Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   White screen nach normalem Boot, Abgesichert mit Netzwerktreibern bootet anschliessend neu (https://www.trojaner-board.de/141398-white-screen-normalem-boot-abgesichert-netzwerktreibern-bootet-anschliessend-neu.html)

Schmittchen 12.09.2013 10:24
White screen nach normalem Boot, Abgesichert mit Netzwerktreibern bootet anschliessend neu
 
Guten Morgen

Habe mir heute Morgen einen Trojaner [durch Dummheit :) ] aufgeladen der von McAfee nicht erkannt wurde.
Die Symptome sind die folgenden:

- Windows normal booten: White screen nach kurzem Hintergrundbild
- Windows in abgesichertem Modus mit Netzwerktreibern: bootet anschliessend neu
- Windows in abgesichertem Modus mit Eingabeaufforderung: funktioniert
- Computer reparieren: funktioniert

Habe bereits Log von FRST64 gespeichert:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-09-2013 02
Ran by SYSTEM on MININT-VLDBNM2 on 12-09-2013 10:55:54
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [626552 2012-04-09] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-02-14] (IDT, Inc.)
HKLM\...\Run: [QuickSet] - c:\Program Files\Dell\QuickSet\QuickSet.exe [4365984 2012-03-12] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [IntelMyWiFiDashboard] - C:\Program Files\Intel\WiFi\bin\CCDashServer.exe [4966912 2012-03-30] (Intel® Corporation)
HKLM\...\Run: [BLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [120592 2012-01-10] ()
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [577024 2012-03-06] (Creative Technology Ltd)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [76872 2012-03-27] (cyberlink)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [NeroLauncher] - C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe [67496 2012-08-21] ()
HKLM-x32\...\Run: [AccuWeatherWidget] - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj [2835443 2012-02-01] ()
HKLM-x32\...\Run: [SweetIM] - C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe [115032 2012-05-29] (SweetIM Technologies Ltd.)
HKLM-x32\...\Run: [Sweetpacks Communicator] - C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe [231768 2012-08-15] (SweetIM Technologies Ltd.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKU\Roman Schmid\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671904 2012-08-28] (DT Soft Ltd)
HKU\Roman Schmid\...\Winlogon: [Shell] explorer.exe,C:\Users\Roman Schmid\AppData\Roaming\cache.dat [142848 2013-08-02] () <==== ATTENTION
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll  [ ] ()

==================== Services (Whitelisted) =================

S2 CLKMSVC10_9EC60124; C:\Program Files (x86)\Cyberlink\PowerDVD9\NavFilter\kmsvc.exe [242448 2012-03-27] (CyberLink)
S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 IBUpdaterService; C:\Windows\system32\dmwu.exe [1447728 2013-05-21] ()
S2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193536 2012-03-28] (Intel Corporation)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [224704 2011-03-08] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [246112 2013-06-20] ()
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-03-29] ()
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-27] ()
S2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [174656 2006-11-02] ()
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-03-29] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-10-17] (DT Soft Ltd)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
S3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-03-28] (Intel Corporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
S5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2013-06-20] (Huawei Technologies Co., Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-12 09:19 - 2013-09-12 09:43 - 00000004 _____ C:\Users\Roman Schmid\AppData\Roaming\cache.ini
2013-09-12 02:08 - 2013-08-10 06:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-12 02:08 - 2013-08-10 06:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-12 02:08 - 2013-08-10 06:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-09-12 02:08 - 2013-08-10 06:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-12 02:08 - 2013-08-10 06:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-12 02:08 - 2013-08-10 06:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-12 02:08 - 2013-08-10 06:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-12 02:08 - 2013-08-10 06:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-12 02:08 - 2013-08-10 06:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-12 02:08 - 2013-08-10 06:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-12 02:08 - 2013-08-10 06:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-09-12 02:08 - 2013-08-10 06:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-09-12 02:08 - 2013-08-10 06:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-09-12 02:08 - 2013-08-10 06:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-09-12 02:08 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 02:08 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 02:08 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 02:08 - 2013-08-10 04:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-12 02:08 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 02:08 - 2013-08-10 03:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-09-12 02:08 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 00:11 - 2013-09-12 00:11 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Chromium
2013-09-12 00:07 - 2013-09-12 00:07 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\The Lord of the Rings Online
2013-09-12 00:01 - 2013-09-12 00:02 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Turbine
2013-09-12 00:01 - 2013-09-12 00:01 - 00001950 _____ C:\Users\Roman Schmid\Desktop\Der Herr der Ringe Online™.lnk
2013-09-12 00:00 - 2013-09-12 00:10 - 00000000 ____D C:\Users\Roman Schmid\Documents\The Lord of the Rings Online
2013-09-11 23:55 - 2013-09-11 23:55 - 00000000 ____D C:\ProgramData\Turbine
2013-09-11 23:54 - 2013-09-12 00:11 - 00000000 ____D C:\ProgramData\HappyCloud
2013-09-11 21:14 - 2013-08-08 02:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-09-11 21:14 - 2013-08-05 03:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2013-09-11 21:14 - 2013-08-02 03:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-09-11 21:14 - 2013-08-02 03:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-09-11 21:14 - 2013-08-02 03:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\System32\wow64win.dll
2013-09-11 21:14 - 2013-08-02 03:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2013-09-11 21:14 - 2013-08-02 03:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll
2013-09-11 21:14 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2013-09-11 21:14 - 2013-08-02 03:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll
2013-09-11 21:14 - 2013-08-02 03:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-09-11 21:14 - 2013-08-02 03:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\apisetschema.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-11 21:14 - 2013-08-02 02:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-11 21:14 - 2013-08-02 02:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-11 21:14 - 2013-08-02 02:51 - 00142848 _____ C:\Users\Roman Schmid\AppData\Roaming\cache.dat
2013-09-11 21:14 - 2013-08-02 02:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-11 21:14 - 2013-08-02 02:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-11 21:14 - 2013-08-02 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2013-09-11 21:14 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\System32\smss.exe
2013-09-11 21:14 - 2013-08-02 01:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-11 21:14 - 2013-08-02 01:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-11 21:14 - 2013-08-02 01:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-11 21:14 - 2013-08-02 01:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-11 21:14 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 21:14 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 21:14 - 2013-07-26 03:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-09-11 21:14 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-09-11 21:14 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-11 21:14 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 13:02 - 2013-09-11 13:02 - 00000000 ____D C:\Users\Roman Schmid\Desktop\Games
2013-09-11 11:18 - 2013-09-11 11:18 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-11 11:18 - 2013-09-11 11:18 - 00000000 ____D C:\Program Files\iTunes
2013-09-11 11:18 - 2013-09-11 11:18 - 00000000 ____D C:\Program Files\iPod
2013-09-11 11:17 - 2013-09-11 12:17 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\download.am-data
2013-09-11 11:17 - 2013-09-11 12:03 - 00000000 ____D C:\Program Files (x86)\Download.am
2013-09-11 11:17 - 2013-09-11 11:38 - 00000000 ____D C:\Users\Roman Schmid\Downloads\Download.am
2013-08-27 23:17 - 2013-08-27 23:17 - 00001159 _____ C:\Users\Roman Schmid\Desktop\farcry3.lnk
2013-08-27 23:09 - 2013-08-27 23:09 - 00000000 ____D C:\Users\Roman Schmid\Documents\My Games
2013-08-27 23:09 - 2013-08-27 23:09 - 00000000 ____D C:\ProgramData\Orbit
2013-08-27 23:06 - 2013-08-27 23:06 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-08-27 07:50 - 2013-08-27 07:50 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-08-18 12:25 - 2013-08-18 12:25 - 00000000 ___HD C:\Program Files (x86)\Zero G Registry
2013-08-18 12:25 - 2013-08-18 12:25 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Solarmax
2013-08-18 12:25 - 2013-08-18 12:25 - 00000000 ____D C:\Program Files (x86)\Solarmax
2013-08-18 12:24 - 2013-08-18 12:24 - 00000000 ___HD C:\Users\Roman Schmid\InstallAnywhere
2013-08-18 11:56 - 2013-08-18 11:56 - 00000000 ____D C:\Users\Roman Schmid\Documents\SolarMax
2013-08-17 21:06 - 2013-08-17 21:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 20:57 - 2013-08-17 20:57 - 00000000 ____D C:\ProgramData\Steam
2013-08-14 02:01 - 2013-09-12 02:06 - 00000000 ____D C:\Windows\System32\MRT
2013-08-13 21:44 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-13 21:44 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-13 21:44 - 2013-07-19 02:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-13 21:44 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-13 21:44 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-13 21:44 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-13 21:44 - 2013-07-09 06:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-13 21:44 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-13 21:44 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-13 21:44 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-13 21:44 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-13 21:44 - 2013-07-09 05:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-13 21:44 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-13 21:44 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-13 21:43 - 2013-07-06 07:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-13 21:43 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-12 09:46 - 2010-11-21 07:50 - 00696620 _____ C:\Windows\System32\perfh007.dat
2013-09-12 09:46 - 2010-11-21 07:50 - 00147916 _____ C:\Windows\System32\perfc007.dat
2013-09-12 09:46 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-12 09:43 - 2013-09-12 09:19 - 00000004 _____ C:\Users\Roman Schmid\AppData\Roaming\cache.ini
2013-09-12 09:43 - 2012-10-02 22:57 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-09-12 09:43 - 2012-10-02 15:20 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-12 09:43 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-12 09:43 - 2009-07-14 05:51 - 00065421 _____ C:\Windows\setupact.log
2013-09-12 09:42 - 2012-10-29 20:06 - 00001118 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-12 09:42 - 2012-10-15 19:12 - 00000426 ____H C:\Windows\Tasks\OptimizerPro1UpdaterTask{870BA444-6012-4990-89E9-5B53916A4E0D}.job
2013-09-12 09:26 - 2012-10-29 20:06 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-12 09:07 - 2012-10-02 15:20 - 01436747 _____ C:\Windows\WindowsUpdate.log
2013-09-12 09:06 - 2012-10-08 16:02 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Nero
2013-09-12 08:37 - 2012-10-02 22:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-12 02:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-09-12 02:34 - 2009-07-14 05:45 - 00021296 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-12 02:34 - 2009-07-14 05:45 - 00021296 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-12 02:26 - 2009-07-14 05:45 - 00349504 _____ C:\Windows\System32\FNTCACHE.DAT
2013-09-12 02:25 - 2010-11-21 04:47 - 00078142 _____ C:\Windows\PFRO.log
2013-09-12 02:08 - 2013-08-14 02:01 - 00000000 ____D C:\Windows\System32\MRT
2013-09-12 02:06 - 2012-10-09 09:27 - 79143768 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-09-12 02:06 - 2012-10-08 17:57 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 00:11 - 2013-09-12 00:11 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Chromium
2013-09-12 00:11 - 2013-09-11 23:54 - 00000000 ____D C:\ProgramData\HappyCloud
2013-09-12 00:10 - 2013-09-12 00:00 - 00000000 ____D C:\Users\Roman Schmid\Documents\The Lord of the Rings Online
2013-09-12 00:07 - 2013-09-12 00:07 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\The Lord of the Rings Online
2013-09-12 00:02 - 2013-09-12 00:01 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Turbine
2013-09-12 00:01 - 2013-09-12 00:01 - 00001950 _____ C:\Users\Roman Schmid\Desktop\Der Herr der Ringe Online™.lnk
2013-09-11 23:55 - 2013-09-11 23:55 - 00000000 ____D C:\ProgramData\Turbine
2013-09-11 23:03 - 2012-10-02 23:14 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-09-11 18:48 - 2012-10-08 23:01 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-11 18:48 - 2012-10-08 22:10 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-09-11 13:10 - 2012-10-08 23:01 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-09-11 13:02 - 2013-09-11 13:02 - 00000000 ____D C:\Users\Roman Schmid\Desktop\Games
2013-09-11 12:37 - 2012-10-02 22:26 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-11 12:37 - 2012-10-02 22:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-11 12:37 - 2012-10-02 22:26 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-11 12:17 - 2013-09-11 11:17 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\download.am-data
2013-09-11 12:03 - 2013-09-11 11:17 - 00000000 ____D C:\Program Files (x86)\Download.am
2013-09-11 11:38 - 2013-09-11 11:17 - 00000000 ____D C:\Users\Roman Schmid\Downloads\Download.am
2013-09-11 11:18 - 2013-09-11 11:18 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-11 11:18 - 2013-09-11 11:18 - 00000000 ____D C:\Program Files\iTunes
2013-09-11 11:18 - 2013-09-11 11:18 - 00000000 ____D C:\Program Files\iPod
2013-09-11 11:18 - 2013-06-18 12:08 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-28 13:22 - 2012-10-16 18:21 - 00000000 ____D C:\Users\Roman Schmid\Documents\Citavi 3
2013-08-27 23:17 - 2013-08-27 23:17 - 00001159 _____ C:\Users\Roman Schmid\Desktop\farcry3.lnk
2013-08-27 23:10 - 2012-10-08 22:09 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\PunkBuster
2013-08-27 23:09 - 2013-08-27 23:09 - 00000000 ____D C:\Users\Roman Schmid\Documents\My Games
2013-08-27 23:09 - 2013-08-27 23:09 - 00000000 ____D C:\ProgramData\Orbit
2013-08-27 23:08 - 2013-05-11 21:37 - 00000000 ____D C:\Games
2013-08-27 23:06 - 2013-08-27 23:06 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-08-27 23:06 - 2012-10-08 23:01 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-27 23:06 - 2012-10-02 23:06 - 00100005 _____ C:\Windows\DirectX.log
2013-08-27 23:01 - 2012-10-02 22:39 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-27 07:50 - 2013-08-27 07:50 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-08-25 09:50 - 2013-01-20 18:47 - 00000000 ____D C:\Program Files (x86)\Need For Speed World
2013-08-19 16:30 - 2012-10-08 21:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-18 12:25 - 2013-08-18 12:25 - 00000000 ___HD C:\Program Files (x86)\Zero G Registry
2013-08-18 12:25 - 2013-08-18 12:25 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Solarmax
2013-08-18 12:25 - 2013-08-18 12:25 - 00000000 ____D C:\Program Files (x86)\Solarmax
2013-08-18 12:24 - 2013-08-18 12:24 - 00000000 ___HD C:\Users\Roman Schmid\InstallAnywhere
2013-08-18 12:24 - 2012-10-08 15:53 - 00000000 ____D C:\users\Roman Schmid
2013-08-18 11:56 - 2013-08-18 11:56 - 00000000 ____D C:\Users\Roman Schmid\Documents\SolarMax
2013-08-17 21:12 - 2012-10-02 23:13 - 00000000 ____D C:\ProgramData\McAfee
2013-08-17 21:06 - 2013-08-17 21:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 20:57 - 2013-08-17 20:57 - 00000000 ____D C:\ProgramData\Steam

