| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: "Obrona VPN Deals" loswerdenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
03.11.2014, 19:56
| #1 |
 |  "Obrona VPN Deals" loswerden Guten Abend, ich habe seit gestern unglaublich nervige und viele Anzeigen wie in dem mit angehängten Beispiel. Vermutlich ist der Virus/Trojaner (weiß es nicht genau) beim Installieren von LoLReplay (um Wiederholungen meiner Spiele aufzunehmen) auf meinen PC gekommen, habe von dieser Seite League Replays | Download the LOL Replay Client das Programm geladen. Hatte außerdem gestern Abend noch den snap.do Trojaner mit aufgenommen, welchen ich aber mittlerweile (hoffentlich komplett) entfernt habe. Unter anderem mit Hilfe des "Revo Uninstaller", da er über Windows nicht entfernbar war. Habe dann vorhin versucht mittels Malwarebytes Anti-Malware (welchen ich nur über das Erstellen eines zweiten Kontos installieren konnte) den Obrona VPN Deals Virus zu löschen, jedoch wurde nichts gefunden. Die lästigen Einblendungen sind aber immernoch da. Die Ausgegebene Log Datei habe ich außerdem hinzugefügt. |
|
03.11.2014, 21:05
| #2 |
| /// TB-Ausbilder   | "Obrona VPN Deals" loswerden Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Danke für deine Mitarbeit! Wir beginnen die erste Analyse mit FRST: Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
|
03.11.2014, 21:36
| #3 |
| | "Obrona VPN Deals" loswerden Danke für deine Hilfe.
__________________Hier die beiden Dateien: Die FRST Datei: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-11-2014 Ran by psx1_000 (administrator) on ABD-ALLA-PC on 03-11-2014 21:29:28 Running from C:\Users\psx1_000\Downloads Loaded Profile: psx1_000 (Available profiles: Mustafa & Mona & UpdatusUser & psx1_000) Platform: Windows 8 Pro (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 10 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (AMD) C:\Windows\System32\atiesrxx.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe () C:\Program Files (x86)\Dypheckolshing\Dypheckolshing.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe () C:\Program Files (x86)\Dypheckolshing\HttpsProxy.exe (Motorola) C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe () C:\Program Files (x86)\Dypheckolshing\DypheckolshingHelper.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.17074_none_6233bc1f5106b696\TiWorker.exe (AMD) C:\Windows\System32\atieclxx.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.) Startup: C:\Users\Mona\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Curse.lnk ShortcutTarget: Curse.lnk -> C:\Users\psx1_000\AppData\Roaming\Curse Client\Bin\Curse.exe (No File) Startup: C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\psx1_000\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File) Startup: C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyEnable: Internet Explorer proxy is enabled. ProxyServer: http=127.0.0.1:9880;https=127.0.0.1:9880 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8FA16C3283F7CF01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll () FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-09-25] Chrome: ======= ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 Dypheckolshing; C:\Program Files (x86)\Dypheckolshing\Dypheckolshing.exe [4383192 2014-10-27] () S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation) R2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [121144 2013-03-25] (Motorola Mobility LLC) S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation) R2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [File not signed] S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21600 2013-03-29] (Advanced Micro Devices, Inc.) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices) S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider) R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2013-01-01] (DT Soft Ltd) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-03] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-03 21:29 - 2014-11-03 21:30 - 00013367 _____ () C:\Users\psx1_000\Downloads\FRST.txt 2014-11-03 21:29 - 2014-11-03 21:29 - 02114560 _____ (Farbar) C:\Users\psx1_000\Downloads\FRST64.exe 2014-11-03 21:29 - 2014-11-03 21:29 - 00000000 ____D () C:\FRST 2014-11-03 21:22 - 2014-11-03 21:22 - 00364247 _____ () C:\Users\Mustafa\Downloads\FRST64.exe 2014-11-03 19:54 - 2014-11-03 19:54 - 00001555 _____ () C:\trojaner.txt 2014-11-03 19:31 - 2014-11-03 19:31 - 00000000 ____D () C:\Users\Mustafa\Documents\FickVirus 2014-11-03 17:31 - 2014-11-03 21:27 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-11-03 17:31 - 2014-11-03 17:31 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-11-03 17:31 - 2014-11-03 17:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-11-03 17:30 - 2014-11-03 17:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-11-03 17:30 - 2014-11-03 17:30 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-11-03 17:30 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-11-03 17:30 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2014-11-03 17:30 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-11-03 17:28 - 2014-11-03 17:28 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Macromedia 2014-11-03 17:25 - 2014-11-03 17:25 - 00002247 _____ () C:\Users\psx1_000\Desktop\Google Chrome.lnk 2014-11-03 17:25 - 2014-11-03 17:25 - 00001438 _____ () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-11-03 17:25 - 2014-11-03 17:25 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Adobe 2014-11-03 17:25 - 2014-11-03 17:25 - 00000000 ____D () C:\Users\psx1_000\AppData\Local\Google 2014-11-03 17:24 - 2014-11-03 18:13 - 00000000 ____D () C:\Users\psx1_000 2014-11-03 17:24 - 2014-11-03 17:30 - 00000000 ____D () C:\Users\psx1_000\AppData\Local\Packages 2014-11-03 17:24 - 2014-11-03 17:24 - 00000020 ___SH () C:\Users\psx1_000\ntuser.ini 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Vorlagen 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Startmenü 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Netzwerkumgebung 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Lokale Einstellungen 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Eigene Dateien 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Druckumgebung 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Documents\Eigene Musik 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Documents\Eigene Bilder 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\AppData\Local\Verlauf 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\AppData\Local\Anwendungsdaten 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Anwendungsdaten 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Motorola Mobility 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 ____D () C:\Users\psx1_000\AppData\Local\VirtualStore 2014-11-03 17:24 - 2014-07-12 13:08 - 00000000 ___RD () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-11-03 17:24 - 2014-05-17 01:03 - 00000000 ___RD () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-11-03 17:24 - 2012-07-26 09:13 - 00000000 ___RD () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-11-03 17:24 - 2012-07-26 09:13 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-11-03 17:11 - 2014-11-03 17:11 - 03377046 _____ (Malwarebytes Corporation ) C:\Users\Mustafa\Downloads\mbam-setup-2.0.2.1012.exe 2014-11-03 17:09 - 2014-11-03 17:09 - 09581416 _____ (Malwarebytes Corporation ) C:\Users\Mustafa\Downloads\mbam-setup-2.0.3.1025(1).exe 2014-11-03 17:02 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\SysWOW64\sqlite3.dll 2014-11-03 17:00 - 2014-11-03 17:00 - 01375089 _____ () C:\Users\Mustafa\Downloads\adwcleaner_3.311.exe 2014-11-03 01:25 - 2014-11-03 01:25 - 00761999 _____ () C:\Users\Mustafa\Downloads\esetsmartinstaller_deu.exe 2014-11-03 01:11 - 2014-11-03 01:11 - 00001264 _____ () C:\Users\Mustafa\Desktop\Revo Uninstaller.lnk 2014-11-03 01:11 - 2014-11-03 01:11 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-11-03 01:09 - 2014-11-03 01:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Mustafa\Downloads\revosetup95.exe 2014-11-03 01:01 - 2014-11-03 17:02 - 00000000 ____D () C:\AdwCleaner 2014-11-03 01:01 - 2014-11-03 01:01 - 01998336 _____ () C:\Users\Mustafa\Downloads\AdwCleaner_4.002.exe 2014-11-03 00:59 - 2014-11-03 01:00 - 06779113 _____ (Malwarebytes Corporation ) C:\Users\Mustafa\Downloads\mbam-setup-2.0.3.1025.exe 2014-11-02 21:37 - 2014-11-02 21:37 - 00001160 _____ () C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-11-02 15:28 - 2014-11-02 23:00 - 00001079 _____ () C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2014-11-02 15:28 - 2014-11-02 23:00 - 00001049 _____ () C:\Users\Mustafa\Desktop\Search.lnk 2014-11-02 15:26 - 2014-11-02 15:26 - 00000000 __SHD () C:\Program Files (x86)\Dypheckolshing 2014-10-28 21:27 - 2014-10-31 18:30 - 00000000 ____D () C:\Users\Mustafa\Documents\Makroökonomie 2014-10-28 20:38 - 2014-10-29 20:06 - 00000000 ____D () C:\WINDOWS\system32\AutoUpdateLicense 2014-10-28 19:44 - 2014-10-22 04:34 - 00010777 _____ () C:\WINDOWS\system32\AutoconfigV2.cab 2014-10-28 19:44 - 2014-10-22 04:33 - 00581016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AutoUpdate.exe 2014-10-28 19:44 - 2014-10-22 04:33 - 00462760 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe 2014-10-28 19:44 - 2014-10-22 02:08 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll 2014-10-28 19:44 - 2014-10-22 02:08 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-10-28 19:44 - 2014-10-22 02:01 - 00695808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll 2014-10-28 19:44 - 2014-10-22 02:01 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll 2014-10-28 19:44 - 2014-10-22 02:01 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-10-28 19:44 - 2014-10-22 02:00 - 00125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll 2014-10-20 22:45 - 2014-10-20 22:45 - 00279408 _____ () C:\WINDOWS\Minidump\102014-20982-01.dmp 2014-10-19 22:43 - 2014-10-26 13:02 - 00004682 _____ () C:\WINDOWS\comsetup.log 2014-10-19 15:05 - 2014-10-19 15:05 - 00279408 _____ () C:\WINDOWS\Minidump\101914-23758-01.dmp 2014-10-19 14:44 - 2014-10-19 14:44 - 00329016 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-10-19 09:01 - 2014-09-29 23:49 - 00705480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-10-19 09:01 - 2014-09-29 23:49 - 00104904 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2014-10-15 14:35 - 2014-07-12 05:41 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRUM.DLL 2014-10-15 14:35 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDYAK.DLL 2014-10-15 14:35 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDTAT.DLL 2014-10-15 14:35 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU1.DLL 2014-10-15 14:35 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU.DLL 2014-10-15 14:35 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDBASH.DLL 2014-10-15 14:35 - 2014-07-12 05:16 - 00008192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRUM.DLL 2014-10-15 14:35 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDYAK.DLL 2014-10-15 14:35 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDTAT.DLL 2014-10-15 14:35 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU1.DLL 2014-10-15 14:35 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU.DLL 2014-10-15 14:35 - 2014-07-12 05:15 - 00006144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDBASH.DLL 2014-10-15 14:35 - 2014-07-12 01:02 - 00478352 _____ () C:\WINDOWS\SysWOW64\locale.nls 2014-10-15 14:35 - 2014-07-12 01:00 - 00478352 _____ () C:\WINDOWS\system32\locale.nls 2014-10-15 14:35 - 2014-07-08 23:33 - 00181248 _____ (Microsoft Corp.) C:\WINDOWS\system32\Defrag.exe 2014-10-15 14:35 - 2014-07-08 23:32 - 01539584 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll 2014-10-15 14:35 - 2014-07-08 23:32 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll 2014-10-15 14:35 - 2014-07-08 23:30 - 01220608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll 2014-10-15 14:35 - 2014-07-07 06:52 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll 2014-10-15 14:35 - 2014-07-07 06:52 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll 2014-10-15 14:35 - 2014-07-04 11:52 - 00328000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys 2014-10-15 14:35 - 2014-07-03 02:59 - 01824784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2014-10-15 14:35 - 2014-07-03 01:30 - 01408952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2014-10-15 14:35 - 2014-06-28 08:01 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmapi.dll 2014-10-15 14:35 - 2014-06-28 07:57 - 00209920 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2014-10-15 14:35 - 2014-06-28 07:56 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmapi.dll 2014-10-15 14:35 - 2014-06-25 08:09 - 00733184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll 2014-10-15 14:35 - 2014-06-25 08:07 - 01023488 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll 2014-10-15 14:35 - 2014-06-18 00:27 - 02032640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll 2014-10-15 14:35 - 2014-06-18 00:23 - 02238464 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll 2014-10-15 14:35 - 2014-06-11 15:47 - 02842112 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVDECOD.DLL 2014-10-15 14:35 - 2014-06-11 05:40 - 02620928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVDECOD.DLL 2014-10-15 14:35 - 2014-06-10 23:44 - 01403896 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2014-10-15 14:35 - 2014-05-30 00:31 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll 2014-10-15 14:35 - 2014-05-30 00:03 - 00419328 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll 2014-10-15 14:35 - 2014-02-04 11:57 - 01271664 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2014-10-15 14:33 - 2014-09-13 06:29 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll 2014-10-15 14:33 - 2014-09-13 05:02 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll 2014-10-15 14:32 - 2014-07-07 06:51 - 05982208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2014-10-15 14:32 - 2014-07-07 05:00 - 05095424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2014-10-15 14:31 - 2014-09-28 05:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2014-10-15 14:31 - 2014-09-20 06:16 - 19280896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-10-15 14:31 - 2014-09-20 04:57 - 14368768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-10-15 14:31 - 2014-07-07 06:53 - 01125376 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe 2014-10-15 14:31 - 2014-07-07 06:52 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2014-10-15 14:31 - 2014-07-07 06:52 - 00724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll 2014-10-15 14:31 - 2014-07-07 06:52 - 00300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsta.dll 2014-10-15 14:31 - 2014-07-07 05:01 - 01049600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe 2014-10-15 14:31 - 2014-07-07 05:01 - 00233472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winsta.dll 2014-10-15 14:31 - 2014-07-07 04:59 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aaclient.dll 2014-10-15 14:30 - 2014-10-10 05:47 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll 2014-10-15 14:30 - 2014-10-10 05:47 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2014-10-15 14:30 - 2014-10-08 05:26 - 00556544 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2014-10-15 14:30 - 2014-09-20 06:18 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2014-10-15 14:30 - 2014-09-20 06:17 - 02236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2014-10-15 14:30 - 2014-09-20 06:17 - 01407488 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2014-10-15 14:30 - 2014-09-20 06:17 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll 2014-10-15 14:30 - 2014-09-20 06:17 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 15399424 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 02655232 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00255488 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll 2014-10-15 14:30 - 2014-09-20 06:15 - 01508864 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2014-10-15 14:30 - 2014-09-20 06:15 - 00451584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll 2014-10-15 14:30 - 2014-09-20 06:15 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 13757952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 02861568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 02055168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 01762816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 01180672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll 2014-10-15 14:30 - 2014-09-20 04:56 - 01440768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2014-10-15 14:30 - 2014-09-20 04:56 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll 2014-10-15 14:30 - 