Trojaner-Board - Trojaner MacroMedia.exe "Coin-Miner"

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Trojaner MacroMedia.exe "Coin-Miner" (https://www.trojaner-board.de/142424-trojaner-macromedia-exe-coin-miner.html)

Trojaner MacroMedia.exe "Coin-Miner"

Hallo Community,

Ich habe seid gestern einen Trojaner auf meinem PC und brauche bitte dringend hilfe ! Er nimmt 90% der Auslastung von meiner CPU ein und nichts geht mehr richtig ....

Lg SyRoX

Hi,

mach bitte einen FRST-Scan:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST

Code:

==================== Processes (Whitelisted) ===================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe

(Microsoft Corporation) C:\Windows\System32\WScript.exe

() C:\ProgramData\win0\bpvttlpxh.exe

(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

(Microsoft Corporation) C:\Windows\system32\taskmgr.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Ufasoft) C:\Users\FLO\AppData\Roaming\WindowsHelp\macromedia.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM\...\Run: [] - [x]

HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [1646216 2013-04-01] (Ask)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-01] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-05] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [svchost] - C:\ProgramData\win0\bpvttlpxh.exe [620032 2013-07-10] ()

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)

HKLM\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

HKLM\...\Policies\Explorer: [HideSCAHealth] 1

HKCU\...\Run: [Steam] - D:\Program Files\Steam\steam.exe [1814440 2013-09-21] (Valve Corporation)

HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)

HKCU\...\Run: [miner] - "C:\Users\FLO\AppData\Roaming\miner\nircmd.exe" exec hide "C:\Users\FLO\AppData\Roaming\miner\start.bat"

HKCU\...\Run: [HKCUwvcs] - C:\Users\FLO\AppData\Roaming\wiiunuws\windcis.exe [385024 2013-09-22] (Mozilla)

HKCU\...\Run: [HKCUwinfc] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)

HKCU\...\Run: [svchost] - C:\ProgramData\win0\bpvttlpxh.exe [620032 2013-07-10] ()

HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-03-28] (AMD)

HKCU\...\Run: [HKCUWINStvl] - C:\Users\FLO\AppData\Roaming\WINSpool\WINSVch.exe [294912 2013-10-02] (IKARUS Security)

HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1

HKCU\...\Policies\Explorer: [HideSCAHealth] 1

IMEO\mbam.exe: [Debugger] jfl_.exe

IMEO\mbamgui.exe: [Debugger] ekm_.exe

IMEO\rstrui.exe: [Debugger] rp_.exe

Startup: C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Skype.lnk

ShortcutTarget: Skype.lnk -> C:\Users\FLO\AppData\Roaming\WindowsHelp\usft_ext.exe.vbs ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA109AF1D4338CE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946

SearchScopes: HKCU - {FE4C0989-6A69-49E7-8229-4251F93E8597} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8960151d-44c5-4d16-812c-cf913cd117eb&apn_sauid=3E6BEBCA-93F6-40BD-9FE7-AC6F8FCD78A6

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Lyrics-Pal - {C8FBE488-BAF5-4019-A7F7-C888045987D3} - C:\Program Files\LyricsPal\120.dll No File

BHO: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: Lyrics-Pal - {ebcafb3f-5032-49f2-bf60-b99beef14b5c} - C:\Program Files\LyricsPal\133.dll ()

Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

Toolbar: HKCU -Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)

Tcpip\Parameters: [DhcpNameServer] 192.168.13.1
 

FireFox:

========

FF ProfilePath: C:\Users\FLO\AppData\Roaming\Mozilla\Firefox\Profiles\ypntwgra.default

FF NewTab: hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946

FF SearchEngineOrder.1: Delta Search

FF SelectedSearchEngine: Delta Search

FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946

FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF HKCU\...\Firefox\Extensions: [{8f5010e2-9577-4aed-ad42-f2098ea15def}] - C:\Program Files\LyricsPal\133.xpi

FF Extension: No Name - C:\Program Files\LyricsPal\133.xpi

FF StartMenuInternet: FIREFOX.EXE - C:\Users\FLO\Documents\Firefox Browser\App\Firefox\firefox.exe
 

Chrome: 

=======

CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\pdf.dll ()

CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)

CHR Plugin: (ESN Sonar API) - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File

CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Nexon Game Controller) - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

CHR Plugin: (Unity Player) - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll No File

CHR Plugin: (Java Deployment Toolkit 7.0.250.16) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

CHR Extension: (Google Docs) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Adblock Plus) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.5_0

CHR Extension: (Google Search) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (GTA5) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjohnmajpleabijkmpeildakhgdfpem\1_0

CHR Extension: (Chrome In-App Payments service) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0

CHR Extension: (Gmail) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR Extension: (Lyrics-Pal) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnbbffeddnekkhjmokkhdebbfbibbflc\1.133_0

CHR HKLM\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files\LyricsPal\125.crx

CHR HKLM\...\Chrome\Extension: [pnbbffeddnekkhjmokkhdebbfbibbflc] - C:\Program Files\LyricsPal\133.crx
 

========================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-09-05] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-01] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-01] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-07-01] (Avira Operations GmbH & Co. KG)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [29184 2013-06-19] (Advanced Micro Devices)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-13] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-13] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-13] (Avira Operations GmbH & Co. KG)

R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)

S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)

R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [62208 2010-11-19] (Renesas Electronics Corporation)

R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141568 2010-11-19] (Renesas Electronics Corporation)

S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [204432 2012-06-05] (Realtek Semiconductor Corp.)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-13] (Avira GmbH)

S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [29184 2013-04-03] (Anchorfree Inc.)

S3 xnacc; C:\Windows\System32\DRIVERS\xnacc.sys [465408 2009-07-14] (Microsoft Corporation)

S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]

S3 WinRing0_1_2_0; \??\D:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST

2013-10-02 15:48 - 2013-10-02 15:48 - 01086873 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe

2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe

2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe

2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-02 15:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-10-02 15:07 - 2013-10-02 15:09 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-02 14:24 - 2013-07-17 22:18 - 00001622 _____ C:\Users\Public\Desktop\LaunchIW4M - Verknüpfung.lnk

2013-10-02 14:24 - 2013-07-15 19:35 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Multiplayer.url

2013-10-02 14:24 - 2013-05-17 15:08 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Zombies.url

2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe

2013-10-02 12:59 - 2013-10-02 13:08 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar

2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip

2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer

2013-10-02 10:42 - 2013-10-02 10:43 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini

2013-10-02 10:41 - 2013-10-02 10:42 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe

2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe

2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5

2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe

2013-10-02 10:34 - 2013-10-02 10:38 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe

2013-10-02 09:47 - 2013-10-02 11:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool

2013-10-01 13:31 - 2013-10-01 13:36 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4

2013-09-29 20:17 - 2013-09-29 20:20 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav

2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun

2013-09-26 15:51 - 2013-09-26 15:52 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe

2013-09-26 14:49 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-09-26 14:49 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-09-26 14:49 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-09-26 14:49 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-09-26 14:49 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-09-26 14:49 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-09-26 14:39 - 2013-09-26 14:45 - 00000000 ____D C:\Windows\system32\MRT

2013-09-26 14:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-09-26 14:38 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-09-26 14:38 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-09-26 14:37 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-09-26 14:37 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2013-09-26 14:37 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2013-09-26 14:37 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2013-09-26 14:37 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2013-09-26 14:37 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2013-09-26 14:37 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

2013-09-26 14:37 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-09-26 14:37 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-09-26 14:37 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2013-09-26 14:37 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-09-26 14:37 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-09-26 14:36 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav

2013-09-24 20:33 - 2013-09-24 20:34 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv

2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws

2013-09-20 21:36 - 2013-09-20 21:36 - 00000000 ____D C:\Users\FLO\AppData\Roaming\File Scout

2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT

2013-09-14 15:33 - 2013-10-01 18:20 - 00000000 ____D C:\ProgramData\BitGuard

2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me

2013-09-13 18:18 - 2013-09-13 18:17 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4

2013-09-12 06:27 - 2013-09-12 06:27 - 00000000 ____D C:\Program Files\LyricsPal

2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url

2013-09-08 20:31 - 2013-09-08 20:49 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock

2013-09-08 20:31 - 2013-09-08 20:42 - 00000000 ____D C:\Users\FLO\Documents\Bioshock