Files to move or delete:
====================
C:\Users\Roman Schmid\AppData\Roaming\cache.dat
C:\Users\Roman Schmid\AppData\Roaming\cache.ini
C:\Users\Roman Schmid\AppData\Local\Temp\40374-92077-magic-the-gathering-online-trial.exe
C:\Users\Roman Schmid\AppData\Local\Temp\7iam2nde.dll
C:\Users\Roman Schmid\AppData\Local\Temp\coupish.exe
C:\Users\Roman Schmid\AppData\Local\Temp\DeltaTB.exe
C:\Users\Roman Schmid\AppData\Local\Temp\gert0.exe
C:\Users\Roman Schmid\AppData\Local\Temp\goe-nxv9.dll
C:\Users\Roman Schmid\AppData\Local\Temp\i9lxziau.dll
C:\Users\Roman Schmid\AppData\Local\Temp\ICReinstall_ICReinstall_JDownloaderSetup_CH3.exe
C:\Users\Roman Schmid\AppData\Local\Temp\ICReinstall_JDownloaderSetup_CH3.exe
C:\Users\Roman Schmid\AppData\Local\Temp\instloffer.exe
C:\Users\Roman Schmid\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Roman Schmid\AppData\Local\Temp\mgsqlite3.dll
C:\Users\Roman Schmid\AppData\Local\Temp\pyl1ADF.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl21C2.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl2FC.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl41DF.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl5CB1.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl7187.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl7290.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl8593.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl85C2.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl89E7.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl8EB7.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl93D5.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl9D97.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylA478.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylA6C9.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylAD2F.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylB930.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylBC2F.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylBE6E.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylC30.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylC551.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylD7D7.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylD825.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylE031.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylE197.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylE8B8.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe
C:\Users\Roman Schmid\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Roman Schmid\AppData\Local\Temp\sqlite-3.6.23.1-sqlitejdbc.dll
C:\Users\Roman Schmid\AppData\Local\Temp\u08ylkhe.dll
C:\Users\Roman Schmid\AppData\Local\Temp\VirtualRouterPlusSetup.exe

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-08-27 23:01:33
Restore point made on: 2013-08-29 02:00:25
Restore point made on: 2013-09-11 11:51:55
Restore point made on: 2013-09-11 23:58:17
Restore point made on: 2013-09-11 23:58:40
Restore point made on: 2013-09-12 02:00:38

==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 8119.32 MB
Available physical RAM: 7281.81 MB
Total Pagefile: 8117.52 MB
Available Pagefile: 7274.3 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:678.78 GB) (Free:577.69 GB) NTFS
Drive d: (DATAPART1) (Fixed) (Total:698.63 GB) (Free:595.38 GB) NTFS
Drive f: (RECOVERY) (Fixed) (Total:19.81 GB) (Free:6.08 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (USB DISK) (Removable) (Total:14.91 GB) (Free:0.64 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 699 GB) (Disk ID: E93DBE4F)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=679 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: E93DBE72)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 8 GB) (Disk ID: E93DBF80)
Partition 1: (Not Active) - (Size=8 GB) - (Type=84)

========================================================
Disk: 3 (Size: 15 GB) (Disk ID: C35E27B3)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)


LastRegBack: 2013-09-11 11:44

==================== End Of Log ============================
Hoffe habe alles richtig geschildert :)
Freundliche Grüsse aus der Not

schrauber 12.09.2013 10:50
hi,

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\Roman Schmid\...\Winlogon: [Shell] explorer.exe,C:\Users\Roman Schmid\AppData\Roaming\cache.dat [142848 2013-08-02] () <==== ATTENTION
C:\Users\Roman Schmid\AppData\Roaming\cache.dat
C:\Users\Roman Schmid\AppData\Roaming\cache.ini
C:\Users\Roman Schmid\AppData\Local\Temp\40374-92077-magic-the-gathering-online-trial.exe
C:\Users\Roman Schmid\AppData\Local\Temp\7iam2nde.dll
C:\Users\Roman Schmid\AppData\Local\Temp\coupish.exe
C:\Users\Roman Schmid\AppData\Local\Temp\DeltaTB.exe
C:\Users\Roman Schmid\AppData\Local\Temp\gert0.exe
C:\Users\Roman Schmid\AppData\Local\Temp\goe-nxv9.dll
C:\Users\Roman Schmid\AppData\Local\Temp\i9lxziau.dll
C:\Users\Roman Schmid\AppData\Local\Temp\ICReinstall_ICReinstall_JDownloaderSetup_CH3.exe
C:\Users\Roman Schmid\AppData\Local\Temp\ICReinstall_JDownloaderSetup_CH3.exe
C:\Users\Roman Schmid\AppData\Local\Temp\instloffer.exe
C:\Users\Roman Schmid\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Roman Schmid\AppData\Local\Temp\mgsqlite3.dll
C:\Users\Roman Schmid\AppData\Local\Temp\pyl1ADF.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl21C2.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl2FC.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl41DF.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl5CB1.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl7187.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl7290.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl8593.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl85C2.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl89E7.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl8EB7.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl93D5.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl9D97.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylA478.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylA6C9.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylAD2F.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylB930.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylBC2F.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylBE6E.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylC30.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylC551.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylD7D7.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylD825.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylE031.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylE197.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylE8B8.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe
C:\Users\Roman Schmid\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Roman Schmid\AppData\Local\Temp\sqlite-3.6.23.1-sqlitejdbc.dll
C:\Users\Roman Schmid\AppData\Local\Temp\u08ylkhe.dll
C:\Users\Roman Schmid\AppData\Local\Temp\VirtualRouterPlusSetup.exe
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


Rechner normal starten.

Schmittchen 12.09.2013 11:27
Hey,

Besten Dank für die rasche Antwort! Hier die Textdatei:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-09-2013 02
Ran by SYSTEM at 2013-09-12 12:24:52 Run:1
Running from G:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKU\Roman Schmid\...\Winlogon: [Shell] explorer.exe,C:\Users\Roman Schmid\AppData\Roaming\cache.dat [142848 2013-08-02] () <==== ATTENTION
C:\Users\Roman Schmid\AppData\Roaming\cache.dat
C:\Users\Roman Schmid\AppData\Roaming\cache.ini
C:\Users\Roman Schmid\AppData\Local\Temp\40374-92077-magic-the-gathering-online-trial.exe
C:\Users\Roman Schmid\AppData\Local\Temp\7iam2nde.dll
C:\Users\Roman Schmid\AppData\Local\Temp\coupish.exe
C:\Users\Roman Schmid\AppData\Local\Temp\DeltaTB.exe
C:\Users\Roman Schmid\AppData\Local\Temp\gert0.exe
C:\Users\Roman Schmid\AppData\Local\Temp\goe-nxv9.dll
C:\Users\Roman Schmid\AppData\Local\Temp\i9lxziau.dll
C:\Users\Roman Schmid\AppData\Local\Temp\ICReinstall_ICReinstall_JDownloaderSetup_CH3.exe
C:\Users\Roman Schmid\AppData\Local\Temp\ICReinstall_JDownloaderSetup_CH3.exe
C:\Users\Roman Schmid\AppData\Local\Temp\instloffer.exe
C:\Users\Roman Schmid\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Roman Schmid\AppData\Local\Temp\mgsqlite3.dll
C:\Users\Roman Schmid\AppData\Local\Temp\pyl1ADF.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl21C2.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl2FC.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl41DF.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl5CB1.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl7187.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl7290.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl8593.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl85C2.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl89E7.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl8EB7.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl93D5.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pyl9D97.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylA478.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylA6C9.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylAD2F.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylB930.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylBC2F.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylBE6E.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylC30.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylC551.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylD7D7.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylD825.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylE031.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylE197.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\pylE8B8.tmp.exe
C:\Users\Roman Schmid\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe
C:\Users\Roman Schmid\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Roman Schmid\AppData\Local\Temp\sqlite-3.6.23.1-sqlitejdbc.dll
C:\Users\Roman Schmid\AppData\Local\Temp\u08ylkhe.dll
C:\Users\Roman Schmid\AppData\Local\Temp\VirtualRouterPlusSetup.exe
*****************

HKU\Roman Schmid\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\Users\Roman Schmid\AppData\Roaming\cache.dat => Moved successfully.
C:\Users\Roman Schmid\AppData\Roaming\cache.ini => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\40374-92077-magic-the-gathering-online-trial.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\7iam2nde.dll => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\coupish.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\DeltaTB.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\gert0.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\goe-nxv9.dll => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\i9lxziau.dll => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\ICReinstall_ICReinstall_JDownloaderSetup_CH3.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\ICReinstall_JDownloaderSetup_CH3.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\instloffer.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\mgsqlite3.dll => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl1ADF.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl21C2.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl2FC.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl41DF.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl5CB1.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl7187.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl7290.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl8593.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl85C2.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl89E7.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl8EB7.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl93D5.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pyl9D97.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylA478.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylA6C9.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylAD2F.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylB930.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylBC2F.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylBE6E.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylC30.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylC551.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylD7D7.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylD825.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylE031.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylE197.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\pylE8B8.tmp.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\SIMEEIInstaller.exe => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\sqlite-3.6.23.1-sqlitejdbc.dll => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\u08ylkhe.dll => Moved successfully.
C:\Users\Roman Schmid\AppData\Local\Temp\VirtualRouterPlusSetup.exe => Moved successfully.

==== End of Fixlog ====

schrauber 12.09.2013 11:30
Rechner startet normal? Wenn ja dann ab jetzt alles im normalen Modus:

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Schmittchen 12.09.2013 12:19
Ja der Rechner hat nbormal gestartet! Schonmal ein Erfolg!^^
die ersten zwei Logs:

Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.12.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
Roman Schmid :: ROMANSCHMID-PC [Administrator]

Schutz: Aktiviert

12.09.2013 12:38:07
mbam-log-2013-09-12 (12-38-07).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 247604
Laufzeit: 5 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 2
C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (PUP.Optional.SweetIM) -> 5676 -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (PUP.Optional.SweetIM) -> 5720 -> Löschen bei Neustart.

Infizierte Speichermodule: 12
C:\Program Files (x86)\SweetIM\Messenger\mgAdaptersProxy.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgUpdateSupport.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgsimcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgcommunication.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mghooking.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgxml_wrapper.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgconfig.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Communicator\mgcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Communicator\mgxml_wrapper.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Communicator\mgcommunication.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Communicator\mgsimcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.

Infizierte Registrierungsschlüssel: 55
HKCR\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\escort.escortIEPane.1 (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\escort.escortIEPane (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\delta.deltaHlpr.1 (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\delta.deltaHlpr (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\SWEETIE.IEToolbar.1 (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\SWEETIE.IEToolbar (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Toolbar3.SWEETIE.1 (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Toolbar3.SWEETIE (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\esrv.deltaESrvc.1 (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\esrv.deltaESrvc (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\delta.deltadskBnd.1 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\delta.deltadskBnd (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Typelib\{4599D05A-D545-4069-BB42-5895B4EAE05B} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{1231839B-064E-4788-B865-465A1B5266FD} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\DELTA\DELTA (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SYSTEM\CurrentControlSet\Services\IBUpdaterService (Adware.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\delta.deltaappCore.1 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\delta.deltaappCore (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\d (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 11
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|SweetIM (PUP.Optional.SweetIM) -> Daten: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Sweetpacks Communicator (PUP.Optional.SweetIM) -> Daten: C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{EEE6C35B-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Daten: Delta Toolbar -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Delta\Delta|tlbrSrchUrl (PUP.Optional.Delta.A) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|bProtector Start Page (PUP.BProtector) -> Daten: hxxp://search.babylon.com/?babsrc=HP_ss_din2g&mntrId=40A4001E101F50A4&affID=44444&tsp=4919 -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|bProtectorDefaultScope (PUP.BProtector) -> Daten: {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0ZtGyEtH1G1NtGtBtH0A0FtHtItGzt -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: {678DAAB7-2035-11E2-99A6-84A6C841E186} -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: {678DAAB7-2035-11E2-99A6-84A6C841E186} -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 14
C:\Users\Roman Schmid\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution\CR (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution\Shared (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Delta\delta\1.8.21.5 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Delta\delta\1.8.21.5\bh (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.21.5 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 64
C:\Program Files (x86)\SweetIM\Messenger\mgAdaptersProxy.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgUpdateSupport.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgsimcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgcommunication.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mghooking.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgxml_wrapper.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgconfig.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Communicator\mgcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Communicator\mgxml_wrapper.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Communicator\mgcommunication.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Communicator\mgsimcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltasrv.exe (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution\Shared\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\5_NeJr8j.exe.part (Trojan.FakeAV) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\c7iXFE8m.exe.part (PUP.Optional.Vittalia) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\tLHMM+m0.exe.part (Trojan.FakeAV) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\x2SGIMjF.exe.part (Trojan.FakeAV) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\2827278562\chromeupdaterfull.exe (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\B3FC4C32-BAB0-7891-B03D-B954F818A4C3\Latest\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\B3FC4C32-BAB0-7891-B03D-B954F818A4C3\Latest\MyDeltaTB.exe (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\B3FC4C32-BAB0-7891-B03D-B954F818A4C3\Latest\Setup.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\bus8FE0\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\is1070216317\bundlesweetimsetup.exe (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\updA016\BabMaint.x (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\346e6.msi (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\346ec.msi (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\346f2.msi (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Local\Temp\blabbers-ff-le.xpi (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\OptimizerPro.chm (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bl (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.settings (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\dm (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\00 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\01 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\02 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\03 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\10 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\11 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\12 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\13 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\20 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\21 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\22 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\23 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution\CR\Delta.crx (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution\Shared\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution\Shared\chu.js (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution\Shared\Delta.ico (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution\Shared\GUninstaller.exe (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution\Shared\SetupParams.ini (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Roman Schmid\AppData\Roaming\BabSolution\Shared\sqlite3.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaApp.dll (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaEng.dll (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Delta\delta\1.8.21.5\GUninstaller.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Delta\delta\1.8.21.5\uninstall.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Code:
# AdwCleaner v3.003 - Bericht erstellt am 12/09/2013 um 12:48:29
# Updated 07/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Roman Schmid - ROMANSCHMID-PC
# Gestartet von : D:\Download\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BrowserDefender
Ordner Gelöscht : C:\ProgramData\Premium
Ordner Gelöscht : C:\ProgramData\SweetIM
Ordner Gelöscht : C:\ProgramData\Bcool
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bcool
Ordner Gelöscht : C:\Program Files (x86)\BrowserCompanion
Ordner Gelöscht : C:\Program Files (x86)\delta
Ordner Gelöscht : C:\Program Files (x86)\SweetIM
Ordner Gelöscht : C:\Windows\SysWOW64\ARFC
Ordner Gelöscht : C:\Windows\SysWOW64\jmdp
Ordner Gelöscht : C:\Windows\SysWOW64\WNLT
Ordner Gelöscht : C:\Users\Roman Schmid\AppData\LocalLow\Bcool
Ordner Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\BrowserCompanion
Ordner Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender
Ordner Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\SweetPacksToolbarData
Ordner Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\Extensions\ffxtlbr@delta.com
Ordner Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\Extensions\507c5399c27e7@507c5399c2820.com
Datei Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
Datei Gelöscht : C:\Windows\System32\dmwu.exe
Datei Gelöscht : C:\Windows\System32\ImhxxpComm.dll
Datei Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\bprotector_prefs.js
Datei Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\searchplugins\Babylon.xml
Datei Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\searchplugins\BrowserDefender.xml
Datei Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\searchplugins\delta.xml
Datei Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\searchplugins\MyStart.xml
Datei Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\searchplugins\SweetIm.xml
Datei Gelöscht : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\BrowserDefendert
Datei Gelöscht : C:\Windows\System32\Tasks\EPUpdater