2014-09-20 04:56 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2014-10-15 14:30 - 2014-09-20 04:38 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb 2014-10-15 14:30 - 2014-09-20 04:33 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb 2014-10-15 14:30 - 2014-09-20 02:06 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll 2014-10-15 14:30 - 2014-09-03 03:48 - 00510464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll 2014-10-15 14:30 - 2014-09-03 03:21 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll 2014-10-15 14:30 - 2014-07-24 14:50 - 00447296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS 2014-10-15 14:30 - 2014-07-16 23:59 - 00305664 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvsvc.dll 2014-10-15 14:30 - 2014-07-12 07:45 - 01549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll 2014-10-15 14:30 - 2014-07-12 05:36 - 00674304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys 2014-10-15 14:30 - 2014-07-12 05:36 - 00211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys 2014-10-15 14:30 - 2014-07-12 05:34 - 00404480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys 2014-10-15 14:30 - 2014-07-12 05:34 - 00250368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys 2014-10-15 14:30 - 2014-06-28 07:57 - 01341952 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll 2014-10-15 14:30 - 2014-06-28 03:23 - 01126400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll 2014-10-15 14:29 - 2014-09-17 23:56 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll 2014-10-15 14:29 - 2014-08-30 06:48 - 10115072 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2014-10-15 14:29 - 2014-08-30 06:46 - 02306560 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2014-10-15 14:29 - 2014-08-30 05:05 - 08858112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2014-10-15 14:29 - 2014-08-01 23:08 - 00388729 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2014-10-15 14:29 - 2014-07-17 00:28 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sscore.dll 2014-10-15 14:29 - 2014-07-16 23:59 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\sscore.dll 2014-10-15 14:29 - 2014-06-13 00:29 - 02146304 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll 2014-10-15 14:28 - 2014-09-18 00:24 - 02416128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll 2014-10-15 14:28 - 2014-08-30 05:03 - 02037760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2014-10-15 14:28 - 2014-06-13 00:34 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-03 21:27 - 2012-12-01 20:12 - 00001138 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-11-03 21:26 - 2013-11-13 19:25 - 00000000 ___RD () C:\Users\Mustafa\Dropbox 2014-11-03 21:24 - 2012-11-08 21:01 - 01498280 _____ () C:\WINDOWS\WindowsUpdate.log 2014-11-03 21:24 - 2012-10-09 01:33 - 00000000 ____D () C:\Users\Mustafa\Desktop\Alte Firefox-Daten 2014-11-03 21:16 - 2012-12-01 20:12 - 00001142 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-11-03 21:02 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2014-11-03 20:39 - 2012-11-08 23:24 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-11-03 20:03 - 2012-11-08 22:00 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1185304261-293873223-3258998266-1001 2014-11-03 20:00 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-11-03 18:29 - 2012-07-26 11:27 - 05112182 _____ () C:\WINDOWS\system32\perfh007.dat 2014-11-03 18:29 - 2012-07-26 11:27 - 01508710 _____ () C:\WINDOWS\system32\perfc007.dat 2014-11-03 18:29 - 2012-07-26 08:28 - 00005430 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-11-03 18:17 - 2014-05-31 12:14 - 00000000 ____D () C:\Users\Mustafa\Documents\Speißeplän Recycling 2014-11-03 18:13 - 2013-11-13 19:22 - 00000000 ____D () C:\Users\Mustafa\AppData\Roaming\Dropbox 2014-11-03 18:13 - 2013-06-25 02:05 - 00000000 ____D () C:\Temp 2014-11-03 17:59 - 2012-11-08 22:01 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-11-03 17:59 - 2012-11-08 20:53 - 00036650 _____ () C:\WINDOWS\PFRO.log 2014-11-03 17:59 - 2012-07-26 09:12 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel 2014-11-03 17:59 - 2012-07-26 08:22 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-11-03 17:58 - 2012-07-26 06:26 - 01048576 ___SH () C:\WINDOWS\system32\config\BBI 2014-11-03 17:35 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\AUInstallAgent 2014-11-03 17:26 - 2012-11-08 21:54 - 00000000 ____D () C:\WINDOWS\System32\Tasks\WPD 2014-11-03 01:28 - 2014-09-25 11:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-03 00:27 - 2012-11-08 23:43 - 00000000 ____D () C:\Users\Mustafa\AppData\Roaming\TS3Client 2014-11-02 22:19 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\rescache 2014-11-01 01:56 - 2013-10-29 17:38 - 00000000 ____D () C:\Users\Mustafa\AppData\Local\Battle.net 2014-10-31 18:31 - 2013-11-11 02:04 - 00000000 ____D () C:\Users\Mustafa\Documents\Messtechnik 2014-10-30 12:25 - 2012-11-10 11:01 - 00275080 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2014-10-29 19:14 - 2013-10-29 17:39 - 00000000 ____D () C:\Program Files (x86)\Hearthstone 2014-10-28 20:38 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\WinStore 2014-10-26 17:22 - 2014-09-24 16:19 - 00000000 ___HD () C:\$Windows.~BT 2014-10-26 13:06 - 2012-11-08 20:57 - 00152403 _____ () C:\WINDOWS\diagwrn.xml 2014-10-26 13:06 - 2012-11-08 20:57 - 00152403 _____ () C:\WINDOWS\diagerr.xml 2014-10-26 13:06 - 2012-07-26 08:21 - 02045102 _____ () C:\WINDOWS\setupact.log 2014-10-26 13:05 - 2012-07-26 09:13 - 00003856 _____ () C:\WINDOWS\DtcInstall.log 2014-10-26 12:58 - 2012-11-08 21:55 - 00019976 _____ () C:\WINDOWS\system32\lvcoinst.log 2014-10-25 23:09 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\Registration 2014-10-25 01:17 - 2013-10-29 17:38 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-10-20 22:45 - 2012-11-09 23:51 - 381125224 _____ () C:\WINDOWS\MEMORY.DMP 2014-10-20 22:45 - 2012-11-09 23:51 - 00000000 ____D () C:\WINDOWS\Minidump 2014-10-19 22:48 - 2012-07-26 06:26 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-10-19 08:58 - 2012-11-08 22:10 - 00000000 ____D () C:\Program Files (x86)\Pando Networks 2014-10-19 01:29 - 2014-07-12 13:08 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel 2014-10-19 01:29 - 2012-07-26 09:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2014-10-19 01:28 - 2012-07-26 09:12 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-10-18 12:11 - 2012-12-01 20:12 - 00004114 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2014-10-18 12:11 - 2012-12-01 20:12 - 00003878 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2014-10-17 15:12 - 2013-07-29 02:05 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-10-17 14:47 - 2012-12-12 21:30 - 103265616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe Some content of TEMP: ==================== C:\Users\Mustafa\AppData\Local\Temp\BlockAds.exe C:\Users\Mustafa\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpr4_efr.dll C:\Users\Mustafa\AppData\Local\Temp\fdminst.exe C:\Users\Mustafa\AppData\Local\Temp\i4jdel0.exe C:\Users\Mustafa\AppData\Local\Temp\MotoCast_Installer_2.0309.exe C:\Users\Mustafa\AppData\Local\Temp\MotorolaDeviceManager_2.0403.exe C:\Users\Mustafa\AppData\Local\Temp\npp.6.2.2.Installer.exe C:\Users\Mustafa\AppData\Local\Temp\nv3DVStreaming.dll C:\Users\Mustafa\AppData\Local\Temp\nvSCPAPI.dll C:\Users\Mustafa\AppData\Local\Temp\nvSCPAPI64.dll C:\Users\Mustafa\AppData\Local\Temp\nvStereoApiI.dll C:\Users\Mustafa\AppData\Local\Temp\nvStInit.dll C:\Users\Mustafa\AppData\Local\Temp\nvStInit64.dll C:\Users\Mustafa\AppData\Local\Temp\nvStInst.exe C:\Users\Mustafa\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe C:\Users\Mustafa\AppData\Local\Temp\SkypeSetup.exe C:\Users\Mustafa\AppData\Local\Temp\sqlite3.dll C:\Users\Mustafa\AppData\Local\Temp\swt-win32-3740.dll C:\Users\Mustafa\AppData\Local\Temp\uninst1.exe C:\Users\Mustafa\AppData\Local\Temp\xmlUpdater.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-28 20:36 ==================== End Of Log ============================ Die Additiondatei: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-11-2014
Ran by psx1_000 at 2014-11-03 21:30:41
Running from C:\Users\psx1_000\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Botanicula (HKLM-x32\...\Botanicula_is1) (Version: - )
Curse (HKLM-x32\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 6.0.0.0 - Curse)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.46.1.0327 - DT Soft Ltd)
Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve)
Free YouTube to MP3 Converter version 3.12.20.1230 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.20.1230 - DVDVideoSoft Ltd.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Gone Home version 0.0.0.9 (HKLM-x32\...\Gone Home_is1) (Version: 0.0.0.9 - WaLMaRT)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
IsoBuster 3.2 (HKLM-x32\...\IsoBuster_is1) (Version: 3.2 - Smart Projects)
Java 7 Update 9 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417009FF}) (Version: 7.0.90 - Oracle)
Java 7 Update 9 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217009FF}) (Version: 7.0.90 - Oracle)
Java SE Development Kit 7 Update 9 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170090}) (Version: 1.7.0.90 - Oracle)
JDownloader 2 (HKLM-x32\...\0630-0716-3135-7887) (Version: 2 - AppWork GmbH)
K-Lite Codec Pack 10.0.5 Standard (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.0.5 - )
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office Standard Edition 2003 (HKLM-x32\...\{91120407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
MiKTeX 2.9 (HKLM\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Motorola Device Manager (HKLM-x32\...\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.3.9 - Motorola Mobility)
Motorola Device Software Update (x32 Version: 13.02.1402 - Motorola Mobility) Hidden
Motorola Mobile Drivers Installation 6.0.0 (Version: 6.0.0 - Motorola Inc.) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.2.1 - )
NVIDIA 3D Vision Controller-Treiber 310.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 310.70 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.1031 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Peggle Deluxe (HKLM-x32\...\Peggle Deluxe) (Version: - PopCap Games)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Pokémon Trading Card Game Online (HKLM-x32\...\{496D7B7E-EBDC-4E2B-B021-4FF03B188B69}) (Version: 1.0.0 - The Pokémon Company International)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
scilab-5.4.1 (64-bit) (HKLM\...\scilab-5.4.1 (64-bit)_is1) (Version: - Scilab Enterprises)
SIMetrix Intro (HKLM-x32\...\{5BFD23B6-8060-11DB-96A4-00E08161165F}) (Version: 5.3 - )
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeXnicCenter Version 2.02 Stable (HKLM\...\TeXnicCenter_is1) (Version: 2.02 Stable - The TeXnicCenter Team)
VLC media player 2.0.4 (HKLM-x32\...\VLC media player) (Version: 2.0.4 - VideoLAN)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
XnView 2.03 (HKLM-x32\...\XnView_is1) (Version: 2.03 - Gougelet Pierre-e)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
25-10-2014 13:12:03 Geplanter Prüfpunkt
28-10-2014 19:33:34 Windows Update
03-11-2014 00:14:55 Revo Uninstaller's restore point - Shopping Helper Smartbar
03-11-2014 01:04:05 Wiederherstellungsvorgang
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2766B33F-F759-4DE1-8855-886D9A9D6B98} - System32\Tasks\Motorola Device Manager Engine => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-03-25] ()
Task: {7578D177-23EA-4BD9-9EF0-93F4EB6CFA9D} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-12] (Adobe Systems Incorporated)
Task: {7EB66830-EC26-4A61-A206-642984E10A9C} - System32\Tasks\Motorola Device Manager Initial Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-03-25] ()
Task: {7FACC369-E6EB-48B0-8938-50C086481287} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-01] (Google Inc.)
Task: {9D07BEEE-3ED6-465C-BC27-4516CF80C1A2} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install ping => C:\Windows\system32\AutoUpdate.exe [2014-10-22] (Microsoft Corporation)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {A81F3819-44A3-432B-85C5-E4521D5259D4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-01] (Google Inc.)
Task: {ADC8854E-100B-4E6F-9E87-02447746E27D} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install v2 => C:\WINDOWS\system32\AutoUpdate.exe [2014-10-22] (Microsoft Corporation)
Task: {C65DFB89-9E9F-4870-AADC-880BDD853B9D} - System32\Tasks\Motorola Device Manager Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-03-25] ()
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {C84F8A44-9FD3-4273-930B-E488674D2812} - System32\Tasks\Microsoft\Windows\Application Experience\AitAgent => aitagent.exe
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {F1B0B509-9478-4AB2-A8CD-A6E9BE3E7C90} - System32\Tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask => BthUdTask.exe
Task: {F848DA13-DB18-47E6-80AC-F1C519CBA19C} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-10-17] (Microsoft Corporation)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-11-02 15:26 - 2014-10-27 09:56 - 04383192 ___SH () C:\Program Files (x86)\Dypheckolshing\Dypheckolshing.exe
2014-11-02 15:26 - 2014-10-27 09:56 - 00417752 ___SH () C:\Program Files (x86)\Dypheckolshing\HttpsProxy.exe
2014-11-02 15:26 - 2014-11-02 15:26 - 00160728 ____R () C:\Program Files (x86)\Dypheckolshing\DypheckolshingHelper.exe
2014-11-02 15:26 - 2014-03-07 19:56 - 00117262 ___SH () C:\Program Files (x86)\Dypheckolshing\libgcc_s_dw2-1.dll
2014-11-02 15:26 - 2014-03-07 19:56 - 00970766 ___SH () C:\Program Files (x86)\Dypheckolshing\libstdc++-6.dll
2013-03-25 20:44 - 2013-03-25 20:44 - 00172032 _____ () C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\css_core.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Mona\Desktop\Bild (11).jpg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Mona\Desktop\Bild (11).jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "StartCCC"
========================= Accounts: ==========================
Administrator (S-1-5-21-1185304261-293873223-3258998266-500 - Administrator - Disabled)
Gast (S-1-5-21-1185304261-293873223-3258998266-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1185304261-293873223-3258998266-1002 - Limited - Enabled)
Mona (S-1-5-21-1185304261-293873223-3258998266-1003 - Limited - Enabled) => C:\Users\Mona
Mustafa (S-1-5-21-1185304261-293873223-3258998266-1001 - Administrator - Enabled) => C:\Users\Mustafa
psx1_000 (S-1-5-21-1185304261-293873223-3258998266-1005 - Administrator - Enabled) => C:\Users\psx1_000
UpdatusUser (S-1-5-21-1185304261-293873223-3258998266-1004 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: Videocontroller für Multimedia
Description: Videocontroller für Multimedia
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Coprozessor
Description: Coprozessor
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (11/03/2014 06:14:10 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/03/2014 06:12:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ABD-ALLA-PC)
Description: Die App „Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (11/03/2014 06:12:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ABD-ALLA-PC)
Description: Bei der Aktivierung der App „Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing“ ist folgender Fehler aufgetreten: -2147467259. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/03/2014 06:09:42 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ABD-ALLA-PC)
Description: Die App „Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (11/03/2014 06:09:39 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ABD-ALLA-PC)
Description: Die App „Microsoft.BingMaps_8wekyb3d8bbwe!AppexMaps“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (11/03/2014 06:09:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ABD-ALLA-PC)
Description: Bei der Aktivierung der App „Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing“ ist folgender Fehler aufgetreten: -2147467259. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/03/2014 06:07:31 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ABD-ALLA-PC)
Description: Die App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Calendar“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
System errors:
=============
Error: (11/03/2014 09:26:27 PM) (Source: DCOM) (EventID: 10010) (User: Abd-Alla-PC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (11/03/2014 09:26:27 PM) (Source: DCOM) (EventID: 10010) (User: Abd-Alla-PC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (11/03/2014 06:02:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (11/03/2014 06:02:07 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (11/03/2014 06:00:41 PM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "C:" wurde eine Beschädigung erkannt.
