files\Logitech Gaming Software\imageformats\qjpeg.dll
2014-07-08 18:13 - 2014-07-08 18:13 - 00046080 _____ () C:\Users\Thunderhawk\AppData\Local\KeePass\PluginCache\J1dTSUyDMfoJCshbCV5J\Fleck2.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00801792 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\SSEngineLib.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00175104 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\DBUtils.dll
2014-05-03 19:19 - 2014-05-03 19:19 - 00089915 ____N () C:\Users\Thunderhawk\AppData\Local\Temp\087a7fb9-4ed6-48f7-81cb-0dfb6f1f0a8b\CliSecureRT64.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00289792 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\DriverCommunication.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00140288 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\ISSPlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00148480 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\Localization.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00145408 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\Utilities.dll
2013-01-10 07:46 - 2013-01-10 07:46 - 00047616 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesDrivers\x2api.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 09674752 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\SSEngineWinGui.dll
2013-01-10 07:46 - 2013-01-10 07:46 - 01102336 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\System.Data.SQLite.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00209408 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\CustomWPFColorPicker.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00349696 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\MousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00171008 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\D3MousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00173056 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\KKMousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00171008 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\SRawPlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00307200 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\MLGSenseiPlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00154624 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\WoWGoldPlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00170496 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\GW2MousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00169472 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\CSGOMousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00169984 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\DOTA2MousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00157184 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\WoWWirelessPlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00170496 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\CODMousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00169984 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\WoTMousePlugin.dll
2014-03-26 14:45 - 2011-06-21 11:14 - 00207872 _____ () C:\users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-02-02 14:13 - 2007-05-31 09:38 - 00167936 ____N () C:\Windows\SysWOW64\SerialXP.dll
2014-06-15 13:18 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-06-15 13:18 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-06-15 13:18 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-06-15 13:18 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-06-15 13:18 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-08-05 18:56 - 2011-01-13 11:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2014-08-05 20:19 - 2014-08-05 20:19 - 00043008 _____ () c:\Users\Thunderhawk\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpopswjk.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\libcef.dll
2014-01-25 23:32 - 2009-03-26 15:46 - 00148480 _____ () C:\Windows\SysWOW64\APOMngr.DLL
2014-01-25 23:32 - 2009-02-06 19:52 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL
2014-01-25 20:46 - 2011-08-22 18:57 - 00002560 _____ () C:\Windows\SysWOW64\CTXFIRES.DLL
2014-03-26 16:14 - 2014-05-06 11:24 - 00013824 _____ () C:\Program Files (x86)\Samsung Magician\SAMSUNG_SSD.dll
2014-03-26 16:14 - 2014-05-19 20:20 - 00103424 _____ () C:\Program Files (x86)\Samsung Magician\PAL.dll
2014-03-26 16:14 - 2014-05-19 20:20 - 00039424 _____ () C:\Program Files (x86)\Samsung Magician\SATA.dll
2014-03-26 16:14 - 2014-05-19 20:19 - 00038400 _____ () C:\Program Files (x86)\Samsung Magician\SAT.dll
2014-03-26 16:14 - 2014-05-19 20:20 - 00031232 _____ () C:\Program Files (x86)\Samsung Magician\SMINI.dll
2014-03-26 16:14 - 2014-05-19 20:19 - 00029696 _____ () C:\Program Files (x86)\Samsung Magician\SAS.dll
2014-07-23 12:44 - 2014-07-23 12:44 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/05/2014 08:18:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/05/2014 06:56:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/05/2014 06:53:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/05/2014 01:32:22 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/05/2014 00:53:06 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/04/2014 11:17:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: EoCApp.exe, Version: 1.0.81.0, Zeitstempel: 0x53c7a40f
Name des fehlerhaften Moduls: EoCApp.exe, Version: 1.0.81.0, Zeitstempel: 0x53c7a40f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000975ae
ID des fehlerhaften Prozesses: 0x18ac
Startzeit der fehlerhaften Anwendung: 0xEoCApp.exe0
Pfad der fehlerhaften Anwendung: EoCApp.exe1
Pfad des fehlerhaften Moduls: EoCApp.exe2
Berichtskennung: EoCApp.exe3
Error: (08/04/2014 08:20:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: EoCApp.exe, Version: 1.0.81.0, Zeitstempel: 0x53c7a40f
Name des fehlerhaften Moduls: EoCApp.exe, Version: 1.0.81.0, Zeitstempel: 0x53c7a40f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000975ae
ID des fehlerhaften Prozesses: 0x1234
Startzeit der fehlerhaften Anwendung: 0xEoCApp.exe0
Pfad der fehlerhaften Anwendung: EoCApp.exe1
Pfad des fehlerhaften Moduls: EoCApp.exe2
Berichtskennung: EoCApp.exe3
Error: (08/04/2014 06:27:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/04/2014 06:25:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/03/2014 09:23:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (08/05/2014 07:41:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "StarMoney 9.0 OnlineUpdate" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (08/05/2014 06:54:44 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "NPEService" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (08/05/2014 00:55:40 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.179.2
registriert werden. Der Computer mit IP-Adresse 192.168.179.1 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (08/05/2014 00:54:00 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "ESET Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (08/03/2014 09:32:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Error: (08/03/2014 09:21:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Hotspot Shield Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (08/03/2014 09:20:56 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 03.08.2014 um 21:19:34 unerwartet heruntergefahren.
Error: (08/03/2014 09:18:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Hotspot Shield Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (08/03/2014 09:16:35 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Hotspot Shield Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Error: (08/03/2014 07:53:53 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Microsoft Office Sessions:
=========================
Error: (08/05/2014 08:18:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/05/2014 06:56:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/05/2014 06:53:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/05/2014 01:32:22 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/05/2014 00:53:06 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/04/2014 11:17:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: EoCApp.exe1.0.81.053c7a40fEoCApp.exe1.0.81.053c7a40fc0000005000975ae18ac01cfb010cbe2fa11E:\Divinity\Divinity - Original Sin\Shipping\EoCApp.exeE:\Divinity\Divinity - Original Sin\Shipping\EoCApp.exeabd286e7-1c1c-11e4-865a-005056c00008
Error: (08/04/2014 08:20:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: EoCApp.exe1.0.81.053c7a40fEoCApp.exe1.0.81.053c7a40fc0000005000975ae123401cfb00416824316E:\Divinity\Divinity - Original Sin\Shipping\EoCApp.exeE:\Divinity\Divinity - Original Sin\Shipping\EoCApp.exefde67c45-1c03-11e4-865a-005056c00008
Error: (08/04/2014 06:27:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/04/2014 06:25:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/03/2014 09:23:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2014-03-09 15:06:56.520
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-03-09 15:06:56.481
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-03-09 15:06:56.344
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\THUNDE~1\AppData\Local\Temp\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-03-09 15:06:56.312
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\THUNDE~1\AppData\Local\Temp\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-03-09 15:06:45.509
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-03-09 15:06:45.479
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-03-09 15:06:45.354
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\THUNDE~1\AppData\Local\Temp\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-03-09 15:06:45.324
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\THUNDE~1\AppData\Local\Temp\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-03-09 15:06:39.306
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-03-09 15:06:39.276
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 48%
Total physical RAM: 6142.17 MB
Available physical RAM: 3139.82 MB
Total Pagefile: 11140.35 MB
Available Pagefile: 7917.85 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Windoof) (Fixed) (Total:111.69 GB) (Free:51.36 GB) NTFS
Drive d: (D) (Fixed) (Total:198.74 GB) (Free:61.98 GB) NTFS
Drive e: (Spiele) (Fixed) (Total:1863.01 GB) (Free:589.8 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (Zeug) (Fixed) (Total:931.51 GB) (Free:189.02 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (CDROM) (CDROM) (Total:1.26 GB) (Free:0 GB) CDFS
Drive s: (SpieleSSD) (Fixed) (Total:74.53 GB) (Free:18.06 GB) NTFS
Drive z: (Boxcryptor Classic) (Fixed) (Total:111.69 GB) (Free:51.36 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 75 GB) (Disk ID: 32801940)
Partition 1: (Not Active) - (Size=75 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 71CC5308)
Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 112 GB) (Disk ID: C2F132C6)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: ADA9E836)
Partition 1: (Active) - (Size=932 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
========================================================
Disk: 4 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 410721C7)
Partition 1: (Not Active) - (Size=34 GB) - (Type=BC)
Partition 2: (Not Active) - (Size=199 GB) - (Type=OF Extended)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-05 20:34:20
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP6T0L0-8 Samsung_SSD_840_EVO_120GB rev.EXT0BB6Q 111,79GB
Running: Gmer-19357.exe; Driver: C:\Users\THUNDE~1\AppData\Local\Temp\pxtirfog.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1984] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075838791 4 bytes [C2, 04, 00, 00]
.text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1984] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1984] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Windows\system32\Dwm.exe[2132] C:\Windows\system32\d3d11.dll!D3D11CreateDeviceAndSwapChain 000007fef7c800f8 9 bytes {MOV RAX, 0x6a144630; JMP RAX}
.text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2516] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2516] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2768] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2768] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2884] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2884] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[3160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[3160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe[3236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe[3236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe[4832] C:\Windows\SYSTEM32\ntdll.dll!DbgBreakPoint 0000000076ea0590 3 bytes [8B, 40, 30]
.text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe[5824] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe[5824] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5964] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5964] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe[5712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe[5712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
.text C:\Program Files (x86)\Fraps\fraps.exe[5972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075111465 2 bytes [11, 75]
.text C:\Program Files (x86)\Fraps\fraps.exe[5972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000751114bb 2 bytes [11, 75]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [6304:6504] 000007fefb0a2bf8
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [6304:6924] 000007fef2f05124
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 2985
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xB2 0x2C 0xBF 0xA6 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x8A 0xB4 0x0A 0x82 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x33 0x32 0xED 0xBB ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xB2 0x2C 0xBF 0xA6 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x8A 0xB4 0x0A 0x82 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x33 0x32 0xED 0xBB ...