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\nepadcndkofccakdfoabecfbfhjgdaoj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sim-packages
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]
Schlüssel Gelöscht : HKCU\Software\5f68fdde16aea46
Schlüssel Gelöscht : HKLM\SOFTWARE\5f68fdde16aea46
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_airstrike-3d_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_airstrike-3d_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_jdownloader_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_jdownloader_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{35E00A5C-0D09-C606-519C-C45D3F846D40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35E00A5C-0D09-C606-519C-C45D3F846D40}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{35E00A5C-0D09-C606-519C-C45D3F846D40}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{35E00A5C-0D09-C606-519C-C45D3F846D40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\BI
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\WNLT
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{20E7BC40-33F6-4A81-9D52-B58349326206}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7683B745-6060-41FD-AA75-0BBB383FEAD4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EA8FA6BE-29BE-4AF2-9352-841F83215EB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\WNLT
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16686

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v23.0.1 (de)

[ Datei : C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "40a4ef67000000000000001e101f50a4");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15876");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.21.5");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.21.523:33:36");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.21.5");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=44444&tsp=4919");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
Zeile gelöscht : user_pref("sweetim.toolbar.RevertDialog.enable", "false");
Zeile gelöscht : user_pref("sweetim.toolbar.UserSelectedSaveSettings", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.Visibility.VisibilityGuardLastUnHide", "0");
Zeile gelöscht : user_pref("sweetim.toolbar.Visibility.enable", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.Visibility.intervaldays", "7");
Zeile gelöscht : user_pref("sweetim.toolbar.cda.DisableOveride.enable", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.cda.HideOveride.enable", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.cda.RemoveOveride.enable", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.cda.returnValue", "none");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.0.enable", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.0.handler", "chrome://sim_toolbar_package/content/optionsdialog-handler.js");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.0.height", "335");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.0.id", "id_options_dialog");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.0.title", "$string.config.label;");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.0.url", "hxxp://www.sweetim.com/simffbar/options_remote_ff.asp?lang=$locale_id;&toolbar_version=$ITEM_VERSION;&crg=$cargo;");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.0.width", "761");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.1.enable", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.1.handler", "chrome://sim_toolbar_package/content/exampledialog-handler.js");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.1.height", "300");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.1.id", "id_example_dialog");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.1.title", "Example (unit-test) dialog");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.1.url", "chrome://sim_toolbar_package/content/exampledialog.html");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.1.width", "500");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.2.enable", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.2.handler", "chrome://sim_toolbar_package/content/cdadialog-handler.js");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.2.height", "150");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.2.id", "id_dialog_hide_disable_remove");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.2.title", "Option Dialog");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.2.url", "hxxp://www.sweetim.com/simffbar/simcdadialog.asp");
Zeile gelöscht : user_pref("sweetim.toolbar.dialogs.2.width", "530");
Zeile gelöscht : user_pref("sweetim.toolbar.dnscatch.domain-blacklist", ".*.sweetim.com/.*|.*.facebook.com/.*|.*.google.com/.*|.*.google.co.in/.*|.*.google.com.br/.*|.*.google.es/.*|.*.youtube.com/.*|.*.yahoo.com/.*|.[...]
Zeile gelöscht : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
Zeile gelöscht : user_pref("sweetim.toolbar.keywordUrlGuard.enable", "false");
Zeile gelöscht : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
Zeile gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
Zeile gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
Zeile gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
Zeile gelöscht : user_pref("sweetim.toolbar.mode.debug", "false");
Zeile gelöscht : user_pref("sweetim.toolbar.newtab.created", "false");
Zeile gelöscht : user_pref("sweetim.toolbar.newtab.enable", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Zeile gelöscht : user_pref("sweetim.toolbar.rc.url", "hxxp://www.sweetim.com/simffbar/rc.html?toolbar_version=$ITEM_VERSION;&crg=$cargo;");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.0.addcontextdiv", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.0.callback", "simVerification");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.0.domain-blacklist", "");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.0.elementid", "id_script_sim_fb");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.0.enable", "false");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.0.id", "id_script_fb");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.0.url", "hxxp://sc.sweetim.com/apps/in/fb/infb.js");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.addcontextdiv", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.callback", "simVerification");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.elementid", "id_script_sim_fb");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.enable", "false");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.id", "id_script_fb_hxxpS");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.url", "hxxps://sc.sweetim.com/apps/in/fb/infb.js");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.2.addcontextdiv", "false");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.2.callback", "");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.2.domain-blacklist", ".*.google..*|.*.bing..*|.*.live..*|.*.msn..*|.*.yahoo..*|.*.youtube.com.*|.*ask.com.*|.*.sweetim.com.*");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.2.domain-whitelist", "");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.2.elementid", "id_predict_include_script");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.2.enable", "false");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.2.id", "id_script_prad");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.2.url", "hxxp://cdn1.certified-apps.com/scripts/shared/enable.js?si=3104&tid=chff1");
Zeile gelöscht : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.yahoo.com/*\" param=\"[...]
Zeile gelöscht : user_pref("sweetim.toolbar.search.history.capacity", "10");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.enable", "false");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.initialized_by_rc", "true");
Zeile gelöscht : user_pref("sweetim.toolbar.simapp_id", "{678DAAB7-2035-11E2-99A6-84A6C841E186}");
Zeile gelöscht : user_pref("sweetim.toolbar.version", "1.9.0.0");

*************************

AdwCleaner[R0].txt - [19321 octets] - [12/09/2013 12:48:03]
AdwCleaner[S0].txt - [18521 octets] - [12/09/2013 12:48:29]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18582 octets] ##########
Bei JRT habe ich jetzt das Problem, dass es nur kurz ein schwarzes Fenster gibt, welches aber sofort wieder geschlossen wird. Dachte zuerst das liegt an McAfee, dort habe ich jedoch Echtzeitscan und Firewall deaktiviert...
Weisst du was ich falsch mache?

Muss ich etwa Malwarebytes auch deaktivieren?

Schmittchen 12.09.2013 12:36
Ich habe jetzt mal FRST vorgezogen, vielleicht siehst du ja dort das Problem... :


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-09-2013 02
Ran by Roman Schmid (administrator) on ROMANSCHMID-PC on 12-09-2013 13:32:15
Running from C:\Users\Roman Schmid\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Adobe Systems Incorporated) c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(McAfee, Inc.) C:\Windows\system32\mfevtps.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PSIService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\CCDashServer.exe
() C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
() C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe
(cyberlink) C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
() C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe
(McAfee, Inc.) C:\Program Files\mcafee.com\agent\mcagent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
() C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Core\mchost.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Dell Products, LP.) c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
(Nero AG) C:\Program Files (x86)\Nero\SyncUP\SyncUP.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Nero AG) C:\Program Files (x86)\Nero\SyncUP\Nero.AndroidServer.exe
(Ghisler Software GmbH) C:\Program Files (x86)\totalcmd\TOTALCMD64.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [626552 2012-04-09] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-02-14] (IDT, Inc.)
HKLM\...\Run: [QuickSet] - c:\Program Files\Dell\QuickSet\QuickSet.exe [4365984 2012-03-12] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [IntelMyWiFiDashboard] - C:\Program Files\Intel\WiFi\bin\CCDashServer.exe [4966912 2012-03-30] (Intel® Corporation)
HKLM\...\Run: [BLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [120592 2012-01-10] ()
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671904 2012-08-28] (DT Soft Ltd)
MountPoints2: {6a187363-d9ed-11e2-8a54-5cf9dd4eab93} - G:\AutoRun.exe
MountPoints2: {6a18737c-d9ed-11e2-8a54-5cf9dd4eab93} - G:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [577024 2012-03-07] (Creative Technology Ltd)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [76872 2012-03-27] (cyberlink)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [NeroLauncher] - C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe [67496 2012-08-21] ()
HKLM-x32\...\Run: [AccuWeatherWidget] - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj [2835443 2012-02-01] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll [ ] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/17
SearchScopes: HKLM - DefaultScope {90F9FBBA-19E1-4ECA-9725-F07F5C566E2C} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {90F9FBBA-19E1-4ECA-9725-F07F5C566E2C} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20121009111843.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20121009111843.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{2D3CFCAF-2B3A-4A29-8C26-798D2A25B3C5}: [NameServer]193.189.244.206 193.189.244.225

FireFox:
========
FF ProfilePath: C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default
FF NewTab: user_pref("browser.newtab.url", "");
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: hxxp://www.google.ch/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Roman Schmid\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Visualisateur 3D de 20-20 - C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\Extensions\2020Player_IKEA@2020Technologies.com
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