Die Masterdateitabelle (MFT) beinhaltet einen beschädigten Dateidatensatz. Die Dateireferenznummer ist 0x20000000005ba3. Der Name der Datei ist "\Windows\System32\LogFiles\SQM\SQMLogger.etl.008".
Error: (11/03/2014 05:58:36 PM) (Source: DCOM) (EventID: 10010) (User: ABD-ALLA-PC)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (11/03/2014 05:26:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (11/03/2014 05:26:23 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (11/03/2014 05:23:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CouponArificService64" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/03/2014 05:22:21 PM) (Source: DCOM) (EventID: 10010) (User: Abd-Alla-PC)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
Microsoft Office Sessions:
=========================
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F2030000E5050000
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance163707000000000000000000008F020000
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance163707000000000000000000008F020000
Error: (11/03/2014 06:14:10 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/03/2014 06:12:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ABD-ALLA-PC)
Description: Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing
Error: (11/03/2014 06:12:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ABD-ALLA-PC)
Description: Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing-2147467259
Error: (11/03/2014 06:09:42 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ABD-ALLA-PC)
Description: Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing
Error: (11/03/2014 06:09:39 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ABD-ALLA-PC)
Description: Microsoft.BingMaps_8wekyb3d8bbwe!AppexMaps
Error: (11/03/2014 06:09:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ABD-ALLA-PC)
Description: Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing-2147467259
Error: (11/03/2014 06:07:31 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ABD-ALLA-PC)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Calendar
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Quad CPU Q8200 @ 2.33GHz
Percentage of memory in use: 44%
Total physical RAM: 4094.99 MB
Available physical RAM: 2292 MB
Total Pagefile: 8191.24 MB
Available Pagefile: 6211.5 MB
Total Virtual: 8192 MB
Available Virtual: 8191.76 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:1220.5 GB) (Free:840.51 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397.3 GB) (Disk ID: FCD6DD83)
Partition 1: (Not Active) - (Size=11.7 GB) - (Type=27)
Partition 2: (Active) - (Size=164.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1220.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
04.11.2014, 14:33
| #4 | |
| /// TB-Ausbilder | "Obrona VPN Deals" loswerden Servus, wenn möglich, bitte alles im infizierten Benutzerkonto laufen lassen. Schritt 1 Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.
Schritt 2 Scan mit Combofix
Bitte poste mit deiner nächsten Antwort
|
|
04.11.2014, 20:04
| #5 |
| | "Obrona VPN Deals" loswerden Guten Tag, habe den Link nach der Virustotal Überprüfung hier: https://www.virustotal.com/de/file/268fa4399bf2b39febc535bd31ef297c9c9b703561a116f8722391dd0bf1da70/analysis/1415126120/ So wie die Log Datei von Combofix: Code:
ATTFilter ComboFix 14-10-29.01 - Mustafa 04.11.2014 19:49:40.1.4 - x64
Microsoft Windows 8 Pro 6.2.9200.0.1252.49.1031.18.4095.1738 [GMT 1:00]
ausgeführt von:: c:\users\Mustafa\Desktop\ComboFix.exe
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe
c:\users\Mustafa\Documents\~WRL0003.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-10-04 bis 2014-11-04 ))))))))))))))))))))))))))))))
.
.
2014-11-04 19:00 . 2014-11-04 19:00 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-11-04 19:00 . 2014-11-04 19:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-11-04 19:00 . 2014-11-04 19:00 -------- d-----w- c:\users\Mona\AppData\Local\temp
2014-11-04 18:42 . 2014-10-14 19:59 11627712 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7A285AA0-FCE8-4BEE-ACC0-F3E923DA0391}\mpengine.dll
2014-11-03 20:29 . 2014-11-03 20:31 -------- d-----w- C:\FRST
2014-11-03 16:31 . 2014-11-04 18:31 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-11-03 16:30 . 2014-11-03 16:31 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2014-11-03 16:30 . 2014-11-03 16:30 -------- d-----w- c:\programdata\Malwarebytes
2014-11-03 16:30 . 2014-10-01 10:11 64216 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-11-03 16:30 . 2014-10-01 10:11 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-11-03 16:30 . 2014-10-01 10:11 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-11-03 16:24 . 2014-11-03 17:13 -------- d-----w- c:\users\psx1_000
2014-11-03 16:02 . 2010-08-30 07:34 536576 ----a-w- c:\windows\SysWow64\sqlite3.dll
2014-11-03 00:11 . 2014-11-03 00:11 -------- d-----w- c:\program files (x86)\VS Revo Group
2014-11-03 00:01 . 2014-11-03 16:02 -------- d-----w- C:\AdwCleaner
2014-11-02 14:26 . 2014-11-02 14:26 -------- d-sh--w- c:\program files (x86)\Dypheckolshing
2014-10-28 19:38 . 2014-10-29 19:06 -------- d-----w- c:\windows\system32\AutoUpdateLicense
2014-10-28 18:44 . 2014-10-22 03:33 462760 ----a-w- c:\windows\system32\NotificationUI.exe
2014-10-28 18:44 . 2014-10-22 03:33 581016 ----a-w- c:\windows\system32\AutoUpdate.exe
2014-10-28 18:44 . 2014-10-22 01:01 695808 ----a-w- c:\windows\system32\WSShared.dll
2014-10-28 18:44 . 2014-10-22 01:01 198656 ----a-w- c:\windows\system32\Windows.ApplicationModel.Store.dll
2014-10-28 18:44 . 2014-10-22 01:01 163840 ----a-w- c:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-28 18:44 . 2014-10-22 01:08 568832 ----a-w- c:\windows\SysWow64\WSShared.dll
2014-10-28 18:44 . 2014-10-22 01:08 124928 ----a-w- c:\windows\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-28 18:44 . 2014-10-22 01:00 125952 ----a-w- c:\windows\system32\WinSetupUI.dll
2014-10-22 09:23 . 2014-11-04 18:44 269992 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10248.bin
2014-10-19 08:01 . 2014-09-29 22:49 705480 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-10-19 08:01 . 2014-09-29 22:49 104904 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-10-15 13:33 . 2014-09-13 05:29 79360 ----a-w- c:\windows\system32\packager.dll
2014-10-15 13:33 . 2014-09-13 04:02 68096 ----a-w- c:\windows\SysWow64\packager.dll
2014-10-15 13:32 . 2014-07-07 05:51 5982208 ----a-w- c:\windows\system32\mstscax.dll
2014-10-15 13:32 . 2014-07-07 04:00 5095424 ----a-w- c:\windows\SysWow64\mstscax.dll
2014-10-15 13:31 . 2014-07-07 05:52 724992 ----a-w- c:\windows\system32\termsrv.dll
2014-10-15 13:31 . 2014-07-07 05:52 3248128 ----a-w- c:\windows\system32\rdpcorets.dll
2014-10-15 13:31 . 2014-07-07 05:53 1125376 ----a-w- c:\windows\system32\mstsc.exe
2014-10-15 13:31 . 2014-07-07 05:52 300544 ----a-w- c:\windows\system32\winsta.dll
2014-10-15 13:31 . 2014-07-07 04:01 1049600 ----a-w- c:\windows\SysWow64\mstsc.exe
2014-10-15 13:31 . 2014-07-07 04:01 233472 ----a-w- c:\windows\SysWow64\winsta.dll
2014-10-15 13:31 . 2014-07-07 03:59 269312 ----a-w- c:\windows\SysWow64\aaclient.dll
2014-10-15 13:31 . 2014-09-28 04:18 4068352 ----a-w- c:\windows\system32\win32k.sys
2014-10-15 13:31 . 2014-09-20 05:16 19280896 ----a-w- c:\windows\system32\mshtml.dll
2014-10-15 13:29 . 2014-07-16 23:28 27648 ----a-w- c:\windows\SysWow64\sscore.dll
2014-10-15 13:29 . 2014-07-16 22:59 35840 ----a-w- c:\windows\system32\sscore.dll
2014-10-15 13:29 . 2014-08-30 05:48 10115072 ----a-w- c:\windows\system32\twinui.dll
2014-10-15 13:29 . 2014-09-17 22:56 2885120 ----a-w- c:\windows\system32\msi.dll
2014-10-15 13:29 . 2014-08-30 05:46 2306560 ----a-w- c:\windows\system32\authui.dll
2014-10-15 13:29 . 2014-08-30 04:05 8858112 ----a-w- c:\windows\SysWow64\twinui.dll
2014-10-15 13:29 . 2014-06-12 23:29 2146304 ----a-w- c:\windows\system32\actxprxy.dll
2014-10-15 13:28 . 2014-09-17 23:24 2416128 ----a-w- c:\windows\SysWow64\msi.dll
2014-10-15 13:28 . 2014-06-12 23:34 754176 ----a-w- c:\windows\SysWow64\actxprxy.dll
2014-10-15 13:28 . 2014-08-30 04:03 2037760 ----a-w- c:\windows\SysWow64\authui.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-30 11:25 . 2012-11-10 10:01 275080 ------w- c:\windows\system32\MpSigStub.exe
2014-10-17 13:47 . 2012-12-12 20:30 103265616 ----a-w- c:\windows\system32\MRT.exe
2014-08-31 09:03 . 2012-07-26 08:13 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-28 11:34 . 2014-09-16 15:58 59400 ----a-w- c:\windows\system32\wuauclt.exe
2014-08-28 06:05 . 2014-09-16 15:58 35328 ----a-w- c:\windows\SysWow64\wuapp.exe
2014-08-28 06:05 . 2014-09-16 15:58 630272 ----a-w- c:\windows\SysWow64\wuapi.dll
2014-08-28 06:05 . 2014-09-16 15:58 86528 ----a-w- c:\windows\SysWow64\wudriver.dll
2014-08-28 06:05 . 2014-09-16 15:58 128000 ----a-w- c:\windows\SysWow64\wuwebv.dll
2014-08-28 06:02 . 2014-09-16 15:58 40448 ----a-w- c:\windows\system32\wuapp.exe
2014-08-28 06:01 . 2014-09-16 15:58 144384 ----a-w- c:\windows\system32\wuwebv.dll
2014-08-28 06:01 . 2014-09-16 15:58 100352 ----a-w- c:\windows\system32\wudriver.dll
2014-08-28 06:01 . 2014-09-16 15:58 253440 ----a-w- c:\windows\system32\WUSettingsProvider.dll
2014-08-28 06:01 . 2014-09-16 15:58 775168 ----a-w- c:\windows\system32\wuapi.dll
2014-08-28 06:01 . 2014-09-16 15:58 3285504 ----a-w- c:\windows\system32\wuaueng.dll
2014-08-28 06:01 . 2014-09-16 15:58 1623552 ----a-w- c:\windows\system32\wucltux.dll
2014-08-28 06:01 . 2014-09-16 15:58 17920 ----a-w- c:\windows\system32\wuaext.dll
2014-08-28 06:01 . 2014-09-16 15:58 176640 ----a-w- c:\windows\system32\storewuauth.dll
2014-08-14 09:30 . 2014-09-15 08:59 1169712 ------w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2E82B5A2-2151-40DF-B670-ABE8BDD6E39A}\gapaengine.dll
2014-08-14 09:30 . 2014-08-31 09:11 1169712 ------w- c:\programdata\Microsoft\Windows Defender\Definition Updates\NISBackup\gapaengine.dll
2014-08-09 08:30 . 2014-09-16 15:53 148480 ----a-w- c:\windows\system32\poqexec.exe
2014-08-09 08:29 . 2014-09-16 15:53 144896 ----a-w- c:\windows\system32\tssdisai.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-11-06 3673728]
"Spotify"="c:\users\Mustafa\AppData\Roaming\Spotify\Spotify.exe" [2014-10-01 6342200]
"Spotify Web Helper"="c:\users\Mustafa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-10-01 1245752]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-03-28 642656]
.
c:\users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Curse.lnk - c:\users\Mustafa\AppData\Roaming\Curse Client\Bin\Curse.exe /startup [2014-4-28 8518920]
Dropbox.lnk - c:\users\Mustafa\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-9-13 36414624]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"PromptOnSecureDesktop"= 0 (0x0)
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
R3 amdkmafd;AMD Audio Bus Lower Filter;c:\windows\System32\drivers\amdkmafd.sys;c:\windows\SYSNATIVE\drivers\amdkmafd.sys [x]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys;c:\windows\SYSNATIVE\DRIVERS\motfilt.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\System32\drivers\motccgp.sys;c:\windows\SYSNATIVE\drivers\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\System32\drivers\motccgpfl.sys;c:\windows\SYSNATIVE\drivers\motccgpfl.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys;c:\windows\SYSNATIVE\DRIVERS\Motousbnet.sys [x]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\System32\drivers\motusbdevice.sys;c:\windows\SYSNATIVE\drivers\motusbdevice.sys [x]
R3 WSDScan;WSD-Scanunterstützung;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\System32\drivers\dtsoftbus01.sys;c:\windows\SYSNATIVE\drivers\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 Dypheckolshing;Dypheckolshing;c:\program files (x86)\Dypheckolshing\Dypheckolshing.exe;c:\program files (x86)\Dypheckolshing\Dypheckolshing.exe [x]
S2 Motorola Device Manager;Motorola Device Manager Service;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [x]
S2 PST Service;PST Service;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW86.sys;c:\windows\SYSNATIVE\drivers\AtihdW86.sys [x]
S3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\DRIVERS\LVUSBS64.sys;c:\windows\SYSNATIVE\DRIVERS\LVUSBS64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-10-28 10:16 1089352 ----a-w- c:\program files (x86)\Google\Chrome\Application\38.0.2125.111\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A6EADE66-0000-0000-484E-7E8A45000000}]
2013-09-05 14:04 215416 ----a-w- c:\program files (x86)\Adobe\Reader 11.0\Esl\AiodLite.dll
.
Inhalt des "geplante Tasks" Ordners
.
2014-11-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-08 18:39]
.
2014-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-01 19:12]
.
2014-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-01 19:12]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:9880;https=127.0.0.1:9880
uSearchAssistant = hxxp://www.google.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Mustafa\AppData\Roaming\Mozilla\Firefox\Profiles\idnadjt3.default-1415046282656\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
c:\users\Mona\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe
c:\users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2014-11-04 20:03:19
ComboFix-quarantined-files.txt 2014-11-04 19:03
.
Vor Suchlauf: 21 Verzeichnis(se), 902.366.240.768 Bytes frei
Nach Suchlauf: 27 Verzeichnis(se), 923.715.321.856 Bytes frei
.