2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll
 

==================== One Month Modified Files and Folders =======
 

2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST

2013-10-02 15:48 - 2013-10-02 15:48 - 01086873 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe

2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe

2013-10-02 15:35 - 2013-06-15 10:23 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe

2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-02 15:09 - 2013-10-02 15:07 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-02 14:41 - 2013-04-13 13:59 - 01209612 _____ C:\Windows\WindowsUpdate.log

2013-10-02 14:34 - 2013-06-20 19:18 - 00000000 ____D C:\Program Files\Paint.NET

2013-10-02 14:34 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-10-02 14:33 - 2013-08-08 12:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins

2013-10-02 14:33 - 2013-06-03 20:23 - 00000000 ____D C:\Users\FLO\AppData\Local\CrashDumps

2013-10-02 14:33 - 2013-04-19 17:53 - 00000000 ____D C:\Windows\Minidump

2013-10-02 14:33 - 2013-04-13 14:55 - 00000000 ____D C:\Windows\Panther

2013-10-02 14:29 - 2013-04-18 16:27 - 00000000 ____D C:\Users\FLO\AppData\Roaming\TS3Client

2013-10-02 14:25 - 2011-04-12 03:39 - 00000000 ____D C:\Windows\ShellNew

2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe

2013-10-02 13:08 - 2013-10-02 12:59 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 13:01 - 2013-04-18 14:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Skype

2013-10-02 13:01 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing

2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar

2013-10-02 12:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF

2013-10-02 11:26 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-10-02 11:26 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip

2013-10-02 11:22 - 2013-07-17 13:30 - 00000346 _____ C:\Windows\Tasks\Lyrics-Pal Update.job

2013-10-02 11:19 - 2013-06-15 10:23 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-10-02 11:18 - 2013-07-15 12:56 - 00065536 _____ C:\Windows\system32\Ikeext.etl

2013-10-02 11:18 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-10-02 11:07 - 2013-10-02 09:47 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:42 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini

2013-10-02 10:42 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe

2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe

2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5

2013-10-02 10:39 - 2013-04-14 18:15 - 00000000 ____D C:\ProgramData\Adobe

2013-10-02 10:38 - 2013-10-02 10:34 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe

2013-10-02 10:38 - 2013-04-14 18:26 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Adobe

2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe

2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool

2013-10-01 18:20 - 2013-09-14 15:33 - 00000000 ____D C:\ProgramData\BitGuard

2013-10-01 13:36 - 2013-10-01 13:31 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4

2013-10-01 11:48 - 2013-04-13 14:40 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Mozilla

2013-10-01 11:21 - 2013-08-28 19:37 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WindowsHelp

2013-09-29 20:20 - 2013-09-29 20:17 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav

2013-09-28 20:21 - 2013-04-13 14:22 - 00000000 ____D C:\Program Files\ATI Technologies

2013-09-28 18:30 - 2010-11-20 23:01 - 01589442 _____ C:\Windows\system32\PerfStringBackup.INI

2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun

2013-09-26 19:54 - 2013-04-14 18:18 - 00000000 ____D C:\Program Files\Common Files\Steam

2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Users\FLO\AppData\Local\Google

2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Program Files\Google

2013-09-26 15:52 - 2013-09-26 15:51 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe

2013-09-26 15:20 - 2009-07-14 06:33 - 00268272 _____ C:\Windows\system32\FNTCACHE.DAT

2013-09-26 15:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE

2013-09-26 14:45 - 2013-09-26 14:39 - 00000000 ____D C:\Windows\system32\MRT

2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav

2013-09-24 20:34 - 2013-09-24 20:33 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv

2013-09-22 20:25 - 2013-04-13 14:41 - 00000000 ____D C:\Users\FLO\AppData\Local\DoNotTrackPlus

2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws

2013-09-20 21:36 - 2013-09-20 21:36 - 00000000 ____D C:\Users\FLO\AppData\Roaming\File Scout

2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT

2013-09-19 15:12 - 2013-04-13 14:29 - 00000000 ____D C:\ProgramData\AMD

2013-09-19 15:04 - 2013-04-13 14:27 - 00000000 ____D C:\AMD

2013-09-19 13:42 - 2013-07-15 10:32 - 00000000 ____D C:\Users\FLO\AppData\Roaming\miner