S2 CLKMSVC10_9EC60124; C:\Program Files (x86)\Cyberlink\PowerDVD9\NavFilter\kmsvc.exe [242448 2012-03-27] (CyberLink)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193536 2012-03-28] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [224704 2011-03-09] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [246112 2013-06-20] ()
R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-03-29] ()
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-28] ()
R2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [174656 2006-11-02] ()
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-03-29] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-10-17] (DT Soft Ltd)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
S3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-03-28] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2013-06-20] (Huawei Technologies Co., Ltd.)
U3 mfeavfk01; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-12 13:17 - 2013-09-12 12:52 - 01029509 _____ (Thisisu) C:\Users\Roman Schmid\Desktop\JRT.exe
2013-09-12 13:09 - 2013-09-12 13:10 - 00001277 _____ C:\Users\Roman Schmid\Desktop\Firewall aktivieren.lnk
2013-09-12 13:08 - 2013-09-12 13:10 - 00001279 _____ C:\Users\Roman Schmid\Desktop\Firewall deaktivieren.lnk
2013-09-12 12:47 - 2013-09-12 12:48 - 00000000 ____D C:\AdwCleaner
2013-09-12 12:35 - 2013-09-12 12:35 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-12 12:35 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-12 11:55 - 2013-09-12 11:55 - 00000000 ____D C:\FRST
2013-09-12 03:08 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 03:08 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 03:08 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 03:08 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 03:08 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 03:08 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 03:08 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 03:08 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 03:08 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 03:08 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 03:08 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 03:08 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 01:11 - 2013-09-12 01:11 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Chromium
2013-09-12 01:07 - 2013-09-12 01:07 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\The Lord of the Rings Online
2013-09-12 01:01 - 2013-09-12 01:02 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Turbine
2013-09-12 01:01 - 2013-09-12 01:01 - 00001950 _____ C:\Users\Roman Schmid\Desktop\Der Herr der Ringe Online™.lnk
2013-09-12 01:00 - 2013-09-12 01:10 - 00000000 ____D C:\Users\Roman Schmid\Documents\The Lord of the Rings Online
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Turbine
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\ProgramData\Turbine
2013-09-12 00:54 - 2013-09-12 01:11 - 00000000 ____D C:\ProgramData\HappyCloud
2013-09-12 00:54 - 2013-09-12 00:54 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2013-09-11 22:14 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 22:14 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-11 22:14 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-11 22:14 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-11 22:14 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-11 22:14 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-11 22:14 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-11 22:14 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-11 22:14 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-11 22:14 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-11 22:14 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-11 22:14 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-11 22:14 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-11 22:14 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-11 22:14 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-11 22:14 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-11 22:14 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-11 22:14 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-11 22:14 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-11 22:14 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-11 22:14 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-11 22:14 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 22:14 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-11 22:14 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-11 22:14 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-11 22:14 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 14:02 - 2013-09-11 14:02 - 00000000 ____D C:\Users\Roman Schmid\Desktop\Games
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iTunes
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iPod
2013-09-11 12:17 - 2013-09-11 13:17 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\download.am-data
2013-09-11 12:17 - 2013-09-11 13:03 - 00000000 ____D C:\Program Files (x86)\Download.am
2013-09-11 12:17 - 2013-09-11 12:38 - 00000000 ____D C:\Users\Roman Schmid\Downloads\Download.am
2013-08-28 00:17 - 2013-08-28 00:17 - 00001159 _____ C:\Users\Roman Schmid\Desktop\farcry3.lnk
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\Users\Roman Schmid\Documents\My Games
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\ProgramData\Orbit
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-08-27 08:50 - 2013-08-27 08:50 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ___HD C:\Program Files (x86)\Zero G Registry
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Solarmax
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Program Files (x86)\Solarmax
2013-08-18 13:24 - 2013-08-18 13:24 - 00000000 ___HD C:\Users\Roman Schmid\InstallAnywhere
2013-08-18 12:56 - 2013-08-18 12:56 - 00000000 ____D C:\Users\Roman Schmid\Documents\SolarMax
2013-08-17 22:06 - 2013-08-17 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 21:57 - 2013-08-17 21:57 - 00000000 ____D C:\ProgramData\Steam
2013-08-14 03:01 - 2013-09-12 03:08 - 00000000 ____D C:\Windows\system32\MRT
2013-08-13 22:44 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-13 22:44 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-13 22:44 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-13 22:44 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-13 22:44 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-13 22:44 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-13 22:44 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-13 22:44 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-13 22:44 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-13 22:44 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-13 22:44 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-13 22:44 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-13 22:44 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-13 22:44 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-13 22:43 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-13 22:43 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-12 13:31 - 2013-09-12 13:31 - 01949642 _____ (Farbar) C:\Users\Roman Schmid\Desktop\FRST64.exe
2013-09-12 13:26 - 2012-10-29 21:06 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-12 13:20 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-12 13:20 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-12 13:10 - 2013-09-12 13:09 - 00001277 _____ C:\Users\Roman Schmid\Desktop\Firewall aktivieren.lnk
2013-09-12 13:10 - 2013-09-12 13:08 - 00001279 _____ C:\Users\Roman Schmid\Desktop\Firewall deaktivieren.lnk
2013-09-12 13:05 - 2012-10-08 17:02 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Nero
2013-09-12 12:54 - 2010-11-21 08:50 - 00696870 _____ C:\Windows\system32\perfh007.dat
2013-09-12 12:54 - 2010-11-21 08:50 - 00148134 _____ C:\Windows\system32\perfc007.dat
2013-09-12 12:54 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-12 12:53 - 2012-10-02 16:20 - 01476305 _____ C:\Windows\WindowsUpdate.log
2013-09-12 12:52 - 2013-09-12 13:17 - 01029509 _____ (Thisisu) C:\Users\Roman Schmid\Desktop\JRT.exe
2013-09-12 12:50 - 2012-10-29 21:06 - 00001118 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-12 12:50 - 2012-10-15 20:12 - 00000426 ____H C:\Windows\Tasks\OptimizerPro1UpdaterTask{870BA444-6012-4990-89E9-5B53916A4E0D}.job
2013-09-12 12:50 - 2012-10-02 23:57 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-09-12 12:49 - 2012-10-02 16:20 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-12 12:49 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-12 12:49 - 2009-07-14 06:51 - 00065645 _____ C:\Windows\setupact.log
2013-09-12 12:48 - 2013-09-12 12:47 - 00000000 ____D C:\AdwCleaner
2013-09-12 12:46 - 2010-11-21 05:47 - 00096552 _____ C:\Windows\PFRO.log
2013-09-12 12:37 - 2012-10-02 23:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-12 12:35 - 2013-09-12 12:35 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-12 11:55 - 2013-09-12 11:55 - 00000000 ____D C:\FRST
2013-09-12 10:06 - 2012-10-08 17:00 - 00000000 ___RD C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 10:06 - 2012-10-08 17:00 - 00000000 ___RD C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 03:52 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-12 03:26 - 2009-07-14 06:45 - 00349504 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 03:08 - 2013-08-14 03:01 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 03:06 - 2012-10-09 10:27 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 03:06 - 2012-10-08 18:57 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 01:11 - 2013-09-12 01:11 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Chromium
2013-09-12 01:11 - 2013-09-12 00:54 - 00000000 ____D C:\ProgramData\HappyCloud
2013-09-12 01:10 - 2013-09-12 01:00 - 00000000 ____D C:\Users\Roman Schmid\Documents\The Lord of the Rings Online
2013-09-12 01:07 - 2013-09-12 01:07 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\The Lord of the Rings Online
2013-09-12 01:02 - 2013-09-12 01:01 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Turbine
2013-09-12 01:01 - 2013-09-12 01:01 - 00001950 _____ C:\Users\Roman Schmid\Desktop\Der Herr der Ringe Online™.lnk
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Turbine
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\ProgramData\Turbine
2013-09-12 00:54 - 2013-09-12 00:54 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2013-09-12 00:03 - 2012-10-03 00:14 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-09-11 19:48 - 2012-10-09 00:01 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-11 19:48 - 2012-10-08 23:10 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-09-11 14:10 - 2012-10-09 00:01 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-09-11 14:02 - 2013-09-11 14:02 - 00000000 ____D C:\Users\Roman Schmid\Desktop\Games
2013-09-11 13:37 - 2012-10-02 23:26 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-11 13:37 - 2012-10-02 23:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-11 13:37 - 2012-10-02 23:26 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-11 13:17 - 2013-09-11 12:17 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\download.am-data
2013-09-11 13:03 - 2013-09-11 12:17 - 00000000 ____D C:\Program Files (x86)\Download.am
2013-09-11 12:38 - 2013-09-11 12:17 - 00000000 ____D C:\Users\Roman Schmid\Downloads\Download.am
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iTunes
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iPod
2013-09-11 12:18 - 2013-06-18 13:08 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-28 14:22 - 2012-10-16 19:21 - 00000000 ____D C:\Users\Roman Schmid\Documents\Citavi 3
2013-08-28 00:17 - 2013-08-28 00:17 - 00001159 _____ C:\Users\Roman Schmid\Desktop\farcry3.lnk
2013-08-28 00:10 - 2012-10-08 23:09 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\PunkBuster
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\Users\Roman Schmid\Documents\My Games
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\ProgramData\Orbit
2013-08-28 00:08 - 2013-05-11 22:37 - 00000000 ____D C:\Games
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-08-28 00:06 - 2012-10-09 00:01 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-28 00:06 - 2012-10-03 00:06 - 00100005 _____ C:\Windows\DirectX.log
2013-08-28 00:01 - 2012-10-02 23:39 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-27 08:50 - 2013-08-27 08:50 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-08-25 10:50 - 2013-01-20 19:47 - 00000000 ____D C:\Program Files (x86)\Need For Speed World
2013-08-19 17:30 - 2012-10-08 22:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ___HD C:\Program Files (x86)\Zero G Registry
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Solarmax
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Program Files (x86)\Solarmax
2013-08-18 13:24 - 2013-08-18 13:24 - 00000000 ___HD C:\Users\Roman Schmid\InstallAnywhere
2013-08-18 13:24 - 2012-10-08 16:53 - 00000000 ____D C:\Users\Roman Schmid
2013-08-18 12:56 - 2013-08-18 12:56 - 00000000 ____D C:\Users\Roman Schmid\Documents\SolarMax
2013-08-17 22:12 - 2012-10-03 00:13 - 00000000 ____D C:\ProgramData\McAfee
2013-08-17 22:06 - 2013-08-17 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 21:57 - 2013-08-17 21:57 - 00000000 ____D C:\ProgramData\Steam

Files to move or delete:
====================
C:\Users\ROMANS~1\AppData\Local\Temp\Quarantine.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 12:44

==================== End Of Log ============================
--- --- ---


Und die Addition.txt Datei:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-09-2013 02
Ran by Roman Schmid at 2013-09-12 13:32:32
Running from C:\Users\Roman Schmid\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe AIR (x32 Version: 2.6.0.19120)
Adobe Community Help (x32 Version: 3.2.1)
Adobe Community Help (x32 Version: 3.2.1.650)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.168)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Adobe Photoshop Elements 9 (x32 Version: 9.0.3.0)
Adobe Premiere Elements 9 (x32 Version: 9.0)
Adobe Premiere Elements 9 (x32 Version: 9.0.1)
Adobe Reader X (10.1.8) MUI (x32 Version: 10.1.8)
Advanced Audio FX Engine (x32 Version: 1.12.05)
Age of Empire 2 HD Edition GERMAN (c) Microsoft version 1 (x32 Version: 1)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)
Blackhawk Striker 2 (x32 Version: 2.2.0.95)
Bonjour (Version: 3.0.0.10)
Bounce Symphony (x32 Version: 2.2.0.95)
Build-a-lot 2 (x32 Version: 2.2.0.95)
Cake Mania (x32 Version: 2.2.0.95)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Cisco Systems VPN Client 5.0.07.0440 (Version: 5.0.7)
Citavi (x32 Version: 3.0.12.0)
Corel Paint Shop Pro X (x32 Version: 10.10)
CyberLink PowerDVD 9.6 (x32 Version: 9.6.1.5127)
D3DX10 (x32 Version: 15.4.2368.0902)
DAEMON Tools Lite (x32 Version: 4.45.4.0316)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Dell DataSafe Local Backup - Support Software (x32 Version: 9.4.67)
Dell DataSafe Local Backup (x32 Version: 9.4.67)
Dell DataSafe Online (x32 Version: 2.1.19634)
Dell Digital Delivery (x32 Version: 2.7.1000.0)
Dell Edoc Viewer (Version: 1.0.0)
Dell Getting Started Guide (x32 Version: 1.00.0000)
Dell MusicStage (x32 Version: 1.6.225.0)
Dell PhotoStage (x32 Version: 1.5.0.130)
Dell Stage (x32 Version: 1.7.209.0)
Dell Stage Remote (x32 Version: 2.0.0.43)
Dell Support Center (Version: 3.1.5907.16)
Dell Touchpad (Version: 7.1209.101.217)
Dell VideoStage  (x32 Version: 1.3.0.2513)
Dell Webcam Central (x32 Version: 2.01.15)
Der Herr der Ringe Online (HKCU)
DIE SIEDLER - Das Erbe der Könige (Alle Produkte) (x32 Version: 1.00.0000)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)
Dora's World Adventure (x32 Version: 2.2.0.95)
eBay (x32 Version: 1.4.0)
Electronic Arts Game Updater (x32)
Elements 9 Organizer (x32 Version: 9.0)
Elements STI Installer (x32 Version: 1.0)
Escape Whisper Valley (TM) (x32 Version: 2.2.0.95)
Far Cry 3 (x32 Version: 1.01)
Farm Frenzy (x32 Version: 2.2.0.95)
FastStone Image Viewer 4.8 (x32 Version: 4.8)
FATE (x32 Version: 2.2.0.95)
Final Drive Fury (x32 Version: 2.2.0.95)
Final Drive Nitro (x32 Version: 2.2.0.95)
Gadwin PrintScreen (x32 Version: 4.7)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
Happy Cloud Client (HKCU Version: 3.41)
iCloud (Version: 2.1.2.8)
iFunbox (v2.1.2228.731), iFunbox DevTeam (x32 Version: v2.1.2228.731)
Intel PROSet Wireless
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 8.0.1.1399)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 15.1.0.0096)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (Version: 2.0.0.0113)
Intel(R) Rapid Start Technology (x32 Version: 1.0.0.1024)
Intel(R) Rapid Storage Technology (x32 Version: 11.1.0.1006)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.220)
Intel® PROSet/Wireless WiFi-Software (Version: 15.01.1000.0927)
Intel® Trusted Connect Service Client (Version: 1.23.219.2)
IrfanView (remove only) (x32 Version: 4.35)
iTunes (Version: 11.0.5.5)
Java 7 Update 21 (64-bit) (Version: 7.0.210)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Java SE Development Kit 7 Update 7 (64-bit) (Version: 1.7.0.70)
JDownloader 0.9 (x32 Version: 0.9)
jEdit 4.5.2 (Version: 4.5.2)
Jewel Quest (x32 Version: 2.2.0.95)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.95)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Luxor (x32 Version: 2.2.0.95)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
MaxTalk 2 (x32 Version: 2.2.2.0)
McAfee Security Scan Plus (x32 Version: 3.0.318.3)
McAfee SecurityCenter (x32 Version: 11.6.511)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Mobile Partner (x32 Version: 21.005.15.00.705)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95)
NC Launcher (GameForge) (x32)
Need For Speed - Porsche (x32)
Need For Speed™ World (x32 Version: 1.0.0.1229)
Nero 10 Movie ThemePack Basic (x32 Version: 10.6.10000.1.0)
Nero Blu-ray Player (x32 Version: 12.0.20030)
Nero Control Center 10 (x32 Version: 10.6.13000.0.11)
Nero ControlCenter 10 Help (CHM) (x32 Version: 10.2.10800)
Nero Core Components 10 (x32 Version: 2.0.20500.9.16)
Nero Update (x32 Version: 11.0.11800.31.0)
NVIDIA 3D Vision Controller-Treiber 295.73 (Version: 295.73)
NVIDIA 3D Vision PowerPack - Santa Clara Classic Car Show 2009 (x32)
NVIDIA 3D Vision Treiber 296.37 (Version: 296.37)
NVIDIA 3D Vision Video Player (x32 Version: 1.7.2)
NVIDIA Grafiktreiber 296.37 (Version: 296.37)
NVIDIA HD-Audiotreiber 1.3.12.0 (Version: 1.3.12.0)
NVIDIA Install Application (Version: 2.1002.62.312)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.9637)
NVIDIA Systemsteuerung 296.37 (Version: 296.37)
NVIDIA Update 1.7.12 (Version: 1.7.12)
NVIDIA Update Components (Version: 1.7.12)
Penguins! (x32 Version: 2.2.0.95)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)
Poker Superstars III (x32 Version: 2.2.0.95)
Polar Bowler (x32 Version: 2.2.0.95)
Polar Golfer (x32 Version: 2.2.0.95)
PunkBuster Services (x32 Version: 0.993)
Quickset64 (Version: 11.1.17)
QuickTime (x32 Version: 7.74.80.86)
QXL Ricardo Assistant 5 (x32 Version: 0.0.0.0)
Samantha Swift (x32 Version: 2.2.0.95)
Shared C Run-time for x64 (Version: 10.0.0)
Skype™ 5.10 (x32 Version: 5.10.116)
SmartSound Quicktracks for Premiere Elements 9.0 (x32 Version: 3.12.3090)
SyncUP (x32 Version: 1.12.12400.17.102)
SyncUP (x32 Version: 10.2.16500)
Total Commander 64-bit (Remove or Repair) (Version: 8.01)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.1.23.0)
Unity Web Player (HKCU Version: )
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553157) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589370) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760758) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update Installer for WildTangent Games App (x32)
Uplay (x32 Version: 2.0)
Virtual Router Plus (x32 Version: 2.5.0)
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.95)
VoiceOver Kit (x32 Version: 1.42.128.0)
Wedding Dash - Ready, Aim, Love! (x32 Version: 2.2.0.95)
WildTangent Games App (Dell Games) (x32 Version: 4.0.10.2)
WildTangent-Spiele (x32 Version: 1.0.2.5)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
Zinio Reader 4 (x32 Version: 4.2.4164)
Zuma Deluxe (x32 Version: 2.2.0.95)