- - End Of File - - FB95FD2ECAEECBA76EC79806D971B20D
A36C5E4F47E84449FF07ED3517B43A31
|
|
05.11.2014, 14:21
| #6 |
| /// TB-Ausbilder | "Obrona VPN Deals" loswerden Servus, Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
CloseProcesses:
R2 Dypheckolshing; C:\Program Files (x86)\Dypheckolshing\Dypheckolshing.exe [4383192 2014-10-27] ()
C:\Program Files (x86)\Dypheckolshing
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:9880;https=127.0.0.1:9880
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2
Schritt 3 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 4 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 5
Bitte poste mit deiner nächsten Antwort
|
|
05.11.2014, 16:51
| #7 |
| | "Obrona VPN Deals" loswerden Guten Tag, die Fixlog Datei: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-11-2014
Ran by Mustafa at 2014-11-05 15:43:40 Run:1
Running from C:\Users\psx1_000\Downloads
Loaded Profile: Mustafa (Available profiles: Mustafa & Mona & UpdatusUser & psx1_000)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
CloseProcesses:
R2 Dypheckolshing; C:\Program Files (x86)\Dypheckolshing\Dypheckolshing.exe [4383192 2014-10-27] ()
C:\Program Files (x86)\Dypheckolshing
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:9880;https=127.0.0.1:9880
end
*****************
Processes closed successfully.
Dypheckolshing => Service deleted successfully.
C:\Program Files (x86)\Dypheckolshing => Moved successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
The system needed a reboot.
==== End of Fixlog ====
Zu Schritt 3: Die AdwCleaner Logdatei: Code:
ATTFilter # AdwCleaner v4.002 - Bericht erstellt am 05/11/2014 um 16:03:23
# DB v2014-11-02.1
# Aktualisiert 27/10/2014 von Xplode
# Betriebssystem : Windows 8 Pro (64 bits)
# Benutzername : Mustafa - ABD-ALLA-PC
# Gestartet von : C:\Users\Mustafa\Desktop\AdwCleaner_4.002.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.17116
-\\ Mozilla Firefox v32.0.3 (x86 de)
-\\ Google Chrome v38.0.2125.111
*************************
AdwCleaner[R2].txt - [2550 octets] - [03/11/2014 01:01:29]
AdwCleaner[R3].txt - [1352 octets] - [03/11/2014 01:52:42]
AdwCleaner[R4].txt - [1535 octets] - [03/11/2014 17:01:32]
AdwCleaner[R5].txt - [1214 octets] - [05/11/2014 16:00:53]
AdwCleaner[S1].txt - [2456 octets] - [03/11/2014 01:03:33]
AdwCleaner[S2].txt - [1545 octets] - [03/11/2014 17:02:42]
AdwCleaner[S3].txt - [1128 octets] - [05/11/2014 16:03:23]
########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1188 octets] ##########
Schritt 4 die mbax.txt Datei: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 05.11.2014 Suchlauf-Zeit: 16:16:54 Logdatei: mbam.txt Administrator: Ja Version: 2.00.3.1025 Malware Datenbank: v2014.11.05.06 Rootkit Datenbank: v2014.11.01.02 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8 CPU: x64 Dateisystem: NTFS Benutzer: Mustafa Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 452704 Verstrichene Zeit: 17 Min, 29 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 1 PUM.Bad.Proxy, HKU\S-1-5-21-1185304261-293873223-3258998266-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, http=127.0.0.1:9880;https=127.0.0.1:9880, , [a3872018621a9f97ea3a85b0709337c9] Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) FRST.txt Datei: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-11-2014 Ran by Mustafa (administrator) on ABD-ALLA-PC on 05-11-2014 16:38:41 Running from C:\Users\psx1_000\Downloads Loaded Profile: Mustafa (Available profiles: Mustafa & Mona & UpdatusUser & psx1_000) Platform: Windows 8 Pro (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 10 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe (Motorola) C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe (Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Dropbox, Inc.) C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.) HKU\S-1-5-21-1185304261-293873223-3258998266-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd) HKU\S-1-5-21-1185304261-293873223-3258998266-1001\...\Run: [Spotify] => C:\Users\Mustafa\AppData\Roaming\Spotify\Spotify.exe [6342200 2014-10-01] (Spotify Ltd) HKU\S-1-5-21-1185304261-293873223-3258998266-1001\...\Run: [Spotify Web Helper] => C:\Users\Mustafa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-10-01] (Spotify Ltd) Startup: C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Curse.lnk ShortcutTarget: Curse.lnk -> C:\Users\Mustafa\AppData\Roaming\Curse Client\Bin\Curse.exe (Curse, Inc) Startup: C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2E3B65AEFA4BCE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE,de;q=0.8,en-US;q=0.5,en;q=0.3 HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-1185304261-293873223-3258998266-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Mustafa\AppData\Roaming\Mozilla\Firefox\Profiles\idnadjt3.default-1415046282656 FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll () FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-09-25] Chrome: ======= CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3319709&octid=EB_ORIGINAL_CTID&ISID=M6719EEC0-0B6D-4A1A-92D1-0DA93492344E&SearchSource=55&CUI=&UM=6&UP=SP2FB3BBE9-029C-4CE8-8C26-B397BC25ADB3&SSPV= CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3319709&octid=EB_ORIGINAL_CTID&ISID=M6719EEC0-0B6D-4A1A-92D1-0DA93492344E&SearchSource=55&CUI=&UM=6&UP=SP2FB3BBE9-029C-4CE8-8C26-B397BC25ADB3&SSPV=" CHR Profile: C:\Users\Mustafa\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Drive) - C:\Users\Mustafa\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-12-02] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Mustafa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-02] CHR Extension: (Google Search) - C:\Users\Mustafa\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-02] CHR Extension: (Google Wallet) - C:\Users\Mustafa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-02] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation) R2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [121144 2013-03-25] (Motorola Mobility LLC) S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation) R2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [File not signed] S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21600 2013-03-29] (Advanced Micro Devices, Inc.) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices) S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider) R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2013-01-01] (DT Soft Ltd) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-05] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-05 16:35 - 2014-11-05 16:35 - 00001410 _____ () C:\Users\Mustafa\Desktop\mbam.txt 2014-11-05 15:59 - 2014-11-05 15:59 - 01998336 _____ () C:\Users\Mustafa\Desktop\AdwCleaner_4.002.exe 2014-11-05 15:37 - 2014-11-05 15:37 - 00000272 _____ () C:\Users\Mustafa\Desktop\Fixlist.txt 2014-11-04 20:03 - 2014-11-04 20:03 - 00017378 _____ () C:\ComboFix.txt 2014-11-04 19:43 - 2011-06-26 07:45 - 00256000 _____ () C:\WINDOWS\PEV.exe 2014-11-04 19:43 - 2010-11-07 18:20 - 00208896 _____ () C:\WINDOWS\MBR.exe 2014-11-04 19:43 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe 2014-11-04 19:43 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe 2014-11-04 19:43 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe 2014-11-04 19:43 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe 2014-11-04 19:43 - 2000-08-31 01:00 - 00098816 _____ () C:\WINDOWS\sed.exe 2014-11-04 19:43 - 2000-08-31 01:00 - 00080412 _____ () C:\WINDOWS\grep.exe 2014-11-04 19:43 - 2000-08-31 01:00 - 00068096 _____ () C:\WINDOWS\zip.exe 2014-11-04 19:42 - 2014-11-04 19:42 - 05591672 ____R (Swearware) C:\Users\Mustafa\Desktop\ComboFix.exe 2014-11-04 19:40 - 2014-11-04 20:03 - 00000000 ____D () C:\Qoobox 2014-11-04 19:39 - 2014-11-04 20:02 - 00000000 ____D () C:\WINDOWS\erdnt 2014-11-04 19:36 - 2014-11-04 19:36 - 05591672 ____R (Swearware) C:\Users\Mustafa\Downloads\ComboFix.exe 2014-11-03 21:30 - 2014-11-03 21:31 - 00024382 _____ () C:\Users\psx1_000\Downloads\Addition.txt 2014-11-03 21:29 - 2014-11-05 16:39 - 00014313 _____ () C:\Users\psx1_000\Downloads\FRST.txt 2014-11-03 21:29 - 2014-11-05 16:38 - 00000000 ____D () C:\FRST 2014-11-03 21:29 - 2014-11-03 21:29 - 02114560 _____ (Farbar) C:\Users\psx1_000\Downloads\FRST64.exe 2014-11-03 21:22 - 2014-11-03 21:22 - 00364247 _____ () C:\Users\Mustafa\Downloads\FRST64.exe 2014-11-03 19:54 - 2014-11-03 19:54 - 00001555 _____ () C:\trojaner.txt 2014-11-03 19:31 - 2014-11-03 19:31 - 00000000 ____D () C:\Users\Mustafa\Documents\FickVirus 2014-11-03 17:31 - 2014-11-05 16:05 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-11-03 17:31 - 2014-11-03 17:31 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-11-03 17:31 - 2014-11-03 17:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-11-03 17:30 - 2014-11-03 17:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-11-03 17:30 - 2014-11-03 17:30 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-11-03 17:30 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-11-03 17:30 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2014-11-03 17:30 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-11-03 17:28 - 2014-11-03 17:28 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Macromedia 2014-11-03 17:25 - 2014-11-03 17:25 - 00002247 _____ () C:\Users\psx1_000\Desktop\Google Chrome.lnk 2014-11-03 17:25 - 2014-11-03 17:25 - 00001438 _____ () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-11-03 17:25 - 2014-11-03 17:25 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Adobe 2014-11-03 17:25 - 2014-11-03 17:25 - 00000000 ____D () C:\Users\psx1_000\AppData\Local\Google 2014-11-03 17:24 - 2014-11-03 18:13 - 00000000 ____D () C:\Users\psx1_000 2014-11-03 17:24 - 2014-11-03 17:30 - 00000000 ____D () C:\Users\psx1_000\AppData\Local\Packages 2014-11-03 17:24 - 2014-11-03 17:24 - 00000020 ___SH () C:\Users\psx1_000\ntuser.ini 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Vorlagen 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Startmenü 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Netzwerkumgebung 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Lokale Einstellungen 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Eigene Dateien 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Druckumgebung 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Documents\Eigene Musik 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Documents\Eigene Bilder 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\AppData\Local\Verlauf 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\AppData\Local\Anwendungsdaten 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Anwendungsdaten 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Motorola Mobility 2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 ____D () C:\Users\psx1_000\AppData\Local\VirtualStore 2014-11-03 17:24 - 2014-07-12 13:08 - 00000000 ___RD () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-11-03 17:24 - 2014-05-17 01:03 - 00000000 ___RD () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-11-03 17:24 - 2012-07-26 09:13 - 00000000 ___RD () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-11-03 17:24 - 2012-07-26 09:13 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-11-03 17:11 - 2014-11-03 17:11 - 03377046 _____ (Malwarebytes Corporation ) C:\Users\Mustafa\Downloads\mbam-setup-2.0.2.1012.exe 2014-11-03 17:09 - 2014-11-03 17:09 - 09581416 _____ (Malwarebytes Corporation ) C:\Users\Mustafa\Downloads\mbam-setup-2.0.3.1025(1).exe 2014-11-03 17:02 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\SysWOW64\sqlite3.dll 2014-11-03 17:00 - 2014-11-03 17:00 - 01375089 _____ () C:\Users\Mustafa\Downloads\adwcleaner_3.311.exe 2014-11-03 01:25 - 2014-11-03 01:25 - 00761999 _____ () C:\Users\Mustafa\Downloads\esetsmartinstaller_deu.exe 2014-11-03 01:11 - 2014-11-03 01:11 - 00001264 _____ () C:\Users\Mustafa\Desktop\Revo Uninstaller.lnk 2014-11-03 01:11 - 2014-11-03 01:11 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-11-03 01:09 - 2014-11-03 01:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Mustafa\Downloads\revosetup95.exe 2014-11-03 01:01 - 2014-11-05 16:03 - 00000000 ____D () C:\AdwCleaner 2014-11-03 01:01 - 2014-11-03 01:01 - 01998336 _____ () C:\Users\Mustafa\Downloads\AdwCleaner_4.002.exe 2014-11-03 00:59 - 2014-11-03 01:00 - 06779113 _____ (Malwarebytes Corporation ) C:\Users\Mustafa\Downloads\mbam-setup-2.0.3.1025.exe 2014-11-02 21:37 - 2014-11-02 21:37 - 00001160 _____ () C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-11-02 15:28 - 2014-11-02 23:00 - 00001079 _____ () C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2014-11-02 15:28 - 2014-11-02 23:00 - 00001049 _____ () C:\Users\Mustafa\Desktop\Search.lnk 2014-10-28 21:27 - 2014-10-31 18:30 - 00000000 ____D () C:\Users\Mustafa\Documents\Makroökonomie 2014-10-28 20:38 - 2014-10-29 20:06 - 00000000 ____D () C:\WINDOWS\system32\AutoUpdateLicense 2014-10-28 19:44 - 2014-10-22 04:34 - 00010777 _____ () C:\WINDOWS\system32\AutoconfigV2.cab 2014-10-28 19:44 - 2014-10-22 04:33 - 00581016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AutoUpdate.exe 2014-10-28 19:44 - 2014-10-22 04:33 - 00462760 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe 2014-10-28 19:44 - 2014-10-22 02:08 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll 2014-10-28 19:44 - 2014-10-22 02:08 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-10-28 19:44 - 2014-10-22 02:01 - 00695808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll 2014-10-28 19:44 - 2014-10-22 02:01 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll 2014-10-28 19:44 - 2014-10-22 02:01 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-10-28 19:44 - 2014-10-22 02:00 - 00125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll 2014-10-20 22:45 - 2014-10-20 22:45 - 00279408 _____ () C:\WINDOWS\Minidump\102014-20982-01.dmp 2014-10-19 22:43 - 2014-10-26 13:02 - 00004682 _____ () C:\WINDOWS\comsetup.log 2014-10-19 15:05 - 2014-10-19 15:05 - 00279408 _____ () C:\WINDOWS\Minidump\101914-23758-01.dmp 2014-10-19 14:44 - 2014-10-19 14:44 - 00329016 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-10-19 09:01 - 2014-09-29 23:49 - 00705480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-10-19 09:01 - 2014-09-29 23:49 - 00104904 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2014-10-15 14:35 - 2014-07-12 05:41 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRUM.DLL 2014-10-15 14:35 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDYAK.DLL 2014-10-15 14:35 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDTAT.DLL 2014-10-15 14:35 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU1.DLL 2014-10-15 14:35 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU.DLL 2014-10-15 14:35 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDBASH.DLL 2014-10-15 14:35 - 2014-07-12 05:16 - 00008192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRUM.DLL 2014-10-15 14:35 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDYAK.DLL 2014-10-15 14:35 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDTAT.DLL 2014-10-15 14:35 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU1.DLL 2014-10-15 14:35 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU.DLL 2014-10-15 14:35 - 2014-07-12 05:15 - 00006144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDBASH.DLL 2014-10-15 14:35 - 2014-07-12 01:02 - 00478352 _____ () C:\WINDOWS\SysWOW64\locale.nls 2014-10-15 14:35 - 2014-07-12 01:00 - 00478352 _____ () C:\WINDOWS\system32\locale.nls 2014-10-15 14:35 - 2014-07-08 23:33 - 00181248 _____ (Microsoft Corp.) C:\WINDOWS\system32\Defrag.exe 2014-10-15 14:35 - 2014-07-08 23:32 - 01539584 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll 2014-10-15 14:35 - 2014-07-08 23:32 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll 2014-10-15 14:35 - 2014-07-08 23:30 - 01220608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll 2014-10-15 14:35 - 2014-07-07 06:52 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll 2014-10-15 14:35 - 2014-07-07 06:52 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll 2014-10-15 14:35 - 2014-07-04 11:52 - 