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 05.08.2014 Suchlauf-Zeit: 19:04:21 Logdatei: MalwareBytes.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.08.05.06 Rootkit Datenbank: v2014.08.04.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Thunderhawk Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 308060 Verstrichene Zeit: 8 Min, 30 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end)  |
|
06.08.2014, 15:24
| #5 |
| /// the machine /// TB-Ausbilder | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.08.2014, 22:22
| #6 |
| | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. Soo, hier das Log von Combofix. Sorry, dass es so spät kommt, aber bin gerade erst von der Arbeit zurück. Code:
ATTFilter ComboFix 14-08-06.01 - Thunderhawk 06.08.2014 16:30:28.1.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.6142.4130 [GMT 2:00]
ausgeführt von:: c:\users\Thunderhawk\Desktop\ComboFix.exe
AV: ESET Smart Security 7.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
FW: ESET Personal Firewall *Enabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
SP: ESET Smart Security 7.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\KeePass Password Safe 2\KeePass.exe
c:\users\THUNDE~1\AppData\Local\Temp\087a7fb9-4ed6-48f7-81cb-0dfb6f1f0a8b\CliSecureRT64.dll
c:\users\Thunderhawk\AppData\Local\Temp\087a7fb9-4ed6-48f7-81cb-0dfb6f1f0a8b\CliSecureRT64.dll
c:\users\Thunderhawk\AppData\Roaming\YaTQA
c:\users\Thunderhawk\AppData\Roaming\YaTQA\icons.res
c:\users\Thunderhawk\AppData\Roaming\YaTQA\yatqa.ini
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-07-06 bis 2014-08-06 ))))))))))))))))))))))))))))))
.
.
2014-08-06 14:43 . 2014-08-06 14:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-08-05 17:57 . 2014-08-05 18:23 -------- d-----w- C:\FRST
2014-08-05 17:03 . 2014-08-05 18:36 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 17:02 . 2014-08-05 17:03 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2014-08-05 17:02 . 2014-05-12 05:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-08-05 17:02 . 2014-05-12 05:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-05 16:56 . 2014-08-05 16:56 -------- d-----w- C:\NPE
2014-08-05 16:54 . 2014-08-05 17:02 -------- d-----w- c:\users\Thunderhawk\AppData\Local\NPE
2014-08-05 16:54 . 2014-08-05 16:54 -------- d-----w- c:\programdata\Norton
2014-08-04 22:55 . 2014-08-04 22:55 -------- d-----w- c:\users\Thunderhawk\AppData\Local\ESET
2014-08-04 22:53 . 2014-08-04 22:53 -------- d-----w- c:\program files\ESET
2014-08-03 19:39 . 2014-08-03 19:39 -------- d-----w- c:\users\Thunderhawk\AppData\Local\ElevatedDiagnostics
2014-08-03 17:53 . 2014-08-03 17:53 -------- d-----w- c:\program files (x86)\Supraball
2014-08-03 16:43 . 2014-08-03 16:43 -------- d-----w- c:\users\Thunderhawk\AppData\Local\ODUI
2014-08-03 16:41 . 2014-08-03 16:41 -------- d-----w- c:\users\Thunderhawk\AppData\Local\Stardock
2014-08-03 16:40 . 2014-08-03 16:40 -------- d-----w- c:\users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 16:39 . 2014-08-03 16:39 -------- d-----w- c:\users\Thunderhawk\AppData\Local\PackageAware
2014-08-03 11:42 . 2014-08-03 11:42 -------- d-----w- c:\users\Thunderhawk\AppData\Local\Funcom
2014-08-02 15:18 . 2014-07-25 14:01 1291280 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2014-08-02 15:18 . 2014-07-25 14:01 1126480 ----a-w- c:\windows\SysWow64\nvspcap.dll
2014-08-02 15:18 . 2014-07-25 14:01 1715224 ----a-w- c:\windows\system32\nvspbridge64.dll
2014-08-02 15:18 . 2014-07-25 14:01 1283136 ----a-w- c:\windows\system32\nvspcap64.dll
2014-08-02 15:18 . 2014-08-02 15:22 -------- d-----w- c:\users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 15:18 . 2014-08-02 15:18 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2014-08-02 15:16 . 2014-07-02 17:44 609240 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2014-08-02 15:16 . 2014-08-06 14:26 -------- d-----w- c:\programdata\NVIDIA
2014-08-02 15:16 . 2014-07-02 18:55 6783776 ----a-w- c:\windows\system32\nvcpl.dll
2014-08-02 15:16 . 2014-07-02 18:55 3522392 ----a-w- c:\windows\system32\nvsvc64.dll
2014-08-02 15:16 . 2014-07-02 18:55 935368 ----a-w- c:\windows\system32\nvvsvc.exe
2014-08-02 15:16 . 2014-07-02 18:55 62808 ----a-w- c:\windows\system32\nvshext.dll
2014-08-02 15:16 . 2014-07-02 18:55 386520 ----a-w- c:\windows\system32\nvmctray.dll
2014-08-02 15:16 . 2014-07-02 18:55 2559960 ----a-w- c:\windows\system32\nvsvcr.dll
2014-08-02 15:16 . 2014-07-02 10:14 3826628 ----a-w- c:\windows\system32\nvcoproc.bin
2014-08-02 15:16 . 2014-07-02 20:48 75040 ----a-w- c:\windows\system32\OpenCL.dll
2014-08-02 15:16 . 2014-07-02 20:48 61912 ----a-w- c:\windows\SysWow64\OpenCL.dll
2014-08-02 13:42 . 2014-08-02 13:42 -------- d-----w- c:\users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 13:42 . 2014-08-02 13:42 -------- d-----w- c:\users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 13:42 . 2014-08-02 13:42 -------- d-----w- c:\program files (x86)\TopBanking
2014-07-27 17:32 . 2014-07-27 17:41 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2014-07-26 15:11 . 2014-07-26 15:11 -------- d-----w- c:\users\Thunderhawk\AppData\Local\Glyph
2014-07-26 15:11 . 2014-07-26 15:11 -------- d-----w- c:\programdata\Glyph
2014-07-26 12:43 . 2014-07-26 12:43 -------- d-----w- c:\users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-24 11:07 . 2014-07-24 11:07 -------- d-----w- c:\programdata\Riot Games
2014-07-21 19:50 . 2014-07-21 19:50 -------- d-----w- c:\program files (x86)\Common Files\Java
2014-07-21 19:50 . 2014-07-11 01:02 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-19 16:10 . 2014-07-21 20:20 -------- d-----w- c:\program files (x86)\SpeedFan
2014-07-19 15:00 . 2014-07-19 15:11 -------- d-----w- c:\users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 15:00 . 2014-07-19 15:00 -------- d-----w- c:\programdata\Bohemia Interactive
2014-07-19 10:34 . 2014-07-19 10:34 -------- d-----w- c:\users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-18 12:28 . 2014-07-18 12:28 -------- d-----w- c:\program files (x86)\NirSoft
2014-07-17 10:38 . 2014-07-17 10:38 -------- d-----w- c:\program files (x86)\Boxcryptor Classic
2014-07-15 15:32 . 2014-07-26 23:28 -------- d-----w- c:\users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-15 15:30 . 2014-07-15 15:30 -------- d-----w- c:\windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-14 14:23 . 2014-07-14 14:27 -------- d-----w- c:\users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 14:23 . 2014-07-14 14:23 -------- d-----w- c:\programdata\Bohemia Interactive Studio
2014-07-14 14:22 . 2014-07-14 14:23 -------- d-----w- c:\program files (x86)\Common Files\BattlEye
2014-07-14 14:18 . 2014-07-14 14:18 -------- d-----w- c:\users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 14:11 . 2014-07-14 14:11 -------- d-----w- c:\users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 14:10 . 2014-07-14 14:10 -------- d-----w- c:\program files (x86)\Dotjosh Studios
2014-07-14 13:49 . 2014-07-14 13:49 -------- d-----w- c:\users\Thunderhawk\AppData\Local\Adobe
2014-07-14 13:26 . 2014-08-03 11:24 -------- d-----w- c:\users\Thunderhawk\.junique
2014-07-12 22:22 . 2014-06-05 14:45 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-07-12 22:22 . 2014-06-05 14:26 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-07-12 22:22 . 2014-06-05 14:25 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-12 22:30 . 2014-01-25 20:54 96441528 ----a-w- c:\windows\system32\MRT.exe
2014-07-09 13:26 . 2014-01-25 21:42 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-09 13:26 . 2014-01-25 21:42 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-08 18:08 . 2014-05-14 11:08 5659136 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-06-05 15:59 . 2014-04-27 12:16 353280 ----a-w- c:\windows\system32\ssleay32.dll
2014-06-05 15:59 . 2014-04-27 12:16 353280 ----a-w- c:\windows\system32\libssl32.dll
2014-06-05 15:59 . 2014-04-27 12:16 1649664 ----a-w- c:\windows\system32\libeay32.dll
2014-06-05 06:07 . 2014-01-25 21:42 271360 ----a-w- c:\windows\SysWow64\ssleay32.dll