==================== Restore Points  =========================

27-08-2013 22:01:24 Installiert Far Cry 3
29-08-2013 01:00:12 Windows Update
11-09-2013 10:51:43 Geplanter Prüfpunkt
11-09-2013 22:58:05 DirectX wurde installiert
11-09-2013 22:58:36 DirectX wurde installiert
12-09-2013 01:00:27 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {0DBAE751-ACE0-472D-847F-EC4ECE2F8CBF} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {263C4656-D698-4859-B0C8-3678844131B7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {27A5B41D-EA09-49E8-9621-4E9E75FA6F2D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-29] (Google Inc.)
Task: {378E4995-81CD-423A-8689-1C2291AA5FAC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-29] (Google Inc.)
Task: {59F4C1B5-1D93-4147-99DD-E1A889F2C7FE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-11] (Adobe Systems Incorporated)
Task: {71495C8C-DA61-45C7-9C1D-0112249FA8D6} - System32\Tasks\AdobeAAMUpdater-1.0-RomanSchmid-PC-Roman Schmid => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated)
Task: {79D1004A-7C29-4343-AE0E-B35862236017} - System32\Tasks\IntelBootstrapCCDashServer => C:\Program Files\Intel\WiFi\bin\CCDashServer.exe [2012-03-30] (Intel® Corporation)
Task: {8D37038E-D40F-4959-8CE7-FF899C9BCCA2} - \BrowserDefendert No Task File
Task: {955342B7-155C-44E4-904B-A8A752A1A2A2} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {B84CECE5-A360-4DE0-A6B2-0929984B9D37} - System32\Tasks\Intel® Rapid Start Technology Manager => C:\Program Files (x86)\Intel\irstrt\RapidStartConfig.exe [2012-03-28] (Intel)
Task: {E0151201-B39D-4AB8-8CC2-620B00BAC3A2} - \EPUpdater No Task File
Task: {FC927256-0BB7-4372-ABB0-EAD1100C49A0} - System32\Tasks\OptimizerPro1UpdaterTask{870BA444-6012-4990-89E9-5B53916A4E0D} => C:\ProgramData\Premium\OptimizerPro1\OptimizerPro1.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\OptimizerPro1UpdaterTask{870BA444-6012-4990-89E9-5B53916A4E0D}.job => C:\ProgramData\Premium\OptimizerPro1\OptimizerPro1.exe

==================== Loaded Modules (whitelisted) =============

2012-10-03 00:50 - 2012-03-25 20:23 - 09729344 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2012-10-03 00:50 - 2012-03-25 20:23 - 02677056 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2012-10-02 16:20 - 2012-03-24 22:48 - 00063296 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2013-04-05 12:58 - 2013-04-05 12:58 - 00954696 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
2012-10-03 00:50 - 2012-01-26 08:21 - 00112504 _____ (Alps Electric Co., Ltd.) C:\Windows\system32\Vxdif.dll
2012-10-02 16:21 - 2012-02-14 07:20 - 04636160 _____ (IDT, Inc.) C:\Program Files\IDT\WDM\STLang64.dll
2012-10-03 00:51 - 2012-02-14 07:20 - 00655360 _____ (IDT, Inc.) C:\Windows\system32\stapi64.dll
2012-03-30 02:41 - 2012-03-30 02:41 - 00714240 _____ (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\MDNSSvcAD_Api.dll
2012-03-23 17:17 - 2012-03-23 17:17 - 04201232 _____ (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\de\CCDServerResources.dll
2012-03-29 14:19 - 2012-03-29 14:19 - 00116224 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\PanApi.dll
2012-10-03 00:50 - 2012-01-26 08:21 - 00112504 _____ (Alps Electric Co., Ltd.) C:\Windows\system32\VXDIF.DLL
2010-03-17 03:28 - 2010-03-17 03:28 - 01926144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtCore4.dll
2010-03-22 22:52 - 2010-03-22 22:52 - 06776832 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtGui4.dll
2010-03-17 03:28 - 2010-03-17 03:28 - 00635904 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtNetwork4.dll
2010-03-17 03:28 - 2010-03-17 03:28 - 00326144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtXml4.dll
2011-06-29 15:52 - 2011-06-29 15:52 - 00077376 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\DMSAdapter.dll
2011-06-28 02:25 - 2011-06-28 02:25 - 00491968 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\DHServerAgent.dll
2011-06-28 02:26 - 2011-06-28 02:26 - 00715400 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\UMediaManager.dll
2011-06-25 06:19 - 2011-06-25 06:19 - 00043584 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\ASDBTool.dll
2011-06-25 06:20 - 2011-06-25 06:20 - 00565968 _____ () C:\Program Files (x86)\Dell\Stage Remote\sqlite3.dll
2011-06-28 02:25 - 2011-06-28 02:25 - 00051264 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\ASTransMgr.dll
2011-06-25 06:19 - 2011-06-25 06:19 - 00043584 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\ASXmlTool.dll
2011-06-28 02:25 - 2011-06-28 02:25 - 00058944 _____ () C:\Program Files (x86)\Dell\Stage Remote\DataService.dll
2011-06-25 06:32 - 2011-06-25 06:32 - 00323136 _____ () C:\Program Files (x86)\Dell\Stage Remote\de-DE\UI\ManagerUI.dll
2010-03-12 02:52 - 2010-03-12 02:52 - 00028160 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qgif4.dll
2010-03-05 22:07 - 2010-03-05 22:07 - 00031744 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qico4.dll
2010-03-05 22:07 - 2010-03-05 22:07 - 00125952 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qjpeg4.dll
2010-03-12 02:52 - 2010-03-12 02:52 - 00225280 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qmng4.dll
2010-01-07 03:43 - 2010-01-07 03:43 - 00017408 _____ (ArcSoft Inc.) C:\Program Files (x86)\Dell\Stage Remote\EndPointCtrl.dll
2012-08-27 22:33 - 2012-08-27 22:33 - 00053608 _____ (Open Source Software community project) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\pthreadVC2.dll
2012-08-27 22:33 - 2012-08-27 22:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 22:33 - 2012-08-27 22:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-08-31 00:05 - 2011-08-31 00:05 - 00085864 _____ (Apple Inc.) C:\Windows\system32\dnssd.dll
2013-08-15 12:08 - 2013-08-15 12:08 - 00489472 _____ (Intel Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\591b99d5681c59ed6c5e9544d7def0ea\IAStorUtil.ni.dll
2013-07-22 22:47 - 2013-07-22 22:47 - 00014336 _____ (Intel Corp.) C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\45581138b36fd338c87813390775b65f\IAStorCommon.ni.dll
2010-07-30 19:59 - 2010-07-30 19:59 - 01975592 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\SplashScreen.dll
2010-07-30 19:52 - 2010-07-30 19:52 - 00034600 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\DotNetAppLauncher.dll
2011-02-09 23:25 - 2011-02-09 23:25 - 00135464 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Nfx.Wpf.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00200088 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NeroLibrary.dll
2011-02-09 23:25 - 2011-02-09 23:25 - 00103720 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Nfx.Foundation.dll
2012-03-11 00:52 - 2012-03-11 00:52 - 00349480 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\AdvrCntrProxy.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00071576 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\MainAppCommunicator.dll
2011-02-09 23:25 - 2011-02-09 23:25 - 00040232 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Nfx.License.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00983448 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\MediaHub.Sdk.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00283544 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\MediaLibrary.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00391576 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\MediaHub.DataLibrary.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00081816 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\MediaHub.DataModel.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00014744 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\MediaLibraryInterfaces.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00111000 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\DeviceManager.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00018328 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\TaskScheduler.dll
2011-02-09 23:25 - 2011-02-09 23:25 - 00428328 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Nfx.UXLibrary.dll
2012-03-11 00:53 - 2012-03-11 00:53 - 00251688 _____ () C:\Program Files (x86)\Nero\SyncUP\System.ComponentModel.Composition.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00141208 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\StartPage.dll
2012-03-11 00:52 - 2012-03-11 00:52 - 00095528 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NeAE.Interop.dll
2012-03-11 00:53 - 2012-03-11 00:53 - 00046376 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\BurnAPI.Interop.dll
2011-09-19 23:54 - 2011-09-19 23:54 - 00148776 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NOSWebCommunity.Export.dll
2012-03-11 00:52 - 2012-03-11 00:52 - 00058664 _____ ( ) C:\Program Files (x86)\Nero\SyncUP\NOSMetaData.Interop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00160664 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\PlaybackLibrary.dll
2012-03-11 00:52 - 2012-03-11 00:52 - 00038184 _____ ( ) C:\Program Files (x86)\Nero\SyncUP\NeroUpdate.Interop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00042904 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\ImageProcessLib.Interop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00075672 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NMCoFoundation.Interop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00096152 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NMTTranscoder.Interop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00016280 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NeTargetSettings.Interop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00115096 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\DeviceOperations.dll
2012-08-21 14:19 - 2012-08-21 14:19 - 00194496 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\de-DE\MediaHub.Main.resources.dll
2012-08-21 14:20 - 2012-08-21 14:20 - 00051136 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\de-DE\MediaHub.Sdk.resources.dll
2011-02-09 23:25 - 2011-02-09 23:25 - 00011560 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\de-DE\Nfx.UXLibrary.resources.dll
2010-10-28 21:42 - 2010-10-28 21:42 - 00068424 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\SolutionExplorerCLI.dll
2011-11-25 20:14 - 2011-11-25 20:14 - 05149992 _____ (Nero AG) C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll
2010-10-28 21:42 - 2010-10-28 21:42 - 00031040 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\SolutionExplorer.dll
2012-03-11 00:54 - 2012-03-11 00:54 - 00010536 _____ ( ) C:\Program Files (x86)\Nero\SyncUP\NOSProductRegistration.Interop.dll
2011-09-19 23:49 - 2011-09-19 23:49 - 03740968 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\OnlineServices\NOSProductRegistration.dll
2012-03-11 00:55 - 2012-03-11 00:55 - 00010536 _____ ( ) C:\Program Files (x86)\Nero\SyncUP\NOSUsageStatistics.Interop.dll
2011-09-19 23:52 - 2011-09-19 23:52 - 01078568 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\OnlineServices\NOSUsageStatistics.dll
2012-03-11 00:53 - 2012-03-11 00:53 - 00740648 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NCCoreInterop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00022936 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\DeviceMonitor.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00021400 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\DeviceConnector.interop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00157592 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NMDataServices.Interop.dll
2011-09-19 23:47 - 2011-09-19 23:47 - 00255272 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NOSMetaDataWPF.dll
2011-09-19 23:44 - 2011-09-19 23:44 - 00033064 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NOSUtils.Client.dll
2011-09-19 23:46 - 2011-09-19 23:46 - 04695336 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\OnlineServices\NOSMetaData.dll
2011-08-19 11:31 - 2011-08-19 11:31 - 02864424 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NScCoreComponents\NMDataServices.dll
2011-08-19 11:31 - 2011-08-19 11:31 - 00771368 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NScCoreComponents\NMCoFoundation.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00381848 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\DeviceSync.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00040344 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\SyncLibrary.dll
2012-03-11 00:53 - 2012-03-11 00:53 - 00891688 _____ () C:\Program Files (x86)\Nero\SyncUP\System.Data.SQLite.dll
2012-03-11 00:52 - 2012-03-11 00:52 - 00179496 _____ (hxxp://sqlite.phxsoftware.com) C:\Program Files (x86)\Nero\SyncUP\System.Data.SQLite.Linq.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00026008 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\LibraryBrowserStub.dll
2012-03-11 00:52 - 2012-03-11 00:52 - 00087336 _____ ( ) C:\Program Files (x86)\Nero\SyncUP\Interop.iTunesLib.dll
2012-03-11 00:52 - 2012-03-11 00:52 - 00075048 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NeEE.Interop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00029592 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\MovieWizardLibrary.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00047000 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\IndexingManager.dll
2012-03-11 00:54 - 2012-03-11 00:54 - 00013608 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\AppFormatCOM.Interop.dll
2012-03-11 00:53 - 2012-03-11 00:53 - 00013096 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\MovieWizard.Interop.dll
2011-02-09 23:25 - 2011-02-09 23:25 - 00060712 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Nfx.Burn.ViewModel.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00011160 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NeAudioPCM.Interop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00053144 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\FileScanner.dll
2012-03-11 00:54 - 2012-03-11 00:54 - 00345384 _____ ( ) C:\Program Files (x86)\Nero\SyncUP\Interop.WMPLib.dll
2011-02-09 23:25 - 2011-02-09 23:25 - 00100648 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Nfx.Picker.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00021912 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\ImageEffects.Interop.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00030616 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NMCdRip.Interop.dll
2012-03-11 00:53 - 2012-03-11 00:53 - 00505128 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\ActiveSyncConnector.dll
2012-03-11 00:55 - 2012-03-11 00:55 - 00537896 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\DCIMConnector.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00841000 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\USBConnector.dll
2011-10-13 21:50 - 2011-10-13 21:50 - 00873768 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\PTT\NMThumbnailIconsGen.dll
2011-10-13 21:47 - 2011-10-13 21:47 - 01647912 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\PTT\ImageProcessLib.dll
2011-10-13 21:24 - 2011-10-13 21:24 - 02716968 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\SMC\NeMetadata.dll
2012-03-11 00:52 - 2012-03-11 00:52 - 00320808 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\UsbBasedDeviceMonitor.dll
2012-03-11 00:52 - 2012-03-11 00:52 - 00562472 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\PSPConnector.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00019864 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\FileSystemWatcher.dll
2012-03-11 00:53 - 2012-03-11 00:53 - 00505128 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\PCSuiteConnector.dll
2012-03-11 00:52 - 2012-03-11 00:52 - 00566568 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\SEConnector.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00570664 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\WiFiConnector.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00783656 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\NCConnector.dll
2012-03-11 00:53 - 2012-03-11 00:53 - 00408872 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\desktopclientlib.dll
2012-08-21 14:20 - 2012-08-21 14:20 - 00640936 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\WPDConnector.dll
2012-08-21 14:20 - 2012-08-21 14:20 - 00079776 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\Deviceconnectors\wpdenc.DLL
2012-03-11 00:54 - 2012-03-11 00:54 - 00018216 _____ ( ) C:\Program Files (x86)\Nero\SyncUP\Interop.UPNPLib.dll
2012-07-13 16:27 - 2012-07-13 16:27 - 00048024 _____ (Nero AG) C:\Program Files (x86)\Nero\Update\NASvcPS.dll
2012-08-21 14:20 - 2012-08-21 14:20 - 00017832 _____ (Nero AG) C:\PROGRAM FILES (X86)\NERO\SYNCUP\PLUGINS\SYNC.PLUGIN.dll
2012-08-21 14:20 - 2012-08-21 14:20 - 00911768 _____ (Nero AG) C:\PROGRAM FILES (X86)\NERO\SYNCUP\PLUGINS\Sync.dll
2012-08-21 14:22 - 2012-08-21 14:22 - 00075696 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\de-DE\Sync.resources.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00182168 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NMPlaybackComponent.Interop.dll
2013-08-14 03:36 - 2013-08-14 03:36 - 00039424 _____ (Adobe Systems Incorporated) C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\3ea679e79eda32e3465d8cf36e838a00\PresentationCFFRasterizer.ni.dll
2012-08-21 13:48 - 2012-08-21 13:48 - 00034712 _____ (Nero AG) C:\Program Files (x86)\Nero\SyncUP\NMSearch.Interop.dll

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/12/2013 00:56:08 PM) (Source: Application Hang) (User: )
Description: Programm WebcamDell2.exe, Version 1.1.14.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: fdc

Startzeit: 01ceafa5d72a7f95

Endzeit: 18

Anwendungspfad: C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

Berichts-ID:

Error: (09/12/2013 00:50:18 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.1.1.2, Zeitstempel: 0x4f746f5a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1677
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0x1a80
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3

Error: (09/12/2013 00:50:17 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.1.1.2, Zeitstempel: 0x4f746f5a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1677
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0x117c
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3

Error: (09/12/2013 00:50:06 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.1.1.2, Zeitstempel: 0x4f746f5a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1677
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0xbd0
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3

Error: (09/12/2013 00:49:59 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/12/2013 00:47:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.1.1.2, Zeitstempel: 0x4f746f5a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1677
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0x1b8c
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3

Error: (09/12/2013 00:47:13 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.1.1.2, Zeitstempel: 0x4f746f5a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1677
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0x19bc
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3

Error: (09/12/2013 00:46:56 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.1.1.2, Zeitstempel: 0x4f746f5a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1677
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0xbe4
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3

Error: (09/12/2013 00:46:47 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/12/2013 00:28:23 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.1.1.2, Zeitstempel: 0x4f746f5a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1677
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0x15fc
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3


System errors:
=============
Error: (09/12/2013 00:52:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (09/12/2013 00:52:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (09/12/2013 00:51:30 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (09/12/2013 00:50:18 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.