00328000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys 2014-10-15 14:35 - 2014-07-03 02:59 - 01824784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2014-10-15 14:35 - 2014-07-03 01:30 - 01408952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2014-10-15 14:35 - 2014-06-28 08:01 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmapi.dll 2014-10-15 14:35 - 2014-06-28 07:57 - 00209920 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2014-10-15 14:35 - 2014-06-28 07:56 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmapi.dll 2014-10-15 14:35 - 2014-06-25 08:09 - 00733184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll 2014-10-15 14:35 - 2014-06-25 08:07 - 01023488 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll 2014-10-15 14:35 - 2014-06-18 00:27 - 02032640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll 2014-10-15 14:35 - 2014-06-18 00:23 - 02238464 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll 2014-10-15 14:35 - 2014-06-11 15:47 - 02842112 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVDECOD.DLL 2014-10-15 14:35 - 2014-06-11 05:40 - 02620928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVDECOD.DLL 2014-10-15 14:35 - 2014-06-10 23:44 - 01403896 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2014-10-15 14:35 - 2014-05-30 00:31 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll 2014-10-15 14:35 - 2014-05-30 00:03 - 00419328 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll 2014-10-15 14:35 - 2014-02-04 11:57 - 01271664 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2014-10-15 14:33 - 2014-09-13 06:29 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll 2014-10-15 14:33 - 2014-09-13 05:02 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll 2014-10-15 14:32 - 2014-07-07 06:51 - 05982208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2014-10-15 14:32 - 2014-07-07 05:00 - 05095424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2014-10-15 14:31 - 2014-09-28 05:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2014-10-15 14:31 - 2014-09-20 06:16 - 19280896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-10-15 14:31 - 2014-09-20 04:57 - 14368768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-10-15 14:31 - 2014-07-07 06:53 - 01125376 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe 2014-10-15 14:31 - 2014-07-07 06:52 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2014-10-15 14:31 - 2014-07-07 06:52 - 00724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll 2014-10-15 14:31 - 2014-07-07 06:52 - 00300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsta.dll 2014-10-15 14:31 - 2014-07-07 05:01 - 01049600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe 2014-10-15 14:31 - 2014-07-07 05:01 - 00233472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winsta.dll 2014-10-15 14:31 - 2014-07-07 04:59 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aaclient.dll 2014-10-15 14:30 - 2014-10-10 05:47 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll 2014-10-15 14:30 - 2014-10-10 05:47 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2014-10-15 14:30 - 2014-10-08 05:26 - 00556544 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2014-10-15 14:30 - 2014-09-20 06:18 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2014-10-15 14:30 - 2014-09-20 06:17 - 02236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2014-10-15 14:30 - 2014-09-20 06:17 - 01407488 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2014-10-15 14:30 - 2014-09-20 06:17 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll 2014-10-15 14:30 - 2014-09-20 06:17 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 15399424 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 02655232 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00255488 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll 2014-10-15 14:30 - 2014-09-20 06:16 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll 2014-10-15 14:30 - 2014-09-20 06:15 - 01508864 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2014-10-15 14:30 - 2014-09-20 06:15 - 00451584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll 2014-10-15 14:30 - 2014-09-20 06:15 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 13757952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 02861568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 02055168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 01762816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 01180672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll 2014-10-15 14:30 - 2014-09-20 04:57 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll 2014-10-15 14:30 - 2014-09-20 04:56 - 01440768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2014-10-15 14:30 - 2014-09-20 04:56 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll 2014-10-15 14:30 - 2014-09-20 04:56 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2014-10-15 14:30 - 2014-09-20 04:38 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb 2014-10-15 14:30 - 2014-09-20 04:33 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb 2014-10-15 14:30 - 2014-09-20 02:06 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll 2014-10-15 14:30 - 2014-09-03 03:48 - 00510464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll 2014-10-15 14:30 - 2014-09-03 03:21 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll 2014-10-15 14:30 - 2014-07-24 14:50 - 00447296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS 2014-10-15 14:30 - 2014-07-16 23:59 - 00305664 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvsvc.dll 2014-10-15 14:30 - 2014-07-12 07:45 - 01549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll 2014-10-15 14:30 - 2014-07-12 05:36 - 00674304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys 2014-10-15 14:30 - 2014-07-12 05:36 - 00211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys 2014-10-15 14:30 - 2014-07-12 05:34 - 00404480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys 2014-10-15 14:30 - 2014-07-12 05:34 - 00250368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys 2014-10-15 14:30 - 2014-06-28 07:57 - 01341952 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll 2014-10-15 14:30 - 2014-06-28 03:23 - 01126400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll 2014-10-15 14:29 - 2014-09-17 23:56 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll 2014-10-15 14:29 - 2014-08-30 06:48 - 10115072 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2014-10-15 14:29 - 2014-08-30 06:46 - 02306560 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2014-10-15 14:29 - 2014-08-30 05:05 - 08858112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2014-10-15 14:29 - 2014-08-01 23:08 - 00388729 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2014-10-15 14:29 - 2014-07-17 00:28 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sscore.dll 2014-10-15 14:29 - 2014-07-16 23:59 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\sscore.dll 2014-10-15 14:29 - 2014-06-13 00:29 - 02146304 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll 2014-10-15 14:28 - 2014-09-18 00:24 - 02416128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll 2014-10-15 14:28 - 2014-08-30 05:03 - 02037760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2014-10-15 14:28 - 2014-06-13 00:34 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-05 16:39 - 2012-11-08 23:24 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-11-05 16:34 - 2012-11-08 22:00 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1185304261-293873223-3258998266-1001 2014-11-05 16:16 - 2012-12-01 20:12 - 00001142 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-11-05 16:15 - 2012-11-08 21:01 - 01622591 _____ () C:\WINDOWS\WindowsUpdate.log 2014-11-05 16:06 - 2013-11-13 19:25 - 00000000 ___RD () C:\Users\Mustafa\Dropbox 2014-11-05 16:05 - 2013-11-13 19:22 - 00000000 ____D () C:\Users\Mustafa\AppData\Roaming\Dropbox 2014-11-05 16:04 - 2013-06-25 02:05 - 00000000 ____D () C:\Temp 2014-11-05 16:04 - 2012-12-01 20:12 - 00001138 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-11-05 16:04 - 2012-11-08 22:01 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-11-05 16:04 - 2012-11-08 20:53 - 00038232 _____ () C:\WINDOWS\PFRO.log 2014-11-05 16:04 - 2012-07-26 08:22 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-11-05 16:03 - 2012-07-26 06:26 - 01048576 ___SH () C:\WINDOWS\system32\config\BBI 2014-11-05 16:02 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-11-04 20:03 - 2012-07-26 06:37 - 00000000 __RHD () C:\Users\Default 2014-11-04 20:00 - 2012-07-26 06:26 - 00000215 _____ () C:\WINDOWS\system.ini 2014-11-04 19:33 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2014-11-04 19:30 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\AUInstallAgent 2014-11-03 21:24 - 2012-10-09 01:33 - 00000000 ____D () C:\Users\Mustafa\Desktop\Alte Firefox-Daten 2014-11-03 18:29 - 2012-07-26 11:27 - 05112182 _____ () C:\WINDOWS\system32\perfh007.dat 2014-11-03 18:29 - 2012-07-26 11:27 - 01508710 _____ () C:\WINDOWS\system32\perfc007.dat 2014-11-03 18:29 - 2012-07-26 08:28 - 00005430 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-11-03 18:17 - 2014-05-31 12:14 - 00000000 ____D () C:\Users\Mustafa\Documents\Speißeplän Recycling 2014-11-03 17:59 - 2012-07-26 09:12 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel 2014-11-03 17:26 - 2012-11-08 21:54 - 00000000 ____D () C:\WINDOWS\System32\Tasks\WPD 2014-11-03 01:28 - 2014-09-25 11:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-03 00:27 - 2012-11-08 23:43 - 00000000 ____D () C:\Users\Mustafa\AppData\Roaming\TS3Client 2014-11-02 22:19 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\rescache 2014-11-01 01:56 - 2013-10-29 17:38 - 00000000 ____D () C:\Users\Mustafa\AppData\Local\Battle.net 2014-10-31 18:31 - 2013-11-11 02:04 - 00000000 ____D () C:\Users\Mustafa\Documents\Messtechnik 2014-10-30 12:25 - 2012-11-10 11:01 - 00275080 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2014-10-29 19:14 - 2013-10-29 17:39 - 00000000 ____D () C:\Program Files (x86)\Hearthstone 2014-10-28 20:38 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\WinStore 2014-10-26 17:22 - 2014-09-24 16:19 - 00000000 ____D () C:\$Windows.~BT 2014-10-26 13:06 - 2012-11-08 20:57 - 00152403 _____ () C:\WINDOWS\diagwrn.xml 2014-10-26 13:06 - 2012-11-08 20:57 - 00152403 _____ () C:\WINDOWS\diagerr.xml 2014-10-26 13:06 - 2012-07-26 08:21 - 02045102 _____ () C:\WINDOWS\setupact.log 2014-10-26 13:05 - 2012-07-26 09:13 - 00003856 _____ () C:\WINDOWS\DtcInstall.log 2014-10-26 12:58 - 2012-11-08 21:55 - 00019976 _____ () C:\WINDOWS\system32\lvcoinst.log 2014-10-25 23:09 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\Registration 2014-10-25 01:17 - 2013-10-29 17:38 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-10-20 22:45 - 2012-11-09 23:51 - 381125224 _____ () C:\WINDOWS\MEMORY.DMP 2014-10-20 22:45 - 2012-11-09 23:51 - 00000000 ____D () C:\WINDOWS\Minidump 2014-10-19 22:48 - 2012-07-26 06:26 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-10-19 08:58 - 2012-11-08 22:10 - 00000000 ____D () C:\Program Files (x86)\Pando Networks 2014-10-19 01:29 - 2014-07-12 13:08 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel 2014-10-19 01:29 - 2012-07-26 09:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2014-10-19 01:28 - 2012-07-26 09:12 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-10-18 12:11 - 2012-12-01 20:12 - 00004114 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2014-10-18 12:11 - 2012-12-01 20:12 - 00003878 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2014-10-17 15:12 - 2013-07-29 02:05 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-10-17 14:47 - 2012-12-12 21:30 - 103265616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe Some content of TEMP: ==================== C:\Users\Mustafa\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyou9tb.dll C:\Users\Mustafa\AppData\Local\Temp\Quarantine.exe C:\Users\Mustafa\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-28 20:36 ==================== End Of Log ============================ und die Addition.txt Datei: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-11-2014
Ran by Mustafa at 2014-11-05 16:39:31
Running from C:\Users\psx1_000\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Botanicula (HKLM-x32\...\Botanicula_is1) (Version: - )
Curse (HKLM-x32\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 6.0.0.0 - Curse)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.46.1.0327 - DT Soft Ltd)
Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
Free YouTube to MP3 Converter version 3.12.20.1230 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.20.1230 - DVDVideoSoft Ltd.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Gone Home version 0.0.0.9 (HKLM-x32\...\Gone Home_is1) (Version: 0.0.0.9 - WaLMaRT)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
IsoBuster 3.2 (HKLM-x32\...\IsoBuster_is1) (Version: 3.2 - Smart Projects)
Java 7 Update 9 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417009FF}) (Version: 7.0.90 - Oracle)
Java 7 Update 9 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217009FF}) (Version: 7.0.90 - Oracle)
Java SE Development Kit 7 Update 9 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170090}) (Version: 1.7.0.90 - Oracle)
JDownloader 2 (HKLM-x32\...\0630-0716-3135-7887) (Version: 2 - AppWork GmbH)
K-Lite Codec Pack 10.0.5 Standard (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.0.5 - )
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office Standard Edition 2003 (HKLM-x32\...\{91120407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
MiKTeX 2.9 (HKLM\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Motorola Device Manager (HKLM-x32\...\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.3.9 - Motorola Mobility)
Motorola Device Software Update (x32 Version: 13.02.1402 - Motorola Mobility) Hidden
Motorola Mobile Drivers Installation 6.0.0 (Version: 6.0.0 - Motorola Inc.) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.2.1 - )
NVIDIA 3D Vision Controller-Treiber 310.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 310.70 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.1031 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Peggle Deluxe (HKLM-x32\...\Peggle Deluxe) (Version: - PopCap Games)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Pokémon Trading Card Game Online (HKLM-x32\...\{496D7B7E-EBDC-4E2B-B021-4FF03B188B69}) (Version: 1.0.0 - The Pokémon Company International)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
scilab-5.4.1 (64-bit) (HKLM\...\scilab-5.4.1 (64-bit)_is1) (Version: - Scilab Enterprises)
SIMetrix Intro (HKLM-x32\...\{5BFD23B6-8060-11DB-96A4-00E08161165F}) (Version: 5.3 - )
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.13.24.g5dbb3103 - Spotify AB)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
TeXnicCenter Version 2.02 Stable (HKLM\...\TeXnicCenter_is1) (Version: 2.02 Stable - The TeXnicCenter Team)
VLC media player 2.0.4 (HKLM-x32\...\VLC media player) (Version: 2.0.4 - VideoLAN)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
XnView 2.03 (HKLM-x32\...\XnView_is1) (Version: 2.03 - Gougelet Pierre-e)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
25-10-2014 13:12:03 Geplanter Prüfpunkt
28-10-2014 19:33:34 Windows Update
03-11-2014 00:14:55 Revo Uninstaller's restore point - Shopping Helper Smartbar
03-11-2014 01:04:05 Wiederherstellungsvorgang
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2012-07-26 06:26 - 2014-11-04 20:00 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2766B33F-F759-4DE1-8855-886D9A9D6B98} - System32\Tasks\Motorola Device Manager Engine => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-03-25] ()
Task: {7578D177-23EA-4BD9-9EF0-93F4EB6CFA9D} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-12] (Adobe Systems Incorporated)
Task: {7EB66830-EC26-4A61-A206-642984E10A9C} - System32\Tasks\Motorola Device Manager Initial Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-03-25] ()
Task: {7FACC369-E6EB-48B0-8938-50C086481287} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-01] (Google Inc.)