2014-06-05 06:07 . 2014-01-25 21:42 271360 ----a-w- c:\windows\SysWow64\libssl32.dll
2014-06-05 06:07 . 2014-01-25 21:42 1177088 ----a-w- c:\windows\SysWow64\libeay32.dll
2014-05-29 10:43 . 2014-01-25 19:09 57096 ----a-w- c:\windows\system32\certsentry.dll
2014-05-28 08:30 . 2014-05-28 08:30 283064 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2014-05-27 16:44 . 2014-01-31 20:05 386680 ----a-w- c:\windows\system32\drivers\sptd.sys
2014-05-17 00:42 . 2014-05-17 00:42 42184 ----a-w- c:\windows\system32\drivers\taphss6.sys
2014-05-12 05:25 . 2014-02-04 19:30 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-05-09 06:14 . 2014-05-15 09:30 477184 ----a-w- c:\windows\system32\aepdu.dll
2014-05-09 06:11 . 2014-05-15 09:30 424448 ----a-w- c:\windows\system32\aeinv.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay-cbfs4]
@="{6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80}"
[HKEY_CLASSES_ROOT\CLSID\{6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80}]
2013-11-15 13:43 156456 ----a-w- c:\windows\SysWOW64\cbfsMntNtf4.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BoxcryptorClassic.exe"="c:\program files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe" [2014-07-11 2249472]
"Spotify Web Helper"="c:\users\Thunderhawk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-04-28 1171000]
"SteelSeries Engine"="c:\program files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe" [2014-04-15 252928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files (x86)\Creative\Volume Panel\VolPanlu.exe" [2010-02-18 241789]
"CTxfiHlp"="CTXFIHLP.EXE" [2011-08-22 25600]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"Plantronics MyHeadset Updater"="c:\program files (x86)\Plantronics\MyHeadsetUpdater\MyHeadsetUpdater.exe" [2014-04-29 79872]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2014-02-06 189480]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-11 256896]
.
c:\users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-7-21 35464216]
Samsung Magician.lnk - c:\windows\system32\schtasks.exe /run /tn SamsungMagician [2010-11-21 285696]
starteFraps.bat [2012-7-5 112]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2013-12-6 565464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC}"= "c:\windows\SysWOW64\cbfsMntNtf4.dll" [2013-11-15 156456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"EldosMountNotificator-cbfs4"= {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - c:\windows\SysWOW64\cbfsMntNtf4.dll [2013-11-15 156456]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 ArcService;Arc Service;c:\program files (x86)\Perfect World Entertainment\Arc\ArcService.exe;c:\program files (x86)\Perfect World Entertainment\Arc\ArcService.exe [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\DRIVERS\cjusb.sys;c:\windows\SYSNATIVE\DRIVERS\cjusb.sys [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS;c:\windows\SYSNATIVE\drivers\CT20XUT.SYS [x]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS;c:\windows\SYSNATIVE\drivers\CTEXFIFX.SYS [x]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS;c:\windows\SYSNATIVE\drivers\CTHWIUT.SYS [x]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;e:\spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe;e:\spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 iumsvc;Intel(R) Update Manager;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 rzendpt;rzendpt;c:\windows\system32\DRIVERS\rzendpt.sys;c:\windows\SYSNATIVE\DRIVERS\rzendpt.sys [x]
R3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.SP1a\RpcAgentSrv.exe;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.SP1a\RpcAgentSrv.exe [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SteelSeriesDriver;SteelSeries Engine Service;c:\windows\system32\DRIVERS\ssengine.sys;c:\windows\SYSNATIVE\DRIVERS\ssengine.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys;c:\windows\SYSNATIVE\DRIVERS\mv91xx.sys [x]
S1 cbfs4;cbfs4;c:\windows\system32\drivers\cbfs4.sys;c:\windows\SYSNATIVE\drivers\cbfs4.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S2 avmike;AVM FRITZ!Fernzugang IKE Service;c:\program files\FRITZ!Fernzugang\avmike.exe;c:\program files\FRITZ!Fernzugang\avmike.exe [x]
S2 certsrv;AVM FRITZ!Fernzugang Cert Service;c:\program files\FRITZ!Fernzugang\certsrv.exe;c:\program files\FRITZ!Fernzugang\certsrv.exe [x]
S2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\SysWOW64\cjpcsc.exe;c:\windows\SysWOW64\cjpcsc.exe [x]
S2 DragonUpdater;COMODO Dragon Update Service;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 nwtsrv;AVM FRITZ!Fernzugang Client;c:\program files\FRITZ!Fernzugang\nwtsrv.exe;c:\program files\FRITZ!Fernzugang\nwtsrv.exe [x]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x]
S2 StarMoney 9.0 OnlineUpdate;StarMoney 9.0 OnlineUpdate;c:\program files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe;c:\program files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
S3 busenum;SteelBusSvc;c:\windows\system32\DRIVERS\SteelBus64.sys;c:\windows\SYSNATIVE\DRIVERS\SteelBus64.sys [x]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS;c:\windows\SYSNATIVE\drivers\CT20XUT.SYS [x]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS;c:\windows\SYSNATIVE\drivers\CTEXFIFX.SYS [x]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS;c:\windows\SYSNATIVE\drivers\CTHWIUT.SYS [x]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 NWIM;AVM VPN Miniport;c:\windows\system32\DRIVERS\avmnwim.sys;c:\windows\SYSNATIVE\DRIVERS\avmnwim.sys [x]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf_amd64.sys [x]
S3 SAlphamHid;SteelHIDSvc;c:\windows\system32\DRIVERS\SAlpham64.sys;c:\windows\SYSNATIVE\DRIVERS\SAlpham64.sys [x]
S3 vpnpbus;EldoS PnP Virtual Bus driver;c:\windows\system32\DRIVERS\vpnpbus.sys;c:\windows\SYSNATIVE\DRIVERS\vpnpbus.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-25 13:26]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay-cbfs4]
@="{6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80}"
[HKEY_CLASSES_ROOT\CLSID\{6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80}]
2013-11-15 13:44 183080 ----a-w- c:\windows\System32\cbfsMntNtf4.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2014-07-02 10464536]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-07-25 2403104]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-07-25 1283136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2014-02-24 5581888]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC}"= "c:\windows\system32\cbfsMntNtf4.dll" [2013-11-15 183080]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Alles mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlall.htm
IE: Auswahl mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dllink.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: Videos mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlfvideo.htm
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: Interfaces\{A97AC00F-2870-476B-9163-CCCDC2AA2E83}: NameServer = 192.168.179.1
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
FF - ProfilePath - c:\users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\
FF - prefs.js: browser.startup.homepage - http://www.trojaner-board.de/157274-...ml#post1340512
FF - prefs.js: keyword.enabled - false
FF - prefs.js: network.proxy.type - 2
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-KeePass Password Safe 2 - c:\program files (x86)\KeePass Password Safe 2\KeePass.exe
Wow6432Node-HKCU-Run-RocketDock - c:\program files (x86)\RocketDock\RocketDock.exe
Wow6432Node-HKLM-Run-KeePass 2 PreLoad - c:\program files (x86)\KeePass Password Safe 2\KeePass.exe
Wow6432Node-HKLM-Run-PLTSpokes.exe - c:\program files (x86)\Plantronics\Spokes3G\PLTSpokes.exe
SSODL-EldosMountNotificator-cbfs4 REG_SZ {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC}- - (no file)
AddRemove-BattlEye for A2 - e:\spiele\steam\steamapps\common\arma 2BattlEye\UnInstallBE.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-08-06 17:06:37
ComboFix-quarantined-files.txt 2014-08-06 15:06
.