Error: (09/12/2013 00:50:17 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.

Error: (09/12/2013 00:50:07 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (09/12/2013 00:50:02 PM) (Source: NetBT) (User: )
Description: Der Name "ROMANSCHMID-PC :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.31
registriert werden. Der Computer mit IP-Adresse 192.168.178.28 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (09/12/2013 00:50:02 PM) (Source: Server) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{D842F980-378F-4ADD-98DA-91F514E375E9} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.

Error: (09/12/2013 00:50:00 PM) (Source: NetBT) (User: )
Description: Der Name "ROMANSCHMID-PC :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.31
registriert werden. Der Computer mit IP-Adresse 192.168.178.22 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (09/12/2013 00:49:58 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053


Microsoft Office Sessions:
=========================
Error: (09/12/2013 00:56:08 PM) (Source: Application Hang)(User: )
Description: WebcamDell2.exe1.1.14.0fdc01ceafa5d72a7f9518C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

Error: (09/12/2013 00:50:18 PM) (Source: Application Error)(User: )
Description: ZeroConfigService.exe15.1.1.24f746f5aKERNELBASE.dll6.1.7601.1822951fb1677c06d007e000000000000940d1a8001ceafa5de8521c1C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Windows\system32\KERNELBASE.dll1c9cca8e-1b99-11e3-90a0-84a6c841e186

Error: (09/12/2013 00:50:17 PM) (Source: Application Error)(User: )
Description: ZeroConfigService.exe15.1.1.24f746f5aKERNELBASE.dll6.1.7601.1822951fb1677c06d007e000000000000940d117c01ceafa5da1cd57fC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Windows\system32\KERNELBASE.dll1c10595d-1b99-11e3-90a0-84a6c841e186

Error: (09/12/2013 00:50:06 PM) (Source: Application Error)(User: )
Description: ZeroConfigService.exe15.1.1.24f746f5aKERNELBASE.dll6.1.7601.1822951fb1677c06d007e000000000000940dbd001ceafa5d31ce62eC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Windows\system32\KERNELBASE.dll1593172b-1b99-11e3-90a0-84a6c841e186

Error: (09/12/2013 00:49:59 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/12/2013 00:47:14 PM) (Source: Application Error)(User: )
Description: ZeroConfigService.exe15.1.1.24f746f5aKERNELBASE.dll6.1.7601.1822951fb1677c06d007e000000000000940d1b8c01ceafa570b1a059C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Windows\system32\KERNELBASE.dllaeb3dcc3-1b98-11e3-b757-84a6c841e186

Error: (09/12/2013 00:47:13 PM) (Source: Application Error)(User: )
Description: ZeroConfigService.exe15.1.1.24f746f5aKERNELBASE.dll6.1.7601.1822951fb1677c06d007e000000000000940d19bc01ceafa56de986e6C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Windows\system32\KERNELBASE.dllae2c2e53-1b98-11e3-b757-84a6c841e186

Error: (09/12/2013 00:46:56 PM) (Source: Application Error)(User: )
Description: ZeroConfigService.exe15.1.1.24f746f5aKERNELBASE.dll6.1.7601.1822951fb1677c06d007e000000000000940dbe401ceafa5607bce7aC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Windows\system32\KERNELBASE.dlla3ef7a37-1b98-11e3-b757-84a6c841e186

Error: (09/12/2013 00:46:47 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/12/2013 00:28:23 PM) (Source: Application Error)(User: )
Description: ZeroConfigService.exe15.1.1.24f746f5aKERNELBASE.dll6.1.7601.1822951fb1677c06d007e000000000000940d15fc01ceafa2cf5ec84dC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Windows\system32\KERNELBASE.dll0d12774e-1b96-11e3-b0d8-84a6c841e186


==================== Memory info ===========================

Percentage of memory in use: 21%
Total physical RAM: 8119.32 MB
Available physical RAM: 6377.71 MB
Total Pagefile: 16236.82 MB
Available Pagefile: 13419.71 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:678.78 GB) (Free:577.67 GB) NTFS
Drive d: (DATAPART1) (Fixed) (Total:698.63 GB) (Free:595.36 GB) NTFS
Drive f: (Far Cry 3) (CDROM) (Total:1.94 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 699 GB) (Disk ID: E93DBE4F)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=679 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: E93DBE72)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 8 GB) (Disk ID: E93DBF80)
Partition 1: (Not Active) - (Size=8 GB) - (Type=84)

==================== End Of Log ============================

schrauber 12.09.2013 17:16

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Schmittchen 13.09.2013 12:33
Ok, hier die .txt datei:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ecf8ead15260ac41b5711dddf878a232
# engine=15106
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-13 10:19:01
# local_time=2013-09-13 12:19:01 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5122 16777213 100 88 15992715 127850137 0 0
# compatibility_mode=5893 16776574 100 94 5519163 130697391 0 0
# scanned=229982
# found=8
# cleaned=0
# scan_time=10816
sh=55B64F53328498D22D269DE2E65BE2FEEBA7DA00 ft=1 fh=75c36158ce6b01c9 vn="Win32/Adware.MultiPlug.D Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Bcool\507c5399c2977.ocx.vir"
sh=22B6F973ACADD564111CF40FE04F7AEC4D73ED21 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Bcool\507c5399c29b0.html.vir"
sh=A9E7393E3F111507E2D66AD9B2EEE49F623B9C83 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Bcool\nepadcndkofccakdfoabecfbfhjgdaoj.crx.vir"
sh=EC011E78DE86336A0881C7C42311241CC46E9730 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\Extensions\507c5399c27e7@507c5399c2820.com\content\bg.js.vir"
sh=BE72E0D26C97B36EDE492D59859F66367FDD5EC7 ft=1 fh=64ccaa789ebe77a1 vn="Win32/LockScreen.AQD Trojaner" ac=I fn="C:\FRST\Quarantine\cache.dat"
sh=21A3D2184948260F60A805B93FDF4A92D4AF5853 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Roman Schmid\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\33da1072-46a9ec3b"
sh=A0AC50CE60FFE962C625A8A2D1566815BF80D1C5 ft=0 fh=0000000000000000 vn="Variante von Win32/Packed.VMProtect.AAH Trojaner" ac=I fn="C:\Users\Roman Schmid\Desktop\Games\de-aoe2hd.iso"
sh=A0AC50CE60FFE962C625A8A2D1566815BF80D1C5 ft=0 fh=0000000000000000 vn="Variante von Win32/Packed.VMProtect.AAH Trojaner" ac=I fn="D:\Download\JDownloads\DE-AOE2HD\DE-AOE2HD\Age of Empires II HD GERMAN - 0x0007\de-aoe2hd.iso"
Beim SecurityCheck habe ich ein ähnliches Problem wie bei JRT...
Es öffnet sich, ich drücke eine beliebige Taste,
das Programm bereitet sich vor, und ein Prozess beginnt,
bricht dann jedoch ab und es öffnet sich keine Textdatei...
Das letzte Bild das ich kurz vor Autoabruch des Programms gesehen habe ist folgendes:
[IMG]http://www.fotos-hochladen.net/uploa...uyfeb02inh.jpg[/IMG]

Hier noch das Logfile von FRST64:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-09-2013
Ran by Roman Schmid (administrator) on ROMANSCHMID-PC on 13-09-2013 13:30:44
Running from C:\Users\Roman Schmid\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Adobe Systems Incorporated) c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(McAfee, Inc.) C:\Windows\system32\mfevtps.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PSIService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\CCDashServer.exe
() C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
() C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe
() C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe
(cyberlink) C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
(McAfee, Inc.) C:\Program Files\mcafee.com\agent\mcagent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
() C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel) C:\Program Files (x86)\Intel\irstrt\RapidStartConfig.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Dell Products, LP.) c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Core\mchost.exe
(Nero AG) C:\Program Files (x86)\Nero\SyncUP\SyncUP.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Nero AG) C:\Program Files (x86)\Nero\SyncUP\Nero.AndroidServer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Ghisler Software GmbH) C:\Program Files (x86)\totalcmd\TOTALCMD64.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [626552 2012-04-09] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-02-14] (IDT, Inc.)
HKLM\...\Run: [QuickSet] - c:\Program Files\Dell\QuickSet\QuickSet.exe [4365984 2012-03-12] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [IntelMyWiFiDashboard] - C:\Program Files\Intel\WiFi\bin\CCDashServer.exe [4966912 2012-03-30] (Intel® Corporation)
HKLM\...\Run: [BLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [120592 2012-01-10] ()
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671904 2012-08-28] (DT Soft Ltd)
MountPoints2: {6a187363-d9ed-11e2-8a54-5cf9dd4eab93} - G:\AutoRun.exe
MountPoints2: {6a18737c-d9ed-11e2-8a54-5cf9dd4eab93} - G:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [577024 2012-03-07] (Creative Technology Ltd)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [76872 2012-03-27] (cyberlink)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [NeroLauncher] - C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe [67496 2012-08-21] ()
HKLM-x32\...\Run: [AccuWeatherWidget] - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj [2835443 2012-02-01] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll [ ] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/17
SearchScopes: HKLM - DefaultScope {90F9FBBA-19E1-4ECA-9725-F07F5C566E2C} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {90F9FBBA-19E1-4ECA-9725-F07F5C566E2C} URL =
SearchScopes: HKCU - {90F9FBBA-19E1-4ECA-9725-F07F5C566E2C} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20121009111843.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20121009111843.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{2D3CFCAF-2B3A-4A29-8C26-798D2A25B3C5}: [NameServer]193.189.244.206 193.189.244.225

FireFox:
========
FF ProfilePath: C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default
FF NewTab: user_pref("browser.newtab.url", "");
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: hxxp://www.google.ch/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Roman Schmid\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Visualisateur 3D de 20-20 - C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\Extensions\2020Player_IKEA@2020Technologies.com
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