Task: {9D07BEEE-3ED6-465C-BC27-4516CF80C1A2} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install ping => C:\Windows\system32\AutoUpdate.exe [2014-10-22] (Microsoft Corporation)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {A81F3819-44A3-432B-85C5-E4521D5259D4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-01] (Google Inc.)
Task: {ADC8854E-100B-4E6F-9E87-02447746E27D} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install v2 => C:\WINDOWS\system32\AutoUpdate.exe [2014-10-22] (Microsoft Corporation)
Task: {C65DFB89-9E9F-4870-AADC-880BDD853B9D} - System32\Tasks\Motorola Device Manager Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-03-25] ()
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D187D5D7-66A4-4428-A9FE-8392E41D0360} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-10-17] (Microsoft Corporation)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-03-25 20:44 - 2013-03-25 20:44 - 00172032 _____ () C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\css_core.dll
2014-11-05 16:05 - 2014-11-05 16:05 - 00043008 _____ () c:\users\mustafa\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyou9tb.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\libcef.dll
2011-07-18 22:07 - 2011-07-18 22:07 - 00014336 _____ () C:\Program Files (x86)\Notepad++\plugins\NppExport.dll
2011-09-21 21:46 - 2011-09-21 21:46 - 01673728 _____ () C:\Program Files (x86)\Notepad++\plugins\NppFTP.dll
2014-09-25 11:09 - 2014-09-25 11:10 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Mona\Desktop\Bild (11).jpg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Mona\Desktop\Bild (11).jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "StartCCC"
HKCU\...\StartupApproved\StartupFolder: => "OpenOffice.org 3.4.1.lnk"
HKCU\...\StartupApproved\StartupFolder: => "Curse.lnk"
HKCU\...\StartupApproved\Run: => "Pando Media Booster"
HKCU\...\StartupApproved\Run: => "Skype"
HKCU\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKCU\...\StartupApproved\Run: => "Spotify"
HKCU\...\StartupApproved\Run: => "Spotify Web Helper"
HKCU\...\StartupApproved\Run: => "Steam"
========================= Accounts: ==========================
Administrator (S-1-5-21-1185304261-293873223-3258998266-500 - Administrator - Disabled)
Gast (S-1-5-21-1185304261-293873223-3258998266-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1185304261-293873223-3258998266-1002 - Limited - Enabled)
Mona (S-1-5-21-1185304261-293873223-3258998266-1003 - Limited - Enabled) => C:\Users\Mona
Mustafa (S-1-5-21-1185304261-293873223-3258998266-1001 - Administrator - Enabled) => C:\Users\Mustafa
psx1_000 (S-1-5-21-1185304261-293873223-3258998266-1005 - Administrator - Enabled) => C:\Users\psx1_000
UpdatusUser (S-1-5-21-1185304261-293873223-3258998266-1004 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: Videocontroller für Multimedia
Description: Videocontroller für Multimedia
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Coprozessor
Description: Coprozessor
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/05/2014 04:06:09 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/05/2014 03:46:56 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/05/2014 03:31:52 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/04/2014 07:32:23 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (11/03/2014 06:14:10 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/03/2014 06:12:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Abd-Alla-PC)
Description: Die App „Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (11/03/2014 06:12:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Abd-Alla-PC)
Description: Bei der Aktivierung der App „Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing“ ist folgender Fehler aufgetreten: -2147467259. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
System errors:
=============
Error: (11/05/2014 04:06:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (11/05/2014 04:06:53 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (11/05/2014 04:05:00 PM) (Source: DCOM) (EventID: 10016) (User: Abd-Alla-PC)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Abd-Alla-PCMustafaS-1-5-21-1185304261-293873223-3258998266-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (11/05/2014 04:05:00 PM) (Source: DCOM) (EventID: 10016) (User: Abd-Alla-PC)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Abd-Alla-PCMustafaS-1-5-21-1185304261-293873223-3258998266-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (11/05/2014 04:05:00 PM) (Source: DCOM) (EventID: 10016) (User: Abd-Alla-PC)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Abd-Alla-PCMustafaS-1-5-21-1185304261-293873223-3258998266-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (11/05/2014 03:52:59 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMScheduler" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/05/2014 03:52:56 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/05/2014 03:47:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (11/05/2014 03:47:41 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (11/05/2014 03:44:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Microsoft Office Sessions:
=========================
Error: (11/05/2014 04:06:09 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/05/2014 03:46:56 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/05/2014 03:31:52 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/04/2014 07:32:23 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F2030000E5050000
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance163707000000000000000000008F020000
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance163707000000000000000000008F020000
Error: (11/03/2014 06:14:10 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/03/2014 06:12:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Abd-Alla-PC)
Description: Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing
Error: (11/03/2014 06:12:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Abd-Alla-PC)
Description: Microsoft.Bing_8wekyb3d8bbwe!Microsoft.Bing-2147467259
CodeIntegrity Errors:
===================================
Date: 2014-11-04 19:59:40.409
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Quad CPU Q8200 @ 2.33GHz
Percentage of memory in use: 38%
Total physical RAM: 4094.99 MB
Available physical RAM: 2500.38 MB
Total Pagefile: 8191.24 MB
Available Pagefile: 6432.55 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:1220.5 GB) (Free:860.44 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397.3 GB) (Disk ID: FCD6DD83)
Partition 1: (Not Active) - (Size=11.7 GB) - (Type=27)
Partition 2: (Active) - (Size=164.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1220.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
06.11.2014, 20:27
| #8 |
| /// TB-Ausbilder | "Obrona VPN Deals" loswerden Servus, erscheint "Oprona VPN Deals" immer noch? Schritt 1 Bitte deaktiviere dein Anti-Viren-Programm, da es das Ergebnis beeinflussen oder ggf. die Bereinigung stören kann. Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/ und speichere die Datei auf deinem Desktop.
Schritt 2 Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit) | SystemLook (64 bit)
Bitte poste mit deiner nächsten Antwort
|
|
06.11.2014, 21:15
| #9 |
| | "Obrona VPN Deals" loswerden Guten Abend, so weit ich es jetzt in den letzten 30 Minuten überblicken konnte, erscheinen nur "normale" Werbebanner, habe auch den IE probiert und auch der sieht frei aus. Soll ich die beiden von dir eben aufgelisteten Schritte trotzdem noch befolgen? |
|
07.11.2014, 14:11
| #10 | |
| /// TB-Ausbilder | "Obrona VPN Deals" loswerdenZitat:
 Sonst hätte ich sie ja nicht gepostet. Dein Rechner ist ja noch nicht ganz sauber.  |
|
07.11.2014, 15:48
| #11 |
| | "Obrona VPN Deals" loswerden Guten Tag, war etwas verunsichert als du mich gefragt hattest, ob die Werbung immernoch aufkommt.  So habe deine beiden Schritte befolgt. Schritt 1: Das ZOEK-Log Code:
ATTFilter Zoek.exe v5.0.0.0 Updated 06-November-2014
Tool run by Mustafa on 07.11.2014 at 15:17:08,86.
Microsoft Windows 8 Pro 6.2.9200 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Mustafa\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
07.11.2014 15:22:25 Zoek.exe System Restore Point Created Succesfully.
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== FireFox Fix ======================
Deleted from C:\Users\Mona\AppData\Roaming\Mozilla\Firefox\Profiles\3t5wvjef.default\prefs.js:
Added to C:\Users\Mona\AppData\Roaming\Mozilla\Firefox\Profiles\3t5wvjef.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);
Deleted from C:\Users\Mona\AppData\Roaming\Mozilla\Firefox\Profiles\9p7dowse.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.de/");
Added to C:\Users\Mona\AppData\Roaming\Mozilla\Firefox\Profiles\9p7dowse.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);
Deleted from C:\Users\Mustafa\AppData\Roaming\Mozilla\Firefox\Profiles\idnadjt3.default-1415046282656\prefs.js:
Added to C:\Users\Mustafa\AppData\Roaming\Mozilla\Firefox\Profiles\idnadjt3.default-1415046282656\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);
==== Firefox Extensions ======================
AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi
==== Firefox Plugins ======================
Profilepath: C:\Users\Mustafa\AppData\Roaming\Mozilla\Firefox\Profiles\idnadjt3.default-1415046282656
DFC9460CC37E5C414DC4680B10C19E7A - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll - Shockwave Flash
2C82D753EF779945977C82A3908DA20A - C:\WINDOWS\SysWOW64\npDeployJava1.dll - Java Deployment Toolkit 7.0.90.5
3A57A288F098188E92C6B0309CBC50B2 - C:\WINDOWS\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
"Use Search Asst"="yes"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://www.google.com"
"SearchAssistant"="hxxp://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Use Search Asst"="no"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR"
==== Reset Google Chrome ======================
C:\Users\Mona\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\Mustafa\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Mona\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Mustafa\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
==== Reset IE Proxy ======================
Value(s) before fix:
"ProxyOverride"="<local>;192.168.*.*"
"ProxyEnable"=dword:00000000
Value(s) after fix:
"ProxyEnable"=dword:00000000
==== C:\zoek_backup content ======================
C:\zoek_backup (files=0 folders=0 0 bytes)
==== EOF on 07.11.2014 at 15:23:39,35 ======================
Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff
Log created at 15:36 on 07/11/2014 by Mustafa
Administrator - Elevation successful
========== filefind ==========
Searching for "*Dypheckolshing*"
C:\FRST\Quarantine\C\Program Files (x86)\Dypheckolshing\Dypheckolshing.exe --ahs-- 4383192 bytes [14:26 02/11/2014] [08:56 27/10/2014] 58A75165C6045A9B23BCCF9678BEE687
C:\FRST\Quarantine\C\Program Files (x86)\Dypheckolshing\DypheckolshingHelper.exe -ra---- 160728 bytes [14:26 02/11/2014] [14:26 02/11/2014] 88B2C87A054EEF5C406ED2EB002F96E9
C:\Windows\Prefetch\DYPHECKOLSHINGHELPER.EXE-06DB26AE.pf --a---- 31686 bytes [14:30 05/11/2014] [14:38 05/11/2014] 72AAED1A34E24B68B24C59924DBAE23E
========== folderfind ==========
Searching for "*Dypheckolshing*"
C:\FRST\Quarantine\C\Program Files (x86)\Dypheckolshing d--hs-- [14:26 02/11/2014]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Dypheckolshing.e_84cba7d793dc7979c33fa9e14668ac4d5a507c_111695a9 d----c- [15:29 03/11/2014]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_Dypheckolshing.e_84cba7d793dc7979c33fa9e14668ac4d5a507c_111695a9 d----c- [15:29 03/11/2014]
C:\Windows.old\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_Dypheckolshing.e_84cba7d793dc7979c33fa9e14668ac4d5a507c_111695a9 d----c- [15:29 03/11/2014]
========== regfind ==========
Searching for "Dypheckolshing"
No data found.