Vor Suchlauf: 9 Verzeichnis(se), 56.046.120.960 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 56.662.724.608 Bytes frei
.
- - End Of File - - E4A76062439B2A27AEF23F359D696B20
A36C5E4F47E84449FF07ED3517B43A31
|
|
07.08.2014, 16:55
| #7 |
| /// the machine /// TB-Ausbilder | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.08.2014, 17:39
| #8 |
| | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. MalwareBytes log: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 07.08.2014 Suchlauf-Zeit: 18:19:06 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.08.07.07 Rootkit Datenbank: v2014.08.04.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Thunderhawk Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 328550 Verstrichene Zeit: 5 Min, 49 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.303 - Bericht erstellt am 07/08/2014 um 18:26:46
# Aktualisiert 06/08/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Thunderhawk - THUNDER-PC
# Gestartet von : C:\Users\Thunderhawk\Desktop\adwcleaner_3.303.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Default\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Thunderhawk\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Thunderhawk\AppData\Roaming\pdfforge
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\anchorfree
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17207
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\bq7kyknv.lool\prefs.js ]
[ Datei : C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\prefs.js ]
[ Datei : C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\oca6lwe6.promon\prefs.js ]
*************************
AdwCleaner[R0].txt - [1363 octets] - [07/08/2014 18:26:06]
AdwCleaner[S0].txt - [1231 octets] - [07/08/2014 18:26:46]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1291 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Thunderhawk on 07.08.2014 at 18:30:04,09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Successfully deleted: [File] C:\Users\Thunderhawk\AppData\Roaming\mozilla\firefox\profiles\mj10pijt.default\extensions\jid0-oecfxkaph2tc0bn3li9ajrazx6c@jetpack.xpi
Emptied folder: C:\Users\Thunderhawk\AppData\Roaming\mozilla\firefox\profiles\mj10pijt.default\minidumps [2 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.08.2014 at 18:35:32,93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Thunderhawk (administrator) on THUNDER-PC on 07-08-2014 18:36:01
Running from C:\Users\Thunderhawk\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Hi-Rez Studios) E:\Spiele\Hi-Rez Studios\HiPatchService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Secomba GmbH) C:\Program Files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe
(Spotify Ltd) C:\Users\Thunderhawk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Dropbox, Inc.) C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\Ctxfihlp.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CTxfispi.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps.exe
() C:\Users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps64.dat
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10464536 2014-07-02] (Logitech Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe [241789 2010-02-18] (Creative Technology Ltd)
HKLM-x32\...\Run: [CTxfiHlp] => CTXFIHLP.EXE
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Plantronics MyHeadset Updater] => C:\Program Files (x86)\Plantronics\MyHeadsetUpdater\MyHeadsetUpdater.exe [79872 2014-04-29] (Plantronics)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [BoxcryptorClassic.exe] => C:\Program Files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe [2249472 2014-07-11] (Secomba GmbH)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [Spotify Web Helper] => C:\Users\Thunderhawk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-29] (Spotify Ltd)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [SteelSeries Engine] => C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe [252928 2014-04-15] (SteelSeries ApS)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\starteFraps.bat ()
SSODL: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x020D68C2C09FCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Tcpip\..\Interfaces\{A97AC00F-2870-476B-9163-CCCDC2AA2E83}: [NameServer]192.168.179.1
FireFox:
========
FF ProfilePath: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default
FF Homepage: http://www.trojaner-board.de/157274-...ml#post1340512
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*'))%20%7B%20return%20'PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\idealode.xml
FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\youtube.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: CLEO - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\CLEO@guid.customsoftwareconsult.com [2014-07-01]
FF Extension: HTTPS-Everywhere - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\https-everywhere@eff.org [2014-06-28]
FF Extension: Pocket - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\isreaditlater@ideashower.com [2014-07-04]
FF Extension: KeeFox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\keefox@chris.tomlinson [2014-06-11]
FF Extension: NetVideoHunter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\netvideohunter@netvideohunter.com [2014-07-30]
FF Extension: FEBE - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2014-06-11]
FF Extension: Converter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{8B72860F-C5F8-4286-865E-D2C2DB98A9E6} [2014-03-26]
FF Extension: DownloadHelper - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-26]
FF Extension: ImageHost Grabber - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} [2014-03-26]
FF Extension: about:addons-memory - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\about-addons-memory@tn123.org.xpi [2014-03-26]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-03-26]
FF Extension: Brief - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\brief@mozdev.org.xpi [2014-03-26]
FF Extension: FurAffinity Extender - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\faextender@neocodenetworks.com.xpi [2014-03-26]
FF Extension: Firebug - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firebug@software.joehewitt.com.xpi [2014-03-26]
FF Extension: Grooveshark Remote - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefox@gsremote.com.xpi [2014-03-26]
FF Extension: Bookmarks Checker - check for bad links - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefoxbookmarkchecker@everhelper.me.xpi [2014-03-26]
FF Extension: Furaffinity Download extension for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\fuerholz@gmx.net.xpi [2014-03-26]
FF Extension: Magic Actions for YouTube™ - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi [2014-03-26]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-03-26]
FF Extension: Dict.cc Translation - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\searchdictcc@roughael.xpi [2014-03-26]
FF Extension: ShareMeNot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\sharemenot@franziroesner.com.xpi [2014-03-26]
FF Extension: Smart Referer - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\smart-referer@meh.paranoid.pk.xpi [2014-03-26]
FF Extension: Lyrics Here by Rob W - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\youtube-lyrics-by-rob-w@jetpack.xpi [2014-03-26]
FF Extension: Locator - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{05f6a7ea-896b-11da-8bde-f66bad1e3fff}.xpi [2014-03-26]
FF Extension: FlashGot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-03-26]
FF Extension: Cookie Monster - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{45d8ff86-d909-11db-9705-005056c00008}.xpi [2014-03-26]
FF Extension: eBay Sidebar for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}.xpi [2014-03-26]
FF Extension: NoScript - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-03-26]
FF Extension: Tab Mix Plus - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-03-26]
FF Extension: DownThemAll! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-03-26]
FF Extension: Greasemonkey - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-03-26]
FF Extension: Adblock Edge - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-03-26]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-05]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-06-26] (Perfect World Entertainment Inc)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [345984 2014-07-14] ()
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-01-25] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-01-25] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [294912 2010-09-30] (Creative Technology Ltd) [File not signed]
S3 DAUpdaterSvc; E:\Spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2011-05-04] (BioWare)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2135232 2014-05-21] ()
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
U2 HiPatchService; E:\Spiele\Hi-Rez Studios\HiPatchService.exe [9216 2014-07-18] (Hi-Rez Studios) [File not signed]
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2014-06-05] (The OpenVPN Project)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP1a\RpcAgentSrv.exe [72344 2008-02-17] (SiSoftware) [File not signed]
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
S3 CSRBC; C:\Windows\System32\Drivers\csrbcx64.sys [38400 2014-04-04] (CSR plc.)
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-28] (Disc Soft Ltd)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39080 2014-04-09] (Razer Inc)
R3 SAlphamHid; C:\Windows\System32\DRIVERS\SAlpham64.sys [38016 2013-05-31] (SteelSeries Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-05-27] (Duplex Secure Ltd.)