S2 CLKMSVC10_9EC60124; C:\Program Files (x86)\Cyberlink\PowerDVD9\NavFilter\kmsvc.exe [242448 2012-03-27] (CyberLink)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193536 2012-03-28] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [224704 2011-03-09] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [246112 2013-06-20] ()
R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-03-29] ()
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-28] ()
R2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [174656 2006-11-02] ()
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-03-29] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-10-17] (DT Soft Ltd)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
R3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-03-28] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2013-06-20] (Huawei Technologies Co., Ltd.)
U3 mfeavfk01; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-13 13:30 - 2013-09-13 13:30 - 01949572 _____ (Farbar) C:\Users\Roman Schmid\Desktop\FRST64.exe
2013-09-13 13:28 - 2013-09-13 13:28 - 01949572 _____ (Farbar) C:\Users\Roman Schmid\Downloads\FRST64.exe
2013-09-13 12:39 - 2013-09-13 12:39 - 00891144 _____ C:\Users\Roman Schmid\Desktop\SecurityCheck.exe
2013-09-12 16:44 - 2013-09-12 16:44 - 00000039 _____ C:\Users\Roman Schmid\AppData\Roaming\mbam.context.scan
2013-09-12 16:35 - 2013-09-12 16:35 - 00002966 _____ C:\Windows\System32\Tasks\{A69DBD04-198B-4792-B1EC-7EF8F01C3C43}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{FAEA7F42-9D13-4DFA-99C4-783AD5CA47B0}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{A1EC383F-9603-4628-8D48-9EAEBC19B5F9}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{8F618100-618C-490F-91E6-3238ACAB07CE}
2013-09-12 16:33 - 2013-09-12 16:33 - 00002966 _____ C:\Windows\System32\Tasks\{D66F17FB-B8FA-436C-8473-37A4646DF7D1}
2013-09-12 16:33 - 2013-09-12 16:33 - 00002966 _____ C:\Windows\System32\Tasks\{3092590D-36DD-43E6-8D26-79FA532C9091}
2013-09-12 16:32 - 2013-09-12 16:32 - 00002966 _____ C:\Windows\System32\Tasks\{0229A7BD-5374-41CE-9619-78573D69F66C}
2013-09-12 16:31 - 2013-09-12 16:31 - 00002966 _____ C:\Windows\System32\Tasks\{018BB3A4-161E-4053-9543-070378D4EDB9}
2013-09-12 13:32 - 2013-09-12 13:32 - 00045165 _____ C:\Users\Roman Schmid\Desktop\Addition.txt
2013-09-12 13:17 - 2013-09-12 12:52 - 01029509 _____ (Thisisu) C:\Users\Roman Schmid\Desktop\JRT.exe
2013-09-12 12:47 - 2013-09-12 12:48 - 00000000 ____D C:\AdwCleaner
2013-09-12 12:35 - 2013-09-12 12:35 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-12 12:35 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-12 11:55 - 2013-09-12 11:55 - 00000000 ____D C:\FRST
2013-09-12 03:08 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 03:08 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 03:08 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 03:08 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 03:08 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 03:08 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 03:08 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 03:08 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 03:08 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 03:08 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 03:08 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 03:08 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 01:11 - 2013-09-12 01:11 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Chromium
2013-09-12 01:07 - 2013-09-12 01:07 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\The Lord of the Rings Online
2013-09-12 01:01 - 2013-09-12 01:02 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Turbine
2013-09-12 01:01 - 2013-09-12 01:01 - 00001950 _____ C:\Users\Roman Schmid\Desktop\Der Herr der Ringe Online™.lnk
2013-09-12 01:00 - 2013-09-12 01:10 - 00000000 ____D C:\Users\Roman Schmid\Documents\The Lord of the Rings Online
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Turbine
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\ProgramData\Turbine
2013-09-12 00:54 - 2013-09-12 01:11 - 00000000 ____D C:\ProgramData\HappyCloud
2013-09-12 00:54 - 2013-09-12 00:54 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2013-09-11 22:14 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 22:14 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-11 22:14 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-11 22:14 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-11 22:14 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-11 22:14 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-11 22:14 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-11 22:14 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-11 22:14 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-11 22:14 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-11 22:14 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-11 22:14 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-11 22:14 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-11 22:14 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-11 22:14 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-11 22:14 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-11 22:14 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-11 22:14 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-11 22:14 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-11 22:14 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-11 22:14 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-11 22:14 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 22:14 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-11 22:14 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-11 22:14 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-11 22:14 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 14:02 - 2013-09-11 14:02 - 00000000 ____D C:\Users\Roman Schmid\Desktop\Games
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iTunes
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iPod
2013-09-11 12:17 - 2013-09-11 13:17 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\download.am-data
2013-09-11 12:17 - 2013-09-11 13:03 - 00000000 ____D C:\Program Files (x86)\Download.am
2013-09-11 12:17 - 2013-09-11 12:38 - 00000000 ____D C:\Users\Roman Schmid\Downloads\Download.am
2013-08-28 00:17 - 2013-08-28 00:17 - 00001159 _____ C:\Users\Roman Schmid\Desktop\farcry3.lnk
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\Users\Roman Schmid\Documents\My Games
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\ProgramData\Orbit
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-08-27 08:50 - 2013-08-27 08:50 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ___HD C:\Program Files (x86)\Zero G Registry
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Solarmax
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Program Files (x86)\Solarmax
2013-08-18 13:24 - 2013-08-18 13:24 - 00000000 ___HD C:\Users\Roman Schmid\InstallAnywhere
2013-08-18 12:56 - 2013-08-18 12:56 - 00000000 ____D C:\Users\Roman Schmid\Documents\SolarMax
2013-08-17 22:06 - 2013-08-17 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 21:57 - 2013-08-17 21:57 - 00000000 ____D C:\ProgramData\Steam
2013-08-14 03:01 - 2013-09-12 03:08 - 00000000 ____D C:\Windows\system32\MRT

==================== One Month Modified Files and Folders =======

2013-09-13 13:30 - 2013-09-13 13:30 - 01949572 _____ (Farbar) C:\Users\Roman Schmid\Desktop\FRST64.exe
2013-09-13 13:28 - 2013-09-13 13:28 - 01949572 _____ (Farbar) C:\Users\Roman Schmid\Downloads\FRST64.exe
2013-09-13 13:26 - 2012-10-29 21:06 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-13 12:39 - 2013-09-13 12:39 - 00891144 _____ C:\Users\Roman Schmid\Desktop\SecurityCheck.exe
2013-09-13 12:37 - 2012-10-02 23:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-13 11:54 - 2012-10-08 17:02 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Nero
2013-09-13 10:35 - 2012-10-02 16:20 - 01572236 _____ C:\Windows\WindowsUpdate.log
2013-09-13 09:53 - 2010-11-21 08:50 - 00696870 _____ C:\Windows\system32\perfh007.dat
2013-09-13 09:53 - 2010-11-21 08:50 - 00148134 _____ C:\Windows\system32\perfc007.dat
2013-09-13 09:53 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-13 09:30 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-13 09:30 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-13 08:56 - 2012-10-02 23:57 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-09-13 08:55 - 2012-10-29 21:06 - 00001118 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-13 08:55 - 2012-10-15 20:12 - 00000426 ____H C:\Windows\Tasks\OptimizerPro1UpdaterTask{870BA444-6012-4990-89E9-5B53916A4E0D}.job
2013-09-13 08:54 - 2012-10-02 16:20 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-13 08:54 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-13 08:54 - 2009-07-14 06:51 - 00065701 _____ C:\Windows\setupact.log
2013-09-12 16:44 - 2013-09-12 16:44 - 00000039 _____ C:\Users\Roman Schmid\AppData\Roaming\mbam.context.scan
2013-09-12 16:35 - 2013-09-12 16:35 - 00002966 _____ C:\Windows\System32\Tasks\{A69DBD04-198B-4792-B1EC-7EF8F01C3C43}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{FAEA7F42-9D13-4DFA-99C4-783AD5CA47B0}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{A1EC383F-9603-4628-8D48-9EAEBC19B5F9}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{8F618100-618C-490F-91E6-3238ACAB07CE}
2013-09-12 16:33 - 2013-09-12 16:33 - 00002966 _____ C:\Windows\System32\Tasks\{D66F17FB-B8FA-436C-8473-37A4646DF7D1}
2013-09-12 16:33 - 2013-09-12 16:33 - 00002966 _____ C:\Windows\System32\Tasks\{3092590D-36DD-43E6-8D26-79FA532C9091}
2013-09-12 16:32 - 2013-09-12 16:32 - 00002966 _____ C:\Windows\System32\Tasks\{0229A7BD-5374-41CE-9619-78573D69F66C}
2013-09-12 16:31 - 2013-09-12 16:31 - 00002966 _____ C:\Windows\System32\Tasks\{018BB3A4-161E-4053-9543-070378D4EDB9}
2013-09-12 13:32 - 2013-09-12 13:32 - 00045165 _____ C:\Users\Roman Schmid\Desktop\Addition.txt
2013-09-12 12:52 - 2013-09-12 13:17 - 01029509 _____ (Thisisu) C:\Users\Roman Schmid\Desktop\JRT.exe
2013-09-12 12:48 - 2013-09-12 12:47 - 00000000 ____D C:\AdwCleaner
2013-09-12 12:46 - 2010-11-21 05:47 - 00096552 _____ C:\Windows\PFRO.log
2013-09-12 12:35 - 2013-09-12 12:35 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-12 11:55 - 2013-09-12 11:55 - 00000000 ____D C:\FRST
2013-09-12 10:06 - 2012-10-08 17:00 - 00000000 ___RD C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 10:06 - 2012-10-08 17:00 - 00000000 ___RD C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 03:52 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-12 03:26 - 2009-07-14 06:45 - 00349504 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 03:08 - 2013-08-14 03:01 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 03:06 - 2012-10-09 10:27 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 03:06 - 2012-10-08 18:57 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 01:11 - 2013-09-12 01:11 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Chromium
2013-09-12 01:11 - 2013-09-12 00:54 - 00000000 ____D C:\ProgramData\HappyCloud
2013-09-12 01:10 - 2013-09-12 01:00 - 00000000 ____D C:\Users\Roman Schmid\Documents\The Lord of the Rings Online
2013-09-12 01:07 - 2013-09-12 01:07 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\The Lord of the Rings Online
2013-09-12 01:02 - 2013-09-12 01:01 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Turbine
2013-09-12 01:01 - 2013-09-12 01:01 - 00001950 _____ C:\Users\Roman Schmid\Desktop\Der Herr der Ringe Online™.lnk
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Turbine
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\ProgramData\Turbine
2013-09-12 00:54 - 2013-09-12 00:54 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2013-09-12 00:03 - 2012-10-03 00:14 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-09-11 19:48 - 2012-10-09 00:01 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-11 19:48 - 2012-10-08 23:10 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-09-11 14:10 - 2012-10-09 00:01 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-09-11 14:02 - 2013-09-11 14:02 - 00000000 ____D C:\Users\Roman Schmid\Desktop\Games
2013-09-11 13:37 - 2012-10-02 23:26 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-11 13:37 - 2012-10-02 23:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-11 13:37 - 2012-10-02 23:26 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-11 13:17 - 2013-09-11 12:17 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\download.am-data
2013-09-11 13:03 - 2013-09-11 12:17 - 00000000 ____D C:\Program Files (x86)\Download.am
2013-09-11 12:38 - 2013-09-11 12:17 - 00000000 ____D C:\Users\Roman Schmid\Downloads\Download.am
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iTunes
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iPod
2013-09-11 12:18 - 2013-06-18 13:08 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-28 14:22 - 2012-10-16 19:21 - 00000000 ____D C:\Users\Roman Schmid\Documents\Citavi 3
2013-08-28 00:17 - 2013-08-28 00:17 - 00001159 _____ C:\Users\Roman Schmid\Desktop\farcry3.lnk
2013-08-28 00:10 - 2012-10-08 23:09 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\PunkBuster
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\Users\Roman Schmid\Documents\My Games
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\ProgramData\Orbit
2013-08-28 00:08 - 2013-05-11 22:37 - 00000000 ____D C:\Games
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-08-28 00:06 - 2012-10-09 00:01 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-28 00:06 - 2012-10-03 00:06 - 00100005 _____ C:\Windows\DirectX.log
2013-08-28 00:01 - 2012-10-02 23:39 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-27 08:50 - 2013-08-27 08:50 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-08-25 10:50 - 2013-01-20 19:47 - 00000000 ____D C:\Program Files (x86)\Need For Speed World
2013-08-19 17:30 - 2012-10-08 22:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ___HD C:\Program Files (x86)\Zero G Registry
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Solarmax
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Program Files (x86)\Solarmax
2013-08-18 13:24 - 2013-08-18 13:24 - 00000000 ___HD C:\Users\Roman Schmid\InstallAnywhere
2013-08-18 13:24 - 2012-10-08 16:53 - 00000000 ____D C:\Users\Roman Schmid
2013-08-18 12:56 - 2013-08-18 12:56 - 00000000 ____D C:\Users\Roman Schmid\Documents\SolarMax
2013-08-17 22:12 - 2012-10-03 00:13 - 00000000 ____D C:\ProgramData\McAfee
2013-08-17 22:06 - 2013-08-17 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 21:57 - 2013-08-17 21:57 - 00000000 ____D C:\ProgramData\Steam

Files to move or delete:
====================
C:\Users\Roman Schmid\AppData\Local\Temp\Quarantine.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 12:44

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 13.09.2013 19:22
Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.


Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll [ ] ()
FF NewTab: user_pref("browser.newtab.url", "");
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Frisches FRST log bitte. Noch Probleme?

Schmittchen 14.09.2013 08:36
Guten Morgen schrauber,

Hier das FRST-log:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-09-2013
Ran by Roman Schmid (administrator) on ROMANSCHMID-PC on 14-09-2013 09:33:44
Running from C:\Users\Roman Schmid\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Adobe Systems Incorporated) c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(McAfee, Inc.) C:\Windows\system32\mfevtps.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PSIService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\CCDashServer.exe
() C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(McAfee, Inc.) C:\Program Files\mcafee.com\agent\mcagent.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Dell Products, LP.) c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Core\mchost.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [626552 2012-04-09] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-02-14] (IDT, Inc.)
HKLM\...\Run: [QuickSet] - c:\Program Files\Dell\QuickSet\QuickSet.exe [4365984 2012-03-12] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [IntelMyWiFiDashboard] - C:\Program Files\Intel\WiFi\bin\CCDashServer.exe [4966912 2012-03-30] (Intel® Corporation)
HKLM\...\Run: [BLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [120592 2012-01-10] ()
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671904 2012-08-28] (DT Soft Ltd)
MountPoints2: {6a187363-d9ed-11e2-8a54-5cf9dd4eab93} - G:\AutoRun.exe
MountPoints2: {6a18737c-d9ed-11e2-8a54-5cf9dd4eab93} - G:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [577024 2012-03-07] (Creative Technology Ltd)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [76872 2012-03-27] (cyberlink)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [NeroLauncher] - C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe [67496 2012-08-21] ()
HKLM-x32\...\Run: [AccuWeatherWidget] - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj [2835443 2012-02-01] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/17
SearchScopes: HKLM - DefaultScope {90F9FBBA-19E1-4ECA-9725-F07F5C566E2C} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {90F9FBBA-19E1-4ECA-9725-F07F5C566E2C} URL =
SearchScopes: HKCU - {90F9FBBA-19E1-4ECA-9725-F07F5C566E2C} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20121009111843.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20121009111843.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{2D3CFCAF-2B3A-4A29-8C26-798D2A25B3C5}: [NameServer]193.189.244.206 193.189.244.225

FireFox:
========
FF ProfilePath: C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF Homepage: hxxp://www.google.ch/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Roman Schmid\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Visualisateur 3D de 20-20 - C:\Users\Roman Schmid\AppData\Roaming\Mozilla\Firefox\Profiles\228mak4o.default\Extensions\2020Player_IKEA@2020Technologies.com
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