-= EOF =-
 |
|
07.11.2014, 16:49
| #12 |
| /// TB-Ausbilder | "Obrona VPN Deals" loswerden Servus, nochmal Kontrolle mit FRST bitte, dann sehen wir weiter:
|
|
07.11.2014, 17:40
| #13 |
| | "Obrona VPN Deals" loswerden Servus, die FRST.txt Datei: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-11-2014
Ran by Mustafa (administrator) on ABD-ALLA-PC on 07-11-2014 17:37:41
Running from C:\Users\psx1_000\Downloads
Loaded Profiles: Mustafa & (Available profiles: Mustafa & Mona & UpdatusUser & psx1_000)
Platform: Windows 8 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe
(Motorola) C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.17074_none_6233bc1f5106b696\TiWorker.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
(Dropbox, Inc.) C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-1185304261-293873223-3258998266-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd)
HKU\S-1-5-21-1185304261-293873223-3258998266-1001\...\Run: [Spotify] => C:\Users\Mustafa\AppData\Roaming\Spotify\Spotify.exe [6342200 2014-10-01] (Spotify Ltd)
HKU\S-1-5-21-1185304261-293873223-3258998266-1001\...\Run: [Spotify Web Helper] => C:\Users\Mustafa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-10-01] (Spotify Ltd)
HKU\S-1-5-21-1185304261-293873223-3258998266-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd)
HKU\S-1-5-21-1185304261-293873223-3258998266-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Spotify] => C:\Users\Mustafa\AppData\Roaming\Spotify\Spotify.exe [6342200 2014-10-01] (Spotify Ltd)
HKU\S-1-5-21-1185304261-293873223-3258998266-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Spotify Web Helper] => C:\Users\Mustafa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-10-01] (Spotify Ltd)
Startup: C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Curse.lnk
ShortcutTarget: Curse.lnk -> C:\Users\Mustafa\AppData\Roaming\Curse Client\Bin\Curse.exe (Curse, Inc)
Startup: C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2E3B65AEFA4BCE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE,de;q=0.8,en-US;q=0.5,en;q=0.3
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1185304261-293873223-3258998266-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1185304261-293873223-3258998266-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Mustafa\AppData\Roaming\Mozilla\Firefox\Profiles\idnadjt3.default-1415046282656
FF NewTab: hxxp://www.google.com/
FF DefaultSearchUrl: hxxp://www.google.com/search?btnG=Google+Search&q=
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-09-25]
Chrome:
=======
CHR Profile: C:\Users\Mustafa\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Mustafa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-02]
CHR Extension: (Google Wallet) - C:\Users\Mustafa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-02]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
R2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [121144 2013-03-25] (Motorola Mobility LLC)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
R2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [File not signed]
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21600 2013-03-29] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2013-01-01] (DT Soft Ltd)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-07] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-07 15:36 - 2014-11-07 15:44 - 00002826 _____ () C:\Users\Mustafa\Desktop\SystemLook.txt
2014-11-07 15:35 - 2014-11-07 15:35 - 00165376 _____ () C:\Users\Mustafa\Desktop\SystemLook_x64.exe
2014-11-07 15:22 - 2014-11-07 15:23 - 00006572 _____ () C:\zoek-results.log
2014-11-07 15:17 - 2014-11-07 15:17 - 00000000 ____D () C:\zoek_backup
2014-11-07 15:16 - 2014-11-07 15:16 - 01294848 _____ () C:\Users\Mustafa\Desktop\zoek.exe
2014-11-07 15:12 - 2014-11-07 15:12 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\65BB2562.sys
2014-11-05 16:35 - 2014-11-05 16:35 - 00001410 _____ () C:\Users\Mustafa\Desktop\mbam.txt
2014-11-05 15:59 - 2014-11-05 15:59 - 01998336 _____ () C:\Users\Mustafa\Desktop\AdwCleaner_4.002.exe
2014-11-05 15:37 - 2014-11-05 15:37 - 00000272 _____ () C:\Users\Mustafa\Desktop\Fixlist.txt
2014-11-04 20:03 - 2014-11-04 20:03 - 00017378 _____ () C:\ComboFix.txt
2014-11-04 19:43 - 2011-06-26 07:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-11-04 19:43 - 2010-11-07 18:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-11-04 19:43 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-11-04 19:43 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-11-04 19:43 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-11-04 19:43 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-11-04 19:43 - 2000-08-31 01:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-11-04 19:43 - 2000-08-31 01:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-11-04 19:43 - 2000-08-31 01:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-11-04 19:42 - 2014-11-04 19:42 - 05591672 ____R (Swearware) C:\Users\Mustafa\Desktop\ComboFix.exe
2014-11-04 19:40 - 2014-11-04 20:03 - 00000000 ____D () C:\Qoobox
2014-11-04 19:39 - 2014-11-04 20:02 - 00000000 ____D () C:\WINDOWS\erdnt
2014-11-04 19:36 - 2014-11-04 19:36 - 05591672 ____R (Swearware) C:\Users\Mustafa\Downloads\ComboFix.exe
2014-11-03 21:30 - 2014-11-05 16:39 - 00028826 _____ () C:\Users\psx1_000\Downloads\Addition.txt
2014-11-03 21:29 - 2014-11-07 17:38 - 00014546 _____ () C:\Users\psx1_000\Downloads\FRST.txt
2014-11-03 21:29 - 2014-11-07 17:37 - 00000000 ____D () C:\FRST
2014-11-03 21:29 - 2014-11-03 21:29 - 02114560 _____ (Farbar) C:\Users\psx1_000\Downloads\FRST64.exe
2014-11-03 21:22 - 2014-11-03 21:22 - 00364247 _____ () C:\Users\Mustafa\Downloads\FRST64.exe
2014-11-03 19:54 - 2014-11-03 19:54 - 00001555 _____ () C:\trojaner.txt
2014-11-03 19:31 - 2014-11-06 20:52 - 00000000 ____D () C:\Users\Mustafa\Documents\FickVirus
2014-11-03 17:31 - 2014-11-07 15:12 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-11-03 17:31 - 2014-11-03 17:31 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-03 17:31 - 2014-11-03 17:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-11-03 17:30 - 2014-11-03 17:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-11-03 17:30 - 2014-11-03 17:30 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-03 17:30 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-11-03 17:30 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-11-03 17:30 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-11-03 17:28 - 2014-11-03 17:28 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Macromedia
2014-11-03 17:25 - 2014-11-03 17:25 - 00002247 _____ () C:\Users\psx1_000\Desktop\Google Chrome.lnk
2014-11-03 17:25 - 2014-11-03 17:25 - 00001438 _____ () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-03 17:25 - 2014-11-03 17:25 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Adobe
2014-11-03 17:25 - 2014-11-03 17:25 - 00000000 ____D () C:\Users\psx1_000\AppData\Local\Google
2014-11-03 17:24 - 2014-11-03 18:13 - 00000000 ____D () C:\Users\psx1_000
2014-11-03 17:24 - 2014-11-03 17:30 - 00000000 ____D () C:\Users\psx1_000\AppData\Local\Packages
2014-11-03 17:24 - 2014-11-03 17:24 - 00000020 ___SH () C:\Users\psx1_000\ntuser.ini
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Vorlagen
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Startmenü
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Netzwerkumgebung
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Lokale Einstellungen
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Eigene Dateien
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Druckumgebung
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Documents\Eigene Musik
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Documents\Eigene Bilder
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\AppData\Local\Verlauf
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\AppData\Local\Anwendungsdaten
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 _SHDL () C:\Users\psx1_000\Anwendungsdaten
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Motorola Mobility
2014-11-03 17:24 - 2014-11-03 17:24 - 00000000 ____D () C:\Users\psx1_000\AppData\Local\VirtualStore
2014-11-03 17:24 - 2014-07-12 13:08 - 00000000 ___RD () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-11-03 17:24 - 2014-05-17 01:03 - 00000000 ___RD () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-03 17:24 - 2012-07-26 09:13 - 00000000 ___RD () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-11-03 17:24 - 2012-07-26 09:13 - 00000000 ____D () C:\Users\psx1_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-11-03 17:11 - 2014-11-03 17:11 - 03377046 _____ (Malwarebytes Corporation ) C:\Users\Mustafa\Downloads\mbam-setup-2.0.2.1012.exe
2014-11-03 17:09 - 2014-11-03 17:09 - 09581416 _____ (Malwarebytes Corporation ) C:\Users\Mustafa\Downloads\mbam-setup-2.0.3.1025(1).exe
2014-11-03 17:02 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\SysWOW64\sqlite3.dll
2014-11-03 17:00 - 2014-11-03 17:00 - 01375089 _____ () C:\Users\Mustafa\Downloads\adwcleaner_3.311.exe
2014-11-03 01:25 - 2014-11-03 01:25 - 00761999 _____ () C:\Users\Mustafa\Downloads\esetsmartinstaller_deu.exe
2014-11-03 01:11 - 2014-11-03 01:11 - 00001264 _____ () C:\Users\Mustafa\Desktop\Revo Uninstaller.lnk
2014-11-03 01:11 - 2014-11-03 01:11 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-11-03 01:09 - 2014-11-03 01:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Mustafa\Downloads\revosetup95.exe
2014-11-03 01:01 - 2014-11-05 16:03 - 00000000 ____D () C:\AdwCleaner
2014-11-03 01:01 - 2014-11-03 01:01 - 01998336 _____ () C:\Users\Mustafa\Downloads\AdwCleaner_4.002.exe
2014-11-03 00:59 - 2014-11-03 01:00 - 06779113 _____ (Malwarebytes Corporation ) C:\Users\Mustafa\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-02 21:37 - 2014-11-02 21:37 - 00001160 _____ () C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-02 15:28 - 2014-11-02 23:00 - 00001079 _____ () C:\Users\Mustafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-11-02 15:28 - 2014-11-02 23:00 - 00001049 _____ () C:\Users\Mustafa\Desktop\Search.lnk
2014-10-28 21:27 - 2014-10-31 18:30 - 00000000 ____D () C:\Users\Mustafa\Documents\Makroökonomie
2014-10-28 20:38 - 2014-10-29 20:06 - 00000000 ____D () C:\WINDOWS\system32\AutoUpdateLicense
2014-10-28 19:44 - 2014-10-22 04:34 - 00010777 _____ () C:\WINDOWS\system32\AutoconfigV2.cab
2014-10-28 19:44 - 2014-10-22 04:33 - 00581016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AutoUpdate.exe
2014-10-28 19:44 - 2014-10-22 04:33 - 00462760 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationUI.exe
2014-10-28 19:44 - 2014-10-22 02:08 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-10-28 19:44 - 2014-10-22 02:08 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-28 19:44 - 2014-10-22 02:01 - 00695808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-10-28 19:44 - 2014-10-22 02:01 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2014-10-28 19:44 - 2014-10-22 02:01 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-28 19:44 - 2014-10-22 02:00 - 00125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2014-10-20 22:45 - 2014-10-20 22:45 - 00279408 _____ () C:\WINDOWS\Minidump\102014-20982-01.dmp
2014-10-19 22:43 - 2014-10-26 13:02 - 00004682 _____ () C:\WINDOWS\comsetup.log
2014-10-19 15:05 - 2014-10-19 15:05 - 00279408 _____ () C:\WINDOWS\Minidump\101914-23758-01.dmp
2014-10-19 14:44 - 2014-10-19 14:44 - 00329016 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-10-19 09:01 - 2014-09-29 23:49 - 00705480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-10-19 09:01 - 2014-09-29 23:49 - 00104904 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-15 14:35 - 2014-07-12 05:41 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRUM.DLL
2014-10-15 14:35 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDYAK.DLL
2014-10-15 14:35 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDTAT.DLL
2014-10-15 14:35 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU1.DLL
2014-10-15 14:35 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU.DLL
2014-10-15 14:35 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDBASH.DLL
2014-10-15 14:35 - 2014-07-12 05:16 - 00008192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRUM.DLL
2014-10-15 14:35 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDYAK.DLL
2014-10-15 14:35 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDTAT.DLL
2014-10-15 14:35 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU1.DLL
2014-10-15 14:35 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU.DLL
2014-10-15 14:35 - 2014-07-12 05:15 - 00006144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDBASH.DLL
2014-10-15 14:35 - 2014-07-12 01:02 - 00478352 _____ () C:\WINDOWS\SysWOW64\locale.nls
2014-10-15 14:35 - 2014-07-12 01:00 - 00478352 _____ () C:\WINDOWS\system32\locale.nls
2014-10-15 14:35 - 2014-07-08 23:33 - 00181248 _____ (Microsoft Corp.) C:\WINDOWS\system32\Defrag.exe
2014-10-15 14:35 - 2014-07-08 23:32 - 01539584 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2014-10-15 14:35 - 2014-07-08 23:32 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2014-10-15 14:35 - 2014-07-08 23:30 - 01220608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2014-10-15 14:35 - 2014-07-07 06:52 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2014-10-15 14:35 - 2014-07-07 06:52 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2014-10-15 14:35 - 2014-07-04 11:52 - 00328000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2014-10-15 14:35 - 2014-07-03 02:59 - 01824784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-10-15 14:35 - 2014-07-03 01:30 - 01408952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-10-15 14:35 - 2014-06-28 08:01 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmapi.dll
2014-10-15 14:35 - 2014-06-28 07:57 - 00209920 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2014-10-15 14:35 - 2014-06-28 07:56 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmapi.dll
2014-10-15 14:35 - 2014-06-25 08:09 - 00733184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2014-10-15 14:35 - 2014-06-25 08:07 - 01023488 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-10-15 14:35 - 2014-06-18 00:27 - 02032640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2014-10-15 14:35 - 2014-06-18 00:23 - 02238464 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2014-10-15 14:35 - 2014-06-11 15:47 - 02842112 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVDECOD.DLL
2014-10-15 14:35 - 2014-06-11 05:40 - 02620928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVDECOD.DLL
2014-10-15 14:35 - 2014-06-10 23:44 - 01403896 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2014-10-15 14:35 - 2014-05-30 00:31 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2014-10-15 14:35 - 2014-05-30 00:03 - 00419328 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2014-10-15 14:35 - 2014-02-04 11:57 - 01271664 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2014-10-15 14:33 - 2014-09-13 06:29 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll
2014-10-15 14:33 - 2014-09-13 05:02 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll
2014-10-15 14:32 - 2014-07-07 06:51 - 05982208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-10-15 14:32 - 2014-07-07 05:00 - 05095424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-10-15 14:31 - 2014-09-28 05:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-10-15 14:31 - 2014-09-20 06:16 - 19280896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-10-15 14:31 - 2014-09-20 04:57 - 14368768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-10-15 14:31 - 2014-07-07 06:53 - 01125376 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2014-10-15 14:31 - 2014-07-07 06:52 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2014-10-15 14:31 - 2014-07-07 06:52 - 00724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll
2014-10-15 14:31 - 2014-07-07 06:52 - 00300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsta.dll
2014-10-15 14:31 - 2014-07-07 05:01 - 01049600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2014-10-15 14:31 - 2014-07-07 05:01 - 00233472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winsta.dll
2014-10-15 14:31 - 2014-07-07 04:59 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aaclient.dll
2014-10-15 14:30 - 2014-10-10 05:47 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-10-15 14:30 - 2014-10-10 05:47 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-10-15 14:30 - 2014-10-08 05:26 - 00556544 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-10-15 14:30 - 2014-09-20 06:18 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-10-15 14:30 - 2014-09-20 06:17 - 02236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-10-15 14:30 - 2014-09-20 06:17 - 01407488 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-10-15 14:30 - 2014-09-20 06:17 - 00915968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll
2014-10-15 14:30 - 2014-09-20 06:17 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 15399424 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 03959296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 02655232 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 00255488 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 00097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2014-10-15 14:30 - 2014-09-20 06:16 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2014-10-15 14:30 - 2014-09-20 06:15 - 01508864 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-10-15 14:30 - 2014-09-20 06:15 - 00451584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-10-15 14:30 - 2014-09-20 06:15 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 13757952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 02861568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 02055168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 01762816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 01180672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2014-10-15 14:30 - 2014-09-20 04:57 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2014-10-15 14:30 - 2014-09-20 04:56 - 01440768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-10-15 14:30 - 2014-09-20 04:56 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-10-15 14:30 - 2014-09-20 04:56 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-10-15 14:30 - 2014-09-20 04:38 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-10-15 14:30 - 2014-09-20 04:33 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-10-15 14:30 - 2014-09-20 02:06 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll
2014-10-15 14:30 - 2014-09-03 03:48 - 00510464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2014-10-15 14:30 - 2014-09-03 03:21 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2014-10-15 14:30 - 2014-07-24 14:50 - 00447296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2014-10-15 14:30 - 2014-07-16 23:59 - 00305664 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvsvc.dll
2014-10-15 14:30 - 2014-07-12 07:45 - 01549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
2014-10-15 14:30 - 2014-07-12 05:36 - 00674304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2014-10-15 14:30 - 2014-07-12 05:36 - 00211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2014-10-15 14:30 - 2014-07-12 05:34 - 00404480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2014-10-15 14:30 - 2014-07-12 05:34 - 00250368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys
2014-10-15 14:30 - 2014-06-28 07:57 - 01341952 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2014-10-15 14:30 - 2014-06-28 03:23 - 01126400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2014-10-15 14:29 - 2014-09-17 23:56 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2014-10-15 14:29 - 2014-08-30 06:48 - 10115072 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-10-15 14:29 - 2014-08-30 06:46 - 02306560 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-10-15 14:29 - 2014-08-30 05:05 - 08858112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-10-15 14:29 - 2014-08-01 23:08 - 00388729 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-10-15 14:29 - 2014-07-17 00:28 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sscore.dll
2014-10-15 14:29 - 2014-07-16 23:59 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\sscore.dll
2014-10-15 14:29 - 2014-06-13 00:29 - 02146304 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2014-10-15 14:28 - 2014-09-18 00:24 - 02416128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2014-10-15 14:28 - 2014-08-30 05:03 - 02037760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-10-15 14:28 - 2014-06-13 00:34 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-07 17:16 - 2012-12-01 20:12 - 00001142 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-07 17:00 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-11-07 16:40 - 2012-11-08 23:24 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-11-07 16:34 - 2014-09-25 11:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-07 16:34 - 2012-11-08 22:00 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1185304261-293873223-3258998266-1001
2014-11-07 15:32 - 2012-11-08 21:01 - 01714792 _____ () C:\WINDOWS\WindowsUpdate.log
2014-11-07 15:13 - 2013-11-13 19:25 - 00000000 ___RD () C:\Users\Mustafa\Dropbox
2014-11-07 15:13 - 2013-11-13 19:22 - 00000000 ____D () C:\Users\Mustafa\AppData\Roaming\Dropbox
2014-11-07 15:13 - 2012-12-01 20:12 - 00001138 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-06 20:49 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-11-06 20:45 - 2013-06-25 02:05 - 00000000 ____D () C:\Temp
2014-11-05 16:04 - 2012-11-08 22:01 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-11-05 16:04 - 2012-11-08 20:53 - 00038232 _____ () C:\WINDOWS\PFRO.log
2014-11-05 16:04 - 2012-07-26 08:22 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-11-05 16:03 - 2012-07-26 06:26 - 01048576 ___SH () C:\WINDOWS\system32\config\BBI
2014-11-04 20:03 - 2012-07-26 06:37 - 00000000 __RHD () C:\Users\Default
2014-11-04 20:00 - 2012-07-26 06:26 - 00000215 _____ () C:\WINDOWS\system.ini
2014-11-04 19:30 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\AUInstallAgent
2014-11-03 21:24 - 2012-10-09 01:33 - 00000000 ____D () C:\Users\Mustafa\Desktop\Alte Firefox-Daten
2014-11-03 18:29 - 2012-07-26 11:27 - 05112182 _____ () C:\WINDOWS\system32\perfh007.dat
2014-11-03 18:29 - 2012-07-26 11:27 - 01508710 _____ () C:\WINDOWS\system32\perfc007.dat
2014-11-03 18:29 - 2012-07-26 08:28 - 00005430 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-11-03 18:17 - 2014-05-31 12:14 - 00000000 ____D () C:\Users\Mustafa\Documents\Speißeplän Recycling
2014-11-03 17:59 - 2012-07-26 09:12 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2014-11-03 17:26 - 2012-11-08 21:54 - 00000000 ____D () C:\WINDOWS\System32\Tasks\WPD
2014-11-03 00:27 - 2012-11-08 23:43 - 00000000 ____D () C:\Users\Mustafa\AppData\Roaming\TS3Client
2014-11-02 22:19 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\rescache
2014-11-01 01:56 - 2013-10-29 17:38 - 00000000 ____D () C:\Users\Mustafa\AppData\Local\Battle.net
2014-10-31 18:31 - 2013-11-11 02:04 - 00000000 ____D () C:\Users\Mustafa\Documents\Messtechnik
2014-10-30 12:25 - 2012-11-10 11:01 - 00275080 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-10-29 19:14 - 2013-10-29 17:39 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-10-28 20:38 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\WinStore
2014-10-26 17:22 - 2014-09-24 16:19 - 00000000 ____D () C:\$Windows.~BT
2014-10-26 13:06 - 2012-11-08 20:57 - 00152403 _____ () C:\WINDOWS\diagwrn.xml
2014-10-26 13:06 - 2012-11-08 20:57 - 00152403 _____ () C:\WINDOWS\diagerr.xml
2014-10-26 13:06 - 2012-07-26 08:21 - 02045102 _____ () C:\WINDOWS\setupact.log
2014-10-26 13:05 - 2012-07-26 09:13 - 00003856 _____ () C:\WINDOWS\DtcInstall.log
2014-10-26 12:58 - 2012-11-08 21:55 - 00019976 _____ () C:\WINDOWS\system32\lvcoinst.log
2014-10-25 23:09 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\Registration
2014-10-25 01:17 - 2013-10-29 17:38 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-10-20 22:45 - 2012-11-09 23:51 - 381125224 _____ () C:\WINDOWS\MEMORY.DMP
2014-10-20 22:45 - 2012-11-09 23:51 - 00000000 ____D () C:\WINDOWS\Minidump
2014-10-19 22:48 - 2012-07-26 06:26 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-10-19 08:58 - 2012-11-08 22:10 - 00000000 ____D () C:\Program Files (x86)\Pando Networks
2014-10-19 01:29 - 2014-07-12 13:08 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-10-19 01:29 - 2012-07-26 09:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-19 01:28 - 2012-07-26 09:12 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-10-18 12:11 - 2012-12-01 20:12 - 00004114 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-18 12:11 - 2012-12-01 20:12 - 00003878 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-17 15:12 - 2013-07-29 02:05 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-10-17 14:47 - 2012-12-12 21:30 - 103265616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Mustafa\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpdawzhh.dll
C:\Users\Mustafa\AppData\Local\Temp\Quarantine.exe
C:\Users\Mustafa\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-11-07 16:39
==================== End Of Log ============================
Und die Addition.txt Datei: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-11-2014
Ran by Mustafa at 2014-11-07 17:38:33
Running from C:\Users\psx1_000\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Botanicula (HKLM-x32\...\Botanicula_is1) (Version: - )
Curse (HKLM-x32\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 6.0.0.0 - Curse)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.46.1.0327 - DT Soft Ltd)
Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
Free YouTube to MP3 Converter version 3.12.20.1230 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.20.1230 - DVDVideoSoft Ltd.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Gone Home version 0.0.0.9 (HKLM-x32\...\Gone Home_is1) (Version: 0.0.0.9 - WaLMaRT)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
IsoBuster 3.2 (HKLM-x32\...\IsoBuster_is1) (Version: 3.2 - Smart Projects)
Java 7 Update 9 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417009FF}) (Version: 7.0.90 - Oracle)
Java 7 Update 9 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217009FF}) (Version: 7.0.90 - Oracle)
Java SE Development Kit 7 Update 9 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170090}) (Version: 1.7.0.90 - Oracle)
JDownloader 2 (HKLM-x32\...\0630-0716-3135-7887) (Version: 2 - AppWork GmbH)
K-Lite Codec Pack 10.0.5 Standard (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.0.5 - )
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office Standard Edition 2003 (HKLM-x32\...\{91120407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
MiKTeX 2.9 (HKLM\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Motorola Device Manager (HKLM-x32\...\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.3.9 - Motorola Mobility)
Motorola Device Software Update (x32 Version: 13.02.1402 - Motorola Mobility) Hidden
Motorola Mobile Drivers Installation 6.0.0 (Version: 6.0.0 - Motorola Inc.) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.2.1 - )
NVIDIA 3D Vision Controller-Treiber 310.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 310.70 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.1031 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Peggle Deluxe (HKLM-x32\...\Peggle Deluxe) (Version: - PopCap Games)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Pokémon Trading Card Game Online (HKLM-x32\...\{496D7B7E-EBDC-4E2B-B021-4FF03B188B69}) (Version: 1.0.0 - The Pokémon Company International)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
scilab-5.4.1 (64-bit) (HKLM\...\scilab-5.4.1 (64-bit)_is1) (Version: - Scilab Enterprises)
SIMetrix Intro (HKLM-x32\...\{5BFD23B6-8060-11DB-96A4-00E08161165F}) (Version: 5.3 - )
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.13.24.g5dbb3103 - Spotify AB)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
TeXnicCenter Version 2.02 Stable (HKLM\...\TeXnicCenter_is1) (Version: 2.02 Stable - The TeXnicCenter Team)
VLC media player 2.0.4 (HKLM-x32\...\VLC media player) (Version: 2.0.4 - VideoLAN)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
XnView 2.03 (HKLM-x32\...\XnView_is1) (Version: 2.03 - Gougelet Pierre-e)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1185304261-293873223-3258998266-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
25-10-2014 13:12:03 Geplanter Prüfpunkt
28-10-2014 19:33:34 Windows Update
03-11-2014 00:14:55 Revo Uninstaller's restore point - Shopping Helper Smartbar
03-11-2014 01:04:05 Wiederherstellungsvorgang
07-11-2014 14:22:04 zoek.exe restore point
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2012-07-26 06:26 - 2014-11-04 20:00 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2766B33F-F759-4DE1-8855-886D9A9D6B98} - System32\Tasks\Motorola Device Manager Engine => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-03-25] ()
Task: {7578D177-23EA-4BD9-9EF0-93F4EB6CFA9D} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-12] (Adobe Systems Incorporated)
Task: {7EB66830-EC26-4A61-A206-642984E10A9C} - System32\Tasks\Motorola Device Manager Initial Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-03-25] ()
Task: {7FACC369-E6EB-48B0-8938-50C086481287} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-01] (Google Inc.)
Task: {9D07BEEE-3ED6-465C-BC27-4516CF80C1A2} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install ping => C:\Windows\system32\AutoUpdate.exe [2014-10-22] (Microsoft Corporation)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {A81F3819-44A3-432B-85C5-E4521D5259D4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-01] (Google Inc.)
Task: {ADC8854E-100B-4E6F-9E87-02447746E27D} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install v2 => C:\WINDOWS\system32\AutoUpdate.exe [2014-10-22] (Microsoft Corporation)
Task: {C65DFB89-9E9F-4870-AADC-880BDD853B9D} - System32\Tasks\Motorola Device Manager Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-03-25] ()
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {DD200DC6-2C22-4A0B-9F12-ABAC1E4B5DD7} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-10-17] (Microsoft Corporation)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-05-15 17:42 - 2014-05-15 17:42 - 00176048 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2013-03-25 20:44 - 2013-03-25 20:44 - 00172032 _____ () C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\css_core.dll
2014-11-07 15:13 - 2014-11-07 15:13 - 00043008 _____ () c:\users\mustafa\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpdawzhh.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Mustafa\AppData\Roaming\Dropbox\bin\libcef.dll
2014-09-25 11:09 - 2014-09-25 11:10 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Mona\Desktop\Bild (11).jpg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Mona\Desktop\Bild (11).jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "StartCCC"
HKCU\...\StartupApproved\StartupFolder: => "OpenOffice.org 3.4.1.lnk"
HKCU\...\StartupApproved\StartupFolder: => "Curse.lnk"
HKCU\...\StartupApproved\Run: => "Pando Media Booster"
HKCU\...\StartupApproved\Run: => "Skype"
HKCU\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKCU\...\StartupApproved\Run: => "Spotify"
HKCU\...\StartupApproved\Run: => "Spotify Web Helper"
HKCU\...\StartupApproved\Run: => "Steam"
========================= Accounts: ==========================
Administrator (S-1-5-21-1185304261-293873223-3258998266-500 - Administrator - Disabled)
Gast (S-1-5-21-1185304261-293873223-3258998266-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1185304261-293873223-3258998266-1002 - Limited - Enabled)
Mona (S-1-5-21-1185304261-293873223-3258998266-1003 - Limited - Enabled) => C:\Users\Mona
Mustafa (S-1-5-21-1185304261-293873223-3258998266-1001 - Administrator - Enabled) => C:\Users\Mustafa
psx1_000 (S-1-5-21-1185304261-293873223-3258998266-1005 - Administrator - Enabled) => C:\Users\psx1_000
UpdatusUser (S-1-5-21-1185304261-293873223-3258998266-1004 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: Videocontroller für Multimedia
Description: Videocontroller für Multimedia
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Coprozessor
Description: Coprozessor
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/07/2014 03:22:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 32.0.3.5379, Zeitstempel: 0x54224e6b
Name des fehlerhaften Moduls: mozalloc.dll, Version: 32.0.3.5379, Zeitstempel: 0x54221b67
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x1478
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
Error: (11/07/2014 03:13:34 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/06/2014 08:46:53 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/05/2014 04:06:09 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/05/2014 03:46:56 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/05/2014 03:31:52 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/04/2014 07:32:23 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Produkt: Adobe Reader XI (11.0.08) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
System errors:
=============
Error: (11/07/2014 03:22:52 PM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "??" wurde eine Beschädigung erkannt.
Die Masterdateitabelle (MFT) beinhaltet einen beschädigten Dateidatensatz. Die Dateireferenznummer ist 0x20000000005ba3. Der Name der Datei ist "\Windows\System32\LogFiles\SQM\SQMLogger.etl.008".
Error: (11/07/2014 03:20:42 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/06/2014 08:48:51 PM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "C:" wurde eine Beschädigung erkannt.
Die Masterdateitabelle (MFT) beinhaltet einen beschädigten Dateidatensatz. Die Dateireferenznummer ist 0x20000000005ba3. Der Name der Datei ist "\Windows\System32\LogFiles\SQM\SQMLogger.etl.008".
Error: (11/05/2014 04:06:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (11/05/2014 04:06:53 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (11/05/2014 04:05:00 PM) (Source: DCOM) (EventID: 10016) (User: Abd-Alla-PC)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Abd-Alla-PCMustafaS-1-5-21-1185304261-293873223-3258998266-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (11/05/2014 04:05:00 PM) (Source: DCOM) (EventID: 10016) (User: Abd-Alla-PC)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Abd-Alla-PCMustafaS-1-5-21-1185304261-293873223-3258998266-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (11/05/2014 04:05:00 PM) (Source: DCOM) (EventID: 10016) (User: Abd-Alla-PC)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}Abd-Alla-PCMustafaS-1-5-21-1185304261-293873223-3258998266-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (11/05/2014 03:52:59 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMScheduler" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/05/2014 03:52:56 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office Sessions:
=========================
Error: (11/07/2014 03:22:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe32.0.3.537954224e6bmozalloc.dll32.0.3.537954221b67800000030000141b147801cffa950d1cb4dbC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll8a2e9ea8-6689-11e4-80a8-002421dec74c
Error: (11/07/2014 03:13:34 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/06/2014 08:46:53 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/05/2014 04:06:09 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/05/2014 03:46:56 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/05/2014 03:31:52 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/04/2014 07:32:23 PM) (Source: MsiInstaller) (EventID: 1024) (User: Abd-Alla-PC)
Description: Adobe Reader XI (11.0.08) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F2030000E5050000
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance163707000000000000000000008F020000
Error: (11/03/2014 06:29:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance163707000000000000000000008F020000
CodeIntegrity Errors:
===================================
Date: 2014-11-04 19:59:40.409
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Quad CPU Q8200 @ 2.33GHz
Percentage of memory in use: 39%
Total physical RAM: 4094.99 MB
Available physical RAM: 2457.68 MB
Total Pagefile: 8191.24 MB
Available Pagefile: 6235.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:1220.5 GB) (Free:860.44 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397.3 GB) (Disk ID: FCD6DD83)
Partition 1: (Not Active) - (Size=11.7 GB) - (Type=27)
Partition 2: (Active) - (Size=164.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1220.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
07.11.2014, 17:48
| #14 |
| /// TB-Ausbilder | "Obrona VPN Deals" loswerden Wir entfernen die letzten Reste und kontrollieren nochmal alles. EEK und ESET können länger (> 2 h) dauern. Im Anschluss entfernen wir alle verwendeten Tools und ich gebe dir noch ein paar Tipps mit auf den Weg. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1185304261-293873223-3258998266-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1185304261-293873223-3258998266-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
EmptyTemp:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Lade Dir bitte von hier  Emsisoft Emergency Kit herunter.
Schritt 3 ESET Online Scanner
Schritt 4 Downloade Dir bitte  SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
|
07.11.2014, 18:45
| #15 |
| | "Obrona VPN Deals" loswerden Guten Abend, ich habe ein kleine(s) Problem/Frage. Schritt 1: Fixlog.txt Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-11-2014
Ran by Mustafa at 2014-11-07 18:24:25 Run:2
Running from C:\Users\psx1_000\Downloads
Loaded Profiles: Mustafa & (Available profiles: Mustafa & Mona & UpdatusUser & psx1_000)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1185304261-293873223-3258998266-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1185304261-293873223-3258998266-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
EmptyTemp:
end
*****************
Processes closed successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-1185304261-293873223-3258998266-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-1185304261-293873223-3258998266-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
EmptyTemp: => Removed 939.7 MB temporary data.
The system needed a reboot.
==== End of Fixlog ====
Soll ich EEK jetzt in diesen Ordner installieren oder es auf den Desktop probieren? |
|
Linear-Darstellung