S3 SteelSeriesDriver; C:\Windows\System32\DRIVERS\ssengine.sys [24064 2013-11-14] () [File not signed]
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R3 vpnpbus; C:\Windows\System32\DRIVERS\vpnpbus.sys [18624 2013-11-15] (EldoS Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-07 18:36 - 2014-08-07 18:36 - 00027264 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt
2014-08-07 18:35 - 2014-08-07 18:35 - 00000933 _____ () C:\Users\Thunderhawk\Desktop\JRT.txt
2014-08-07 18:30 - 2014-08-07 18:30 - 00000000 ____D () C:\Windows\ERUNT
2014-08-07 18:25 - 2014-08-07 18:26 - 00000000 ____D () C:\AdwCleaner
2014-08-07 18:17 - 2014-08-07 18:17 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-07 18:01 - 2014-08-07 18:17 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\trojaner
2014-08-07 02:00 - 2014-08-07 18:01 - 01475072 _____ () C:\Users\Thunderhawk\Desktop\adwcleaner_3.303.exe
2014-08-07 02:00 - 2014-08-07 18:01 - 01016261 _____ (Thisisu) C:\Users\Thunderhawk\Desktop\JRT.exe
2014-08-06 17:07 - 2014-08-06 17:07 - 00031842 _____ () C:\ComboFix.txt
2014-08-06 16:29 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-06 16:29 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-06 16:29 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-06 16:28 - 2014-08-06 17:08 - 00000000 ____D () C:\Qoobox
2014-08-06 16:28 - 2014-08-06 17:00 - 00000000 ____D () C:\Windows\erdnt
2014-08-06 16:27 - 2014-08-06 15:26 - 05567759 ____R (Swearware) C:\Users\Thunderhawk\Desktop\ComboFix.exe
2014-08-05 20:41 - 2014-08-07 18:25 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Neuer Ordner
2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable
2014-08-05 19:57 - 2014-08-07 18:36 - 00000000 ____D () C:\FRST
2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe
2014-08-05 19:57 - 2014-08-02 11:06 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe
2014-08-05 19:03 - 2014-08-07 18:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-05 19:02 - 2014-08-07 18:17 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-05 19:02 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-05 19:02 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE
2014-08-05 18:54 - 2014-08-05 19:02 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET
2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET
2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk
2014-08-03 21:20 - 2014-08-07 18:28 - 00010502 _____ () C:\Windows\PFRO.log
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball
2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock
2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom
2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps
2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician
2014-08-02 17:18 - 2014-08-02 17:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-02 17:18 - 2014-07-25 16:01 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-08-02 17:16 - 2014-07-02 22:48 - 00075040 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-08-02 17:16 - 2014-07-02 22:48 - 00061912 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 06783776 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 03522392 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 02559960 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 00935368 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-08-02 17:16 - 2014-07-02 20:55 - 00386520 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-08-02 17:16 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-08-02 17:16 - 2014-07-02 12:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-08-02 17:15 - 2014-07-02 23:29 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-08-02 17:15 - 2014-07-02 23:29 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-08-02 17:15 - 2014-07-02 23:29 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-02 17:15 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 03196816 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00965312 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00502232 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00418760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00026353 _____ () C:\Windows\system32\nvinfo.pb
2014-08-02 17:15 - 2014-03-31 18:42 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-08-02 17:15 - 2014-03-31 18:42 - 00037320 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2014-08-02 17:15 - 2014-03-31 18:42 - 00034760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-08-02 15:43 - 2014-08-02 16:22 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub
2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking
2014-08-02 14:04 - 2014-08-07 18:28 - 00003031 _____ () C:\Windows\setupact.log
2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-30 20:32 - 2014-07-30 21:04 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge
2014-07-27 19:32 - 2014-07-27 19:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk
2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph
2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-21 21:50 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-21 21:50 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-21 21:50 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-21 21:50 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-19 18:10 - 2014-07-21 22:20 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-07-19 17:00 - 2014-07-19 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic
2014-07-15 17:32 - 2014-07-27 01:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-14 19:43 - 2014-07-14 19:44 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse
2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios
2014-07-14 16:23 - 2014-07-14 16:27 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 16:18 - 2014-07-14 16:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios
2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe
2014-07-14 15:26 - 2014-08-03 13:24 - 00000000 ____D () C:\Users\Thunderhawk\.junique
2014-07-13 00:23 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-13 00:23 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-13 00:23 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-13 00:23 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-13 00:23 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-13 00:23 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-13 00:23 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-13 00:23 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-13 00:23 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-13 00:23 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-13 00:23 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-13 00:23 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-13 00:23 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-13 00:23 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-13 00:23 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-13 00:23 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-13 00:23 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-13 00:23 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-13 00:23 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-13 00:23 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-13 00:23 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-13 00:23 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-13 00:23 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-13 00:23 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-13 00:23 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-13 00:23 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-13 00:23 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-13 00:23 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-13 00:23 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-13 00:23 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-13 00:23 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-13 00:23 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-13 00:23 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-13 00:23 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-13 00:23 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-13 00:23 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-13 00:23 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-13 00:23 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-13 00:23 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-13 00:23 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-13 00:23 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-13 00:23 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-13 00:23 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-13 00:23 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-13 00:23 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-13 00:23 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-13 00:23 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-13 00:23 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-13 00:23 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-13 00:23 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-13 00:23 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-13 00:23 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-13 00:23 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-13 00:23 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-13 00:23 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-13 00:23 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-13 00:23 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-13 00:23 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-13 00:23 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-13 00:23 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-13 00:23 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-13 00:23 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-13 00:22 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-13 00:22 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-13 00:22 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-08 18:06 - 2014-07-08 18:06 - 00001098 _____ () C:\Users\Thunderhawk\Desktop\World of Warcraft - Rising Gods.lnk
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-07 18:36 - 2014-08-07 18:36 - 00027264 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt
2014-08-07 18:36 - 2014-08-05 19:57 - 00000000 ____D () C:\FRST
2014-08-07 18:35 - 2014-08-07 18:35 - 00000933 _____ () C:\Users\Thunderhawk\Desktop\JRT.txt
2014-08-07 18:35 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\NetSpeedMonitor
2014-08-07 18:35 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-07 18:35 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-07 18:34 - 2011-04-12 09:43 - 00709682 _____ () C:\Windows\system32\perfh007.dat
2014-08-07 18:34 - 2011-04-12 09:43 - 00154012 _____ () C:\Windows\system32\perfc007.dat
2014-08-07 18:34 - 2009-07-14 07:13 - 01648762 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-07 18:30 - 2014-08-07 18:30 - 00000000 ____D () C:\Windows\ERUNT
2014-08-07 18:28 - 2014-08-03 21:20 - 00010502 _____ () C:\Windows\PFRO.log
2014-08-07 18:28 - 2014-08-02 14:04 - 00003031 _____ () C:\Windows\setupact.log
2014-08-07 18:28 - 2014-05-12 01:28 - 00000000 ___RD () C:\Users\Thunderhawk\Dropbox