S2 CLKMSVC10_9EC60124; C:\Program Files (x86)\Cyberlink\PowerDVD9\NavFilter\kmsvc.exe [242448 2012-03-27] (CyberLink)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193536 2012-03-28] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [224704 2011-03-09] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [246112 2013-06-20] ()
R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-03-29] ()
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-28] ()
R2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [174656 2006-11-02] ()
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-03-29] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-10-17] (DT Soft Ltd)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
R3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-03-28] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2013-06-20] (Huawei Technologies Co., Ltd.)
U3 mfeavfk01; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-14 09:25 - 2013-09-14 09:25 - 00448512 _____ (OldTimer Tools) C:\Users\Roman Schmid\Desktop\TFC.exe
2013-09-13 13:30 - 2013-09-13 13:30 - 01949572 _____ (Farbar) C:\Users\Roman Schmid\Desktop\FRST64.exe
2013-09-13 13:28 - 2013-09-13 13:28 - 01949572 _____ (Farbar) C:\Users\Roman Schmid\Downloads\FRST64.exe
2013-09-13 12:39 - 2013-09-13 12:39 - 00891144 _____ C:\Users\Roman Schmid\Desktop\SecurityCheck.exe
2013-09-12 16:44 - 2013-09-12 16:44 - 00000039 _____ C:\Users\Roman Schmid\AppData\Roaming\mbam.context.scan
2013-09-12 16:35 - 2013-09-12 16:35 - 00002966 _____ C:\Windows\System32\Tasks\{A69DBD04-198B-4792-B1EC-7EF8F01C3C43}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{FAEA7F42-9D13-4DFA-99C4-783AD5CA47B0}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{A1EC383F-9603-4628-8D48-9EAEBC19B5F9}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{8F618100-618C-490F-91E6-3238ACAB07CE}
2013-09-12 16:33 - 2013-09-12 16:33 - 00002966 _____ C:\Windows\System32\Tasks\{D66F17FB-B8FA-436C-8473-37A4646DF7D1}
2013-09-12 16:33 - 2013-09-12 16:33 - 00002966 _____ C:\Windows\System32\Tasks\{3092590D-36DD-43E6-8D26-79FA532C9091}
2013-09-12 16:32 - 2013-09-12 16:32 - 00002966 _____ C:\Windows\System32\Tasks\{0229A7BD-5374-41CE-9619-78573D69F66C}
2013-09-12 16:31 - 2013-09-12 16:31 - 00002966 _____ C:\Windows\System32\Tasks\{018BB3A4-161E-4053-9543-070378D4EDB9}
2013-09-12 13:32 - 2013-09-12 13:32 - 00045165 _____ C:\Users\Roman Schmid\Desktop\Addition.txt
2013-09-12 13:17 - 2013-09-12 12:52 - 01029509 _____ (Thisisu) C:\Users\Roman Schmid\Desktop\JRT.exe
2013-09-12 12:47 - 2013-09-12 12:48 - 00000000 ____D C:\AdwCleaner
2013-09-12 12:35 - 2013-09-12 12:35 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-12 12:35 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-12 11:55 - 2013-09-12 11:55 - 00000000 ____D C:\FRST
2013-09-12 03:08 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 03:08 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 03:08 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 03:08 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 03:08 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 03:08 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 03:08 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 03:08 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 03:08 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 03:08 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 03:08 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 03:08 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 03:08 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 03:08 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 01:11 - 2013-09-12 01:11 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Chromium
2013-09-12 01:07 - 2013-09-12 01:07 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\The Lord of the Rings Online
2013-09-12 01:01 - 2013-09-12 01:02 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Turbine
2013-09-12 01:01 - 2013-09-12 01:01 - 00001950 _____ C:\Users\Roman Schmid\Desktop\Der Herr der Ringe Online™.lnk
2013-09-12 01:00 - 2013-09-12 01:10 - 00000000 ____D C:\Users\Roman Schmid\Documents\The Lord of the Rings Online
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Turbine
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\ProgramData\Turbine
2013-09-12 00:54 - 2013-09-12 01:11 - 00000000 ____D C:\ProgramData\HappyCloud
2013-09-12 00:54 - 2013-09-12 00:54 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2013-09-11 22:14 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 22:14 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-11 22:14 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-11 22:14 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-11 22:14 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-11 22:14 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-11 22:14 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-11 22:14 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-11 22:14 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-11 22:14 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-11 22:14 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-11 22:14 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-11 22:14 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-11 22:14 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-11 22:14 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-11 22:14 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-11 22:14 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-11 22:14 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-11 22:14 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-11 22:14 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-11 22:14 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-11 22:14 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 22:14 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 22:14 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-11 22:14 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-11 22:14 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-11 22:14 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 14:02 - 2013-09-11 14:02 - 00000000 ____D C:\Users\Roman Schmid\Desktop\Games
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iTunes
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iPod
2013-09-11 12:17 - 2013-09-11 13:17 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\download.am-data
2013-09-11 12:17 - 2013-09-11 13:03 - 00000000 ____D C:\Program Files (x86)\Download.am
2013-09-11 12:17 - 2013-09-11 12:38 - 00000000 ____D C:\Users\Roman Schmid\Downloads\Download.am
2013-08-28 00:17 - 2013-08-28 00:17 - 00001159 _____ C:\Users\Roman Schmid\Desktop\farcry3.lnk
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\Users\Roman Schmid\Documents\My Games
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\ProgramData\Orbit
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-08-27 08:50 - 2013-08-27 08:50 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ___HD C:\Program Files (x86)\Zero G Registry
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Solarmax
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Program Files (x86)\Solarmax
2013-08-18 13:24 - 2013-08-18 13:24 - 00000000 ___HD C:\Users\Roman Schmid\InstallAnywhere
2013-08-18 12:56 - 2013-08-18 12:56 - 00000000 ____D C:\Users\Roman Schmid\Documents\SolarMax
2013-08-17 22:06 - 2013-08-17 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 21:57 - 2013-08-17 21:57 - 00000000 ____D C:\ProgramData\Steam

==================== One Month Modified Files and Folders =======

2013-09-14 09:26 - 2012-10-29 21:06 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-14 09:25 - 2013-09-14 09:25 - 00448512 _____ (OldTimer Tools) C:\Users\Roman Schmid\Desktop\TFC.exe
2013-09-14 09:25 - 2010-11-21 08:50 - 00696870 _____ C:\Windows\system32\perfh007.dat
2013-09-14 09:25 - 2010-11-21 08:50 - 00148134 _____ C:\Windows\system32\perfc007.dat
2013-09-14 09:25 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-14 09:24 - 2012-10-02 23:26 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-14 09:24 - 2012-10-02 23:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-14 09:24 - 2012-10-02 23:26 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-14 09:24 - 2012-10-02 23:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-13 13:30 - 2013-09-13 13:30 - 01949572 _____ (Farbar) C:\Users\Roman Schmid\Desktop\FRST64.exe
2013-09-13 13:28 - 2013-09-13 13:28 - 01949572 _____ (Farbar) C:\Users\Roman Schmid\Downloads\FRST64.exe
2013-09-13 13:15 - 2012-10-02 16:20 - 01603319 _____ C:\Windows\WindowsUpdate.log
2013-09-13 12:39 - 2013-09-13 12:39 - 00891144 _____ C:\Users\Roman Schmid\Desktop\SecurityCheck.exe
2013-09-13 11:54 - 2012-10-08 17:02 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Nero
2013-09-13 09:30 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-13 09:30 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-13 08:56 - 2012-10-02 23:57 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-09-13 08:55 - 2012-10-29 21:06 - 00001118 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-13 08:55 - 2012-10-15 20:12 - 00000426 ____H C:\Windows\Tasks\OptimizerPro1UpdaterTask{870BA444-6012-4990-89E9-5B53916A4E0D}.job
2013-09-13 08:54 - 2012-10-02 16:20 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-13 08:54 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-13 08:54 - 2009-07-14 06:51 - 00065701 _____ C:\Windows\setupact.log
2013-09-12 16:44 - 2013-09-12 16:44 - 00000039 _____ C:\Users\Roman Schmid\AppData\Roaming\mbam.context.scan
2013-09-12 16:35 - 2013-09-12 16:35 - 00002966 _____ C:\Windows\System32\Tasks\{A69DBD04-198B-4792-B1EC-7EF8F01C3C43}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{FAEA7F42-9D13-4DFA-99C4-783AD5CA47B0}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{A1EC383F-9603-4628-8D48-9EAEBC19B5F9}
2013-09-12 16:34 - 2013-09-12 16:34 - 00002966 _____ C:\Windows\System32\Tasks\{8F618100-618C-490F-91E6-3238ACAB07CE}
2013-09-12 16:33 - 2013-09-12 16:33 - 00002966 _____ C:\Windows\System32\Tasks\{D66F17FB-B8FA-436C-8473-37A4646DF7D1}
2013-09-12 16:33 - 2013-09-12 16:33 - 00002966 _____ C:\Windows\System32\Tasks\{3092590D-36DD-43E6-8D26-79FA532C9091}
2013-09-12 16:32 - 2013-09-12 16:32 - 00002966 _____ C:\Windows\System32\Tasks\{0229A7BD-5374-41CE-9619-78573D69F66C}
2013-09-12 16:31 - 2013-09-12 16:31 - 00002966 _____ C:\Windows\System32\Tasks\{018BB3A4-161E-4053-9543-070378D4EDB9}
2013-09-12 13:32 - 2013-09-12 13:32 - 00045165 _____ C:\Users\Roman Schmid\Desktop\Addition.txt
2013-09-12 12:52 - 2013-09-12 13:17 - 01029509 _____ (Thisisu) C:\Users\Roman Schmid\Desktop\JRT.exe
2013-09-12 12:48 - 2013-09-12 12:47 - 00000000 ____D C:\AdwCleaner
2013-09-12 12:46 - 2010-11-21 05:47 - 00096552 _____ C:\Windows\PFRO.log
2013-09-12 12:35 - 2013-09-12 12:35 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-12 12:35 - 2013-09-12 12:35 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-12 11:55 - 2013-09-12 11:55 - 00000000 ____D C:\FRST
2013-09-12 10:06 - 2012-10-08 17:00 - 00000000 ___RD C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 10:06 - 2012-10-08 17:00 - 00000000 ___RD C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 03:52 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-12 03:26 - 2009-07-14 06:45 - 00349504 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 03:08 - 2013-08-14 03:01 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 03:06 - 2012-10-09 10:27 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 03:06 - 2012-10-08 18:57 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 01:11 - 2013-09-12 01:11 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Chromium
2013-09-12 01:11 - 2013-09-12 00:54 - 00000000 ____D C:\ProgramData\HappyCloud
2013-09-12 01:10 - 2013-09-12 01:00 - 00000000 ____D C:\Users\Roman Schmid\Documents\The Lord of the Rings Online
2013-09-12 01:07 - 2013-09-12 01:07 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\The Lord of the Rings Online
2013-09-12 01:02 - 2013-09-12 01:01 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Turbine
2013-09-12 01:01 - 2013-09-12 01:01 - 00001950 _____ C:\Users\Roman Schmid\Desktop\Der Herr der Ringe Online™.lnk
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Turbine
2013-09-12 00:55 - 2013-09-12 00:55 - 00000000 ____D C:\ProgramData\Turbine
2013-09-12 00:54 - 2013-09-12 00:54 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2013-09-12 00:03 - 2012-10-03 00:14 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-09-11 19:48 - 2012-10-09 00:01 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-11 19:48 - 2012-10-08 23:10 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-09-11 14:10 - 2012-10-09 00:01 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-09-11 14:02 - 2013-09-11 14:02 - 00000000 ____D C:\Users\Roman Schmid\Desktop\Games
2013-09-11 13:17 - 2013-09-11 12:17 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\download.am-data
2013-09-11 13:03 - 2013-09-11 12:17 - 00000000 ____D C:\Program Files (x86)\Download.am
2013-09-11 12:38 - 2013-09-11 12:17 - 00000000 ____D C:\Users\Roman Schmid\Downloads\Download.am
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iTunes
2013-09-11 12:18 - 2013-09-11 12:18 - 00000000 ____D C:\Program Files\iPod
2013-09-11 12:18 - 2013-06-18 13:08 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-28 14:22 - 2012-10-16 19:21 - 00000000 ____D C:\Users\Roman Schmid\Documents\Citavi 3
2013-08-28 00:17 - 2013-08-28 00:17 - 00001159 _____ C:\Users\Roman Schmid\Desktop\farcry3.lnk
2013-08-28 00:10 - 2012-10-08 23:09 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\PunkBuster
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\Users\Roman Schmid\Documents\My Games
2013-08-28 00:09 - 2013-08-28 00:09 - 00000000 ____D C:\ProgramData\Orbit
2013-08-28 00:08 - 2013-05-11 22:37 - 00000000 ____D C:\Games
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Users\Roman Schmid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2013-08-28 00:06 - 2013-08-28 00:06 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-08-28 00:06 - 2012-10-09 00:01 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-28 00:06 - 2012-10-03 00:06 - 00100005 _____ C:\Windows\DirectX.log
2013-08-28 00:01 - 2012-10-02 23:39 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-27 08:50 - 2013-08-27 08:50 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-08-25 10:50 - 2013-01-20 19:47 - 00000000 ____D C:\Program Files (x86)\Need For Speed World
2013-08-19 17:30 - 2012-10-08 22:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ___HD C:\Program Files (x86)\Zero G Registry
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Users\Roman Schmid\AppData\Local\Solarmax
2013-08-18 13:25 - 2013-08-18 13:25 - 00000000 ____D C:\Program Files (x86)\Solarmax
2013-08-18 13:24 - 2013-08-18 13:24 - 00000000 ___HD C:\Users\Roman Schmid\InstallAnywhere
2013-08-18 13:24 - 2012-10-08 16:53 - 00000000 ____D C:\Users\Roman Schmid
2013-08-18 12:56 - 2013-08-18 12:56 - 00000000 ____D C:\Users\Roman Schmid\Documents\SolarMax
2013-08-17 22:12 - 2012-10-03 00:13 - 00000000 ____D C:\ProgramData\McAfee
2013-08-17 22:06 - 2013-08-17 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 21:57 - 2013-08-17 21:57 - 00000000 ____D C:\ProgramData\Steam

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-09-11 12:44

==================== End Of Log ============================
--- --- ---

--- --- ---


und das Fixlog:
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-09-2013
Ran by Roman Schmid at 2013-09-14 09:31:34 Run:2
Running from C:\Users\Roman Schmid\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll [ ] ()
FF NewTab: user_pref("browser.newtab.url", "");
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
       
*****************

HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
Firefox newtab deleted successfully.
Firefox SelectedSearchEngine deleted successfully.

==== End of Fixlog ====
Gruss Schmittchen

schrauber 14.09.2013 20:27
Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Schmittchen 15.09.2013 10:41
Hey Schrauber!

Besten Dank für deine kompetente Hilfe! Du kannst dir nicht vorstellen wie froh ich darüber bin, wie schnell und elegant die ganze Sache jetzt verlaufen ist :)

Eine Frage betreffend Anti-Virenprogramm und Firewall habe ich noch:
Welche/s Programm/e kannst du da empfehlen?

Besten Dank und mit freundlichen Grüssen
Schmittchen

schrauber 15.09.2013 15:45
Wenn du bissl Geld ausgeben kannst, Emsisoft :)

Schmittchen 19.09.2013 21:30
Ok, werde mir das mal in Ruhe überlegen!^^
Besten Dank nochmal!
Kann jetzt geschlossen werden^^

schrauber 20.09.2013 11:08
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131