2014-08-07 18:28 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Dropbox
2014-08-07 18:28 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-07 18:27 - 2014-01-25 21:06 - 01416417 _____ () C:\Windows\WindowsUpdate.log
2014-08-07 18:26 - 2014-08-07 18:25 - 00000000 ____D () C:\AdwCleaner
2014-08-07 18:25 - 2014-08-05 20:41 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Neuer Ordner
2014-08-07 18:17 - 2014-08-07 18:17 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-07 18:17 - 2014-08-07 18:01 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\trojaner
2014-08-07 18:17 - 2014-08-05 19:03 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-07 18:17 - 2014-08-05 19:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-07 18:08 - 2014-01-25 23:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-07 18:01 - 2014-08-07 02:00 - 01475072 _____ () C:\Users\Thunderhawk\Desktop\adwcleaner_3.303.exe
2014-08-07 18:01 - 2014-08-07 02:00 - 01016261 _____ (Thisisu) C:\Users\Thunderhawk\Desktop\JRT.exe
2014-08-07 17:57 - 2014-06-15 13:18 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-07 17:57 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Apps\2.0
2014-08-06 23:16 - 2014-01-31 14:43 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-08-06 23:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-06 17:08 - 2014-08-06 16:28 - 00000000 ____D () C:\Qoobox
2014-08-06 17:07 - 2014-08-06 17:07 - 00031842 _____ () C:\ComboFix.txt
2014-08-06 17:07 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\SKLAVE
2014-08-06 17:00 - 2014-08-06 16:28 - 00000000 ____D () C:\Windows\erdnt
2014-08-06 16:44 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-06 16:36 - 2014-01-25 23:57 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2
2014-08-06 16:27 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\KeePass
2014-08-06 15:26 - 2014-08-06 16:27 - 05567759 ____R (Swearware) C:\Users\Thunderhawk\Desktop\ComboFix.exe
2014-08-06 01:15 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\TS3Client
2014-08-05 20:45 - 2014-04-19 19:25 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Networking Course
2014-08-05 20:23 - 2014-04-26 20:44 - 00003718 _____ () C:\Windows\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable
2014-08-05 20:17 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\Thunderhawk
2014-08-05 20:01 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\vlc
2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe
2014-08-05 19:40 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-05 19:40 - 2014-03-23 14:04 - 00000000 ____D () C:\Program Files\WinRAR
2014-08-05 19:35 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\VMware
2014-08-05 19:34 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\VMware
2014-08-05 19:08 - 2014-03-08 23:24 - 00000000 ____D () C:\TEMP
2014-08-05 19:03 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Malwarebytes
2014-08-05 19:02 - 2014-08-05 18:54 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE
2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET
2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET
2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk
2014-08-04 00:57 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\JDownloader v2.0
2014-08-03 21:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-08-03 20:52 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Free Download Manager
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball
2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock
2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 17:30 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Deployment
2014-08-03 17:00 - 2014-03-26 14:45 - 00002240 ____H () C:\Users\Thunderhawk\Documents\Default.rdp
2014-08-03 16:48 - 2014-02-23 18:19 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-03 14:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom
2014-08-03 13:24 - 2014-07-14 15:26 - 00000000 ____D () C:\Users\Thunderhawk\.junique
2014-08-03 13:24 - 2014-04-06 15:27 - 00000000 ____D () C:\Users\Thunderhawk\.minion
2014-08-03 13:10 - 2014-01-31 13:06 - 00000000 ____D () C:\Program Files\Logitech Gaming Software
2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps
2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician
2014-08-02 18:12 - 2014-03-26 16:14 - 00000000 ____D () C:\Program Files (x86)\Samsung Magician
2014-08-02 18:01 - 2014-03-09 16:05 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-02 17:22 - 2014-08-02 17:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 17:22 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA Corporation
2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-02 17:18 - 2014-01-25 22:39 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-02 17:18 - 2014-01-25 22:38 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-02 16:22 - 2014-08-02 15:43 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub
2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking
2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-02 11:06 - 2014-08-05 19:57 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe
2014-08-01 19:09 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\DAEMON Tools Lite
2014-07-31 15:24 - 2014-02-04 21:13 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-30 21:04 - 2014-07-30 20:32 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge
2014-07-30 19:26 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Thunderbird
2014-07-30 19:18 - 2014-01-25 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-27 19:41 - 2014-07-27 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-07-27 01:28 - 2014-07-15 17:32 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-26 21:26 - 2014-03-26 14:46 - 00581038 _____ () C:\Users\Thunderhawk\Documents\Thunder.kdbx
2014-07-26 21:25 - 2014-03-26 14:46 - 00000000 ____D () C:\Users\Thunderhawk\Documents\my games
2014-07-26 20:20 - 2014-04-13 14:24 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Roaming\winscp.rnd
2014-07-26 19:40 - 2014-03-26 14:41 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Local\PUTTY.RND
2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk
2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph
2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-26 01:10 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 16:01 - 2014-08-02 17:18 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-21 22:20 - 2014-07-19 18:10 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-21 21:50 - 2014-01-25 23:39 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-07-19 17:11 - 2014-07-19 17:00 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 17:01 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Arma 3
2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-19 12:30 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\.minecraft
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-07-17 13:02 - 2014-04-13 14:21 - 00000986 _____ () C:\Users\Public\Desktop\WinSCP.lnk
2014-07-17 13:02 - 2014-04-13 14:21 - 00000000 ____D () C:\Program Files (x86)\WinSCP
2014-07-17 13:01 - 2014-01-25 21:59 - 01677000 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic
2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-15 16:10 - 2014-01-31 13:10 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-07-14 19:44 - 2014-07-14 19:43 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse
2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios
2014-07-14 16:27 - 2014-07-14 16:23 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 16:23 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArmA 2
2014-07-14 16:22 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios
2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe
2014-07-14 15:34 - 2014-05-27 20:22 - 00000058 _____ () C:\Users\Thunderhawk\Desktop\Neues Textdokument.txt
2014-07-13 21:02 - 2009-07-14 06:45 - 00394536 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-13 00:33 - 2014-01-25 22:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-13 00:30 - 2014-01-25 22:54 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-11 03:02 - 2014-07-21 21:50 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-11 02:56 - 2014-07-21 21:50 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-11 02:56 - 2014-07-21 21:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-11 02:55 - 2014-07-21 21:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-09 15:39 - 2014-03-23 18:45 - 00000000 ____D () C:\Program Files (x86)\RocketDock
2014-07-09 15:26 - 2014-01-25 23:42 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:26 - 2014-01-25 23:42 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 15:26 - 2014-01-25 23:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-08 20:08 - 2014-05-14 13:08 - 05659136 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-07-08 18:06 - 2014-07-08 18:06 - 00001098 _____ () C:\Users\Thunderhawk\Desktop\World of Warcraft - Rising Gods.lnk
Some content of TEMP:
====================
C:\Users\Thunderhawk\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpduxrjt.dll
C:\Users\Thunderhawk\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-07 18:15
==================== End Of Log ============================
--- --- --- |
|
08.08.2014, 16:14
| #9 |
| /// the machine /// TB-Ausbilder | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet.ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.08.2014, 09:45
| #10 |
| | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. ESET Online Scanner log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=d143a919dfbd1441b4539b0177fa3285
# engine=19572
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-09 07:15:13
# local_time=2014-08-09 09:15:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 16890087 159198363 0 0
# compatibility_mode_1='ESET Smart Security 7.0'
# compatibility_mode=8221 16777213 100 100 373392 28148255 0 0
# scanned=797374
# found=5
# cleaned=0
# scan_time=22879
# nod_component=V3 Build:0x30000000
sh=B20B0BD8E5CDD280C5DC922FFD896DF50D208CB7 ft=1 fh=59ddf8c2c6946d84 vn="Variante von Win32/HackTool.CheatEngine.AB potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Cheat Engine 6.3\cheatengine-i386.exe"
sh=860EFD5893E4DD4E820227B7DEAD144F974456AC ft=1 fh=c0b9ed8dfe12ffb8 vn="Variante von Win32/HackTool.CheatEngine.AF potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Cheat Engine 6.3\standalonephase1.dat"
sh=EE3CA882FB4443EF06929ECAEAF423B8A55C680B ft=1 fh=724db7b255f14a9a vn="Variante von Win32/BitCoinMiner.BJ potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Dogecoin\dogecoin-qt.exe"
sh=0415AD8BD5F4257B470B879A8C2F6AD6AEDA237F ft=0 fh=0000000000000000 vn="Variante von Android/Remosm.A potenziell unsichere Anwendung" ac=I fn="D:\Handysave\vorCrashHandysave.7z"
sh=B4B36B0EA5BF4F5D689D8632E24E5B67B72D9E89 ft=0 fh=0000000000000000 vn="Win32/PSWTool.KonBoot.A potenziell unsichere Anwendung" ac=I fn="F:\ubcd5(inkl ToolStar).iso"
Code:
ATTFilter Results of screen317's Security Check version 0.99.86
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
ESET Smart Security 7.0
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Secunia PSI (3.0.0.9016)
Java 7 Update 67
Java version out of Date!
Adobe Flash Player 14.0.0.145
Adobe Reader XI
Mozilla Firefox (31.0)
Mozilla Thunderbird (31.0.)
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
StarMoney 9.0 ouservice StarMoneyOnlineUpdate.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Thunderhawk (administrator) on THUNDER-PC on 09-08-2014 10:37:39
Running from C:\Users\Thunderhawk\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Hi-Rez Studios) E:\Spiele\Hi-Rez Studios\HiPatchService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\Ctxfihlp.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CTxfispi.exe
() C:\Users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps64.dat
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10464536 2014-07-02] (Logitech Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe [241789 2010-02-18] (Creative Technology Ltd)
HKLM-x32\...\Run: [CTxfiHlp] => CTXFIHLP.EXE
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [SteelSeries Engine] => C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe [252928 2014-04-15] (SteelSeries ApS)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\starteFraps.bat ()
SSODL: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x020D68C2C09FCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Tcpip\..\Interfaces\{A97AC00F-2870-476B-9163-CCCDC2AA2E83}: [NameServer]192.168.179.1
FireFox:
========
FF ProfilePath: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default
FF Homepage: http://www.trojaner-board.de/157274-...ml#post1340512
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*'))%20%7B%20return%20'PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000%3B%20PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\idealode.xml
FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\youtube.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: CLEO - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\CLEO@guid.customsoftwareconsult.com [2014-07-01]
FF Extension: HTTPS-Everywhere - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\https-everywhere@eff.org [2014-06-28]
FF Extension: Pocket - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\isreaditlater@ideashower.com [2014-07-04]
FF Extension: KeeFox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\keefox@chris.tomlinson [2014-06-11]
FF Extension: NetVideoHunter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\netvideohunter@netvideohunter.com [2014-07-30]
FF Extension: FEBE - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2014-06-11]
FF Extension: Converter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{8B72860F-C5F8-4286-865E-D2C2DB98A9E6} [2014-03-26]
FF Extension: DownloadHelper - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-08-09]
FF Extension: ImageHost Grabber - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} [2014-03-26]
FF Extension: about:addons-memory - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\about-addons-memory@tn123.org.xpi [2014-03-26]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-03-26]
FF Extension: Brief - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\brief@mozdev.org.xpi [2014-03-26]
FF Extension: FurAffinity Extender - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\faextender@neocodenetworks.com.xpi [2014-03-26]
FF Extension: Firebug - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firebug@software.joehewitt.com.xpi [2014-03-26]
FF Extension: Grooveshark Remote - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefox@gsremote.com.xpi [2014-03-26]
FF Extension: Bookmarks Checker - check for bad links - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefoxbookmarkchecker@everhelper.me.xpi [2014-03-26]
FF Extension: Furaffinity Download extension for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\fuerholz@gmx.net.xpi [2014-03-26]
FF Extension: Magic Actions for YouTube™ - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi [2014-03-26]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-03-26]
FF Extension: Dict.cc Translation - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\searchdictcc@roughael.xpi [2014-03-26]
FF Extension: ShareMeNot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\sharemenot@franziroesner.com.xpi [2014-03-26]
FF Extension: Smart Referer - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\smart-referer@meh.paranoid.pk.xpi [2014-03-26]
FF Extension: Lyrics Here by Rob W - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\youtube-lyrics-by-rob-w@jetpack.xpi [2014-03-26]
FF Extension: Locator - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{05f6a7ea-896b-11da-8bde-f66bad1e3fff}.xpi [2014-03-26]
FF Extension: FlashGot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-03-26]
FF Extension: Cookie Monster - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{45d8ff86-d909-11db-9705-005056c00008}.xpi [2014-03-26]
FF Extension: eBay Sidebar for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}.xpi [2014-03-26]
FF Extension: NoScript - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-03-26]
FF Extension: Tab Mix Plus - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-03-26]
FF Extension: DownThemAll! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-03-26]
FF Extension: Greasemonkey - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-03-26]
FF Extension: Adblock Edge - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-03-26]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-05]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-06-26] (Perfect World Entertainment Inc)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [345984 2014-07-14] ()
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-01-25] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-01-25] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [294912 2010-09-30] (Creative Technology Ltd) [File not signed]
S3 DAUpdaterSvc; E:\Spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2011-05-04] (BioWare)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2135232 2014-05-21] ()
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
U2 HiPatchService; E:\Spiele\Hi-Rez Studios\HiPatchService.exe [9216 2014-07-18] (Hi-Rez Studios) [File not signed]
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2014-06-05] (The OpenVPN Project)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP1a\RpcAgentSrv.exe [72344 2008-02-17] (SiSoftware) [File not signed]
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
S3 CSRBC; C:\Windows\System32\Drivers\csrbcx64.sys [38400 2014-04-04] (CSR plc.)
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-28] (Disc Soft Ltd)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39080 2014-04-09] (Razer Inc)
R3 SAlphamHid; C:\Windows\System32\DRIVERS\SAlpham64.sys [38016 2013-05-31] (SteelSeries Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-05-27] (Duplex Secure Ltd.)
S3 SteelSeriesDriver; C:\Windows\System32\DRIVERS\ssengine.sys [24064 2013-11-14] () [File not signed]
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R3 vpnpbus; C:\Windows\System32\DRIVERS\vpnpbus.sys [18624 2013-11-15] (EldoS Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-09 02:22 - 2014-08-09 02:22 - 00854410 _____ () C:\Users\Thunderhawk\Desktop\SecurityCheck.exe
2014-08-09 02:20 - 2014-08-09 02:20 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-09 02:19 - 2013-02-08 17:15 - 02347384 _____ (ESET) C:\Users\Thunderhawk\Desktop\esetsmartinstaller_deu.exe
2014-08-08 14:22 - 2014-08-08 14:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\CrashDumps
2014-08-07 23:11 - 2014-08-07 23:11 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-07 18:36 - 2014-08-09 10:37 - 00026309 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt
2014-08-07 18:35 - 2014-08-07 18:35 - 00000933 _____ () C:\Users\Thunderhawk\Desktop\JRT.txt
2014-08-07 18:30 - 2014-08-07 18:30 - 00000000 ____D () C:\Windows\ERUNT
2014-08-07 18:25 - 2014-08-07 18:26 - 00000000 ____D () C:\AdwCleaner
2014-08-07 18:17 - 2014-08-07 18:17 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-07 18:01 - 2014-08-07 18:17 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\trojaner
2014-08-07 02:00 - 2014-08-07 18:01 - 01475072 _____ () C:\Users\Thunderhawk\Desktop\adwcleaner_3.303.exe
2014-08-07 02:00 - 2014-08-07 18:01 - 01016261 _____ (Thisisu) C:\Users\Thunderhawk\Desktop\JRT.exe
2014-08-06 17:07 - 2014-08-06 17:07 - 00031842 _____ () C:\ComboFix.txt
2014-08-06 16:29 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-06 16:29 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-06 16:29 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-06 16:28 - 2014-08-06 17:08 - 00000000 ____D () C:\Qoobox
2014-08-06 16:28 - 2014-08-06 17:00 - 00000000 ____D () C:\Windows\erdnt
2014-08-06 16:27 - 2014-08-06 15:26 - 05567759 ____R (Swearware) C:\Users\Thunderhawk\Desktop\ComboFix.exe
2014-08-05 20:41 - 2014-08-09 10:37 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Neuer Ordner
2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable
2014-08-05 19:57 - 2014-08-09 10:37 - 00000000 ____D () C:\FRST
2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe
2014-08-05 19:57 - 2014-08-02 11:06 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe
2014-08-05 19:03 - 2014-08-08 01:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-05 19:02 - 2014-08-07 18:17 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-05 19:02 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-05 19:02 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE
2014-08-05 18:54 - 2014-08-05 19:02 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET
2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET
2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk
2014-08-03 21:20 - 2014-08-07 18:28 - 00010502 _____ () C:\Windows\PFRO.log
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball
2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock
2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom
2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps
2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician
2014-08-02 17:18 - 2014-08-02 17:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-02 17:18 - 2014-07-25 16:01 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-08-02 17:16 - 2014-07-02 22:48 - 00075040 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-08-02 17:16 - 2014-07-02 22:48 - 00061912 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 06783776 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 03522392 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 02559960 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 00935368 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-08-02 17:16 - 2014-07-02 20:55 - 00386520 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-08-02 17:16 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-08-02 17:16 - 2014-07-02 12:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-08-02 17:15 - 2014-07-02 23:29 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-08-02 17:15 - 2014-07-02 23:29 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-08-02 17:15 - 2014-07-02 23:29 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-02 17:15 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 03196816 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00965312 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00502232 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00418760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00026353 _____ () C:\Windows\system32\nvinfo.pb
2014-08-02 17:15 - 2014-03-31 18:42 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-08-02 17:15 - 2014-03-31 18:42 - 00037320 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2014-08-02 17:15 - 2014-03-31 18:42 - 00034760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-08-02 15:43 - 2014-08-02 16:22 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub
2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking
2014-08-02 14:04 - 2014-08-09 02:18 - 00003703 _____ () C:\Windows\setupact.log
2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-30 20:32 - 2014-07-30 21:04 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge
2014-07-27 19:32 - 2014-07-27 19:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk
2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph
2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-19 18:10 - 2014-07-21 22:20 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-07-19 17:00 - 2014-07-19 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic
2014-07-15 17:32 - 2014-07-27 01:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-14 19:43 - 2014-07-14 19:44 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse
2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios
2014-07-14 16:23 - 2014-07-14 16:27 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 16:18 - 2014-07-14 16:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios
2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe
2014-07-14 15:26 - 2014-08-08 00:58 - 00000000 ____D () C:\Users\Thunderhawk\.junique
2014-07-13 00:23 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-13 00:23 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-13 00:23 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-13 00:23 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-13 00:23 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-13 00:23 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-13 00:23 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-13 00:23 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-13 00:23 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-13 00:23 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-13 00:23 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-13 00:23 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-13 00:23 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-13 00:23 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-13 00:23 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-13 00:23 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-13 00:23 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-13 00:23 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-13 00:23 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-13 00:23 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-13 00:23 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-13 00:23 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-13 00:23 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-13 00:23 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-13 00:23 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-13 00:23 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-13 00:23 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-13 00:23 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-13 00:23 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-13 00:23 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-13 00:23 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-13 00:23 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-13 00:23 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-13 00:23 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-13 00:23 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-13 00:23 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-13 00:23 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-13 00:23 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-13 00:23 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-13 00:23 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-13 00:23 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-13 00:23 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-13 00:23 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-13 00:23 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-13 00:23 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-13 00:23 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-13 00:23 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-13 00:23 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-13 00:23 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-13 00:23 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-13 00:23 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-13 00:23 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-13 00:23 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-13 00:23 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-13 00:23 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-13 00:23 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-13 00:23 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-13 00:23 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-13 00:23 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-13 00:23 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-13 00:23 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-13 00:23 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-13 00:22 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-13 00:22 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-13 00:22 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-09 10:38 - 2014-08-07 18:36 - 00026309 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt
2014-08-09 10:37 - 2014-08-05 20:41 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Neuer Ordner
2014-08-09 10:37 - 2014-08-05 19:57 - 00000000 ____D () C:\FRST
2014-08-09 10:37 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\NetSpeedMonitor
2014-08-09 10:08 - 2014-01-25 23:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-09 09:46 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\vlc
2014-08-09 02:25 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-09 02:25 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-09 02:23 - 2011-04-12 09:43 - 00709682 _____ () C:\Windows\system32\perfh007.dat
2014-08-09 02:23 - 2011-04-12 09:43 - 00154012 _____ () C:\Windows\system32\perfc007.dat
2014-08-09 02:23 - 2009-07-14 07:13 - 01648762 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-09 02:22 - 2014-08-09 02:22 - 00854410 _____ () C:\Users\Thunderhawk\Desktop\SecurityCheck.exe
2014-08-09 02:20 - 2014-08-09 02:20 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-09 02:19 - 2014-01-25 21:06 - 01456070 _____ () C:\Windows\WindowsUpdate.log
2014-08-09 02:18 - 2014-08-02 14:04 - 00003703 _____ () C:\Windows\setupact.log
2014-08-09 02:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-08 14:30 - 2014-05-12 01:28 - 00000000 ___RD () C:\Users\Thunderhawk\Dropbox
2014-08-08 14:22 - 2014-08-08 14:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\CrashDumps
2014-08-08 13:53 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\.minecraft
2014-08-08 13:49 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\TS3Client
2014-08-08 13:43 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Dropbox
2014-08-08 13:43 - 2014-01-31 14:43 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-08-08 01:42 - 2014-08-05 19:03 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-08 00:58 - 2014-07-14 15:26 - 00000000 ____D () C:\Users\Thunderhawk\.junique
2014-08-08 00:58 - 2014-04-06 15:27 - 00000000 ____D () C:\Users\Thunderhawk\.minion
2014-08-07 23:11 - 2014-08-07 23:11 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-07 23:10 - 2014-01-31 13:10 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-08-07 18:35 - 2014-08-07 18:35 - 00000933 _____ () C:\Users\Thunderhawk\Desktop\JRT.txt
2014-08-07 18:30 - 2014-08-07 18:30 - 00000000 ____D () C:\Windows\ERUNT
2014-08-07 18:28 - 2014-08-03 21:20 - 00010502 _____ () C:\Windows\PFRO.log
2014-08-07 18:26 - 2014-08-07 18:25 - 00000000 ____D () C:\AdwCleaner
2014-08-07 18:17 - 2014-08-07 18:17 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-07 18:17 - 2014-08-07 18:01 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\trojaner
2014-08-07 18:17 - 2014-08-05 19:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-07 18:01 - 2014-08-07 02:00 - 01475072 _____ () C:\Users\Thunderhawk\Desktop\adwcleaner_3.303.exe
2014-08-07 18:01 - 2014-08-07 02:00 - 01016261 _____ (Thisisu) C:\Users\Thunderhawk\Desktop\JRT.exe
2014-08-07 17:57 - 2014-06-15 13:18 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-07 17:57 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Apps\2.0
2014-08-06 23:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-06 17:08 - 2014-08-06 16:28 - 00000000 ____D () C:\Qoobox
2014-08-06 17:07 - 2014-08-06 17:07 - 00031842 _____ () C:\ComboFix.txt
2014-08-06 17:07 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\SKLAVE
2014-08-06 17:00 - 2014-08-06 16:28 - 00000000 ____D () C:\Windows\erdnt
2014-08-06 16:44 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-06 16:36 - 2014-01-25 23:57 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2
2014-08-06 16:27 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\KeePass
2014-08-06 15:26 - 2014-08-06 16:27 - 05567759 ____R (Swearware) C:\Users\Thunderhawk\Desktop\ComboFix.exe
2014-08-05 20:45 - 2014-04-19 19:25 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Networking Course
2014-08-05 20:23 - 2014-04-26 20:44 - 00003718 _____ () C:\Windows\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable
2014-08-05 20:17 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\Thunderhawk
2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe
2014-08-05 19:40 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-05 19:40 - 2014-03-23 14:04 - 00000000 ____D () C:\Program Files\WinRAR
2014-08-05 19:35 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\VMware
2014-08-05 19:34 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\VMware
2014-08-05 19:08 - 2014-03-08 23:24 - 00000000 ____D () C:\TEMP
2014-08-05 19:03 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Malwarebytes
2014-08-05 19:02 - 2014-08-05 18:54 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE
2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET
2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET
2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk
2014-08-04 00:57 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\JDownloader v2.0
2014-08-03 21:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-08-03 20:52 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Free Download Manager
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball
2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock
2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 17:30 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Deployment
2014-08-03 17:00 - 2014-03-26 14:45 - 00002240 ____H () C:\Users\Thunderhawk\Documents\Default.rdp
2014-08-03 16:48 - 2014-02-23 18:19 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-03 14:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom
2014-08-03 13:10 - 2014-01-31 13:06 - 00000000 ____D () C:\Program Files\Logitech Gaming Software
2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps
2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician
2014-08-02 18:12 - 2014-03-26 16:14 - 00000000 ____D () C:\Program Files (x86)\Samsung Magician
2014-08-02 18:01 - 2014-03-09 16:05 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-02 17:22 - 2014-08-02 17:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 17:22 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA Corporation
2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-02 17:18 - 2014-01-25 22:39 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-02 17:18 - 2014-01-25 22:38 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-02 16:22 - 2014-08-02 15:43 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub
2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking
2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-02 11:06 - 2014-08-05 19:57 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe
2014-08-01 19:09 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\DAEMON Tools Lite
2014-07-31 15:24 - 2014-02-04 21:13 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-30 21:04 - 2014-07-30 20:32 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge
2014-07-30 19:26 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Thunderbird
2014-07-30 19:18 - 2014-01-25 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-27 19:41 - 2014-07-27 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-07-27 01:28 - 2014-07-15 17:32 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-26 21:26 - 2014-03-26 14:46 - 00581038 _____ () C:\Users\Thunderhawk\Documents\Thunder.kdbx
2014-07-26 21:25 - 2014-03-26 14:46 - 00000000 ____D () C:\Users\Thunderhawk\Documents\my games
2014-07-26 20:20 - 2014-04-13 14:24 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Roaming\winscp.rnd
2014-07-26 19:40 - 2014-03-26 14:41 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Local\PUTTY.RND
2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk
2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph
2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-26 01:10 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 16:01 - 2014-08-02 17:18 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-21 22:20 - 2014-07-19 18:10 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-21 21:50 - 2014-01-25 23:39 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-07-19 17:11 - 2014-07-19 17:00 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 17:01 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Arma 3
2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-07-17 13:02 - 2014-04-13 14:21 - 00000986 _____ () C:\Users\Public\Desktop\WinSCP.lnk
2014-07-17 13:02 - 2014-04-13 14:21 - 00000000 ____D () C:\Program Files (x86)\WinSCP
2014-07-17 13:01 - 2014-01-25 21:59 - 01677000 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic
2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-14 19:44 - 2014-07-14 19:43 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse
2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios
2014-07-14 16:27 - 2014-07-14 16:23 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 16:23 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArmA 2
2014-07-14 16:22 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios
2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe
2014-07-14 15:34 - 2014-05-27 20:22 - 00000058 _____ () C:\Users\Thunderhawk\Desktop\Neues Textdokument.txt
2014-07-13 21:02 - 2009-07-14 06:45 - 00394536 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-13 00:33 - 2014-01-25 22:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-13 00:30 - 2014-01-25 22:54 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Thunderhawk\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp4mhpcd.dll
C:\Users\Thunderhawk\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Thunderhawk\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-07 18:15
==================== End Of Log ============================
--- --- --- |
|
09.08.2014, 17:40
| #11 |
| /// the machine /// TB-Ausbilder | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. Java updaten. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.08.2014, 01:15
| #12 |
| | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. Hey. Super vielen Dank für deine Hilfe und Zeit. Bin soweit fertig mit der Anleitung und scheint auch alles wieder richtig zu funktionieren. Wünsche dir noch ein schönes Wochenende. |
|
10.08.2014, 08:34
| #13 |
| /// the machine /// TB-Ausbilder | E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. |
| android/remosm.a, archiv, betrieb, bitdefender, defender, direkt, e-mail, ergebnisse, erwischt, keine verbindung, malwarebytes, paypal, scanner, screenshot, verbindung, virustotal, win32/bitcoinminer.bj, win32/hacktool.cheatengine.ab, win32/hacktool.cheatengine.af, win32/pswtool.konboot.a |
Linear-Darstellung