2013-09-16 15:22 - 2013-05-10 18:10 - 00000000 ____D C:\Users\FLO\AppData\Local\IW4M

2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me

2013-09-13 18:17 - 2013-09-13 18:18 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4

2013-09-12 06:27 - 2013-09-12 06:27 - 00000000 ____D C:\Program Files\LyricsPal

2013-09-12 06:27 - 2013-07-17 13:32 - 00000000 ____D C:\Windows\system32\Extensions

2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url

2013-09-11 17:48 - 2013-07-17 13:21 - 00000000 ____D C:\Users\FLO\AppData\Roaming\.minecraft

2013-09-08 20:49 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock

2013-09-08 20:42 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\Documents\Bioshock

2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll
 

Some content of TEMP:

====================

C:\Users\FLO\AppData\Local\Temp\ppoazhovqwl.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-29 19:10
 

==================== End Of Log ============================

Addition

Code:

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

7-Zip 9.20

Adobe Reader XI (11.0.04) - Deutsch (Version: 11.0.04)

Akamai NetSession Interface

AMD Accelerated Video Transcoding (Version: 13.20.100.30905)

AMD APP SDK Runtime (Version: 10.0.1084.4)

AMD Catalyst Control Center (Version: 2013.0905.312.3832)

AMD Catalyst Install Manager (Version: 8.0.915.0)

AMD Drag and Drop Transcoding (Version: 2.00.0000)

AMD Fuel (Version: 2013.0905.312.3832)

AMD Media Foundation Decoders (Version: 1.0.80905.0331)

AMD Wireless Display v3.0 (Version: 1.0.0.14)

Application Profiles (Version: 2.0.4888.34279)

Ask Toolbar (Version: 1.15.24.0)

aTube Catcher (Version: 2.9.1347)

Avira Free Antivirus (Version: 13.0.0.3737)

Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.2.5.42066)

Battlefield 3™ (Version: 1.6.0.0)

Battlelog Web Plugins (Version: 2.1.7)

Call of Duty: Black Ops II - Multiplayer

Call of Duty: Black Ops II - Zombies

Call of Duty: Modern Warfare 2 - Multiplayer

Call of Duty: Modern Warfare 3 - Dedicated Server

Call of Duty: Modern Warfare 3 - Multiplayer

Camtasia Studio 8 (Version: 8.0.4.1060)

Catalyst Control Center - Branding (Version: 1.00.0000)

Catalyst Control Center Graphics Previews Common (Version: 2013.0905.312.3832)

Catalyst Control Center InstallProxy (Version: 2013.0815.818.13017)

Catalyst Control Center Localization All (Version: 2013.0905.312.3832)

CCC Help Chinese Standard (Version: 2013.0905.0311.3832)

CCC Help Chinese Traditional (Version: 2013.0905.0311.3832)

CCC Help Czech (Version: 2013.0905.0311.3832)

CCC Help Danish (Version: 2013.0905.0311.3832)

CCC Help Dutch (Version: 2013.0905.0311.3832)

CCC Help English (Version: 2013.0905.0311.3832)

CCC Help Finnish (Version: 2013.0905.0311.3832)

CCC Help French (Version: 2013.0905.0311.3832)

CCC Help German (Version: 2013.0905.0311.3832)

CCC Help Greek (Version: 2013.0905.0311.3832)

CCC Help Hungarian (Version: 2013.0905.0311.3832)

CCC Help Italian (Version: 2013.0905.0311.3832)

CCC Help Japanese (Version: 2013.0905.0311.3832)

CCC Help Korean (Version: 2013.0905.0311.3832)

CCC Help Norwegian (Version: 2013.0905.0311.3832)

CCC Help Polish (Version: 2013.0905.0311.3832)

CCC Help Portuguese (Version: 2013.0905.0311.3832)

CCC Help Russian (Version: 2013.0905.0311.3832)

CCC Help Spanish (Version: 2013.0905.0311.3832)

CCC Help Swedish (Version: 2013.0905.0311.3832)

CCC Help Thai (Version: 2013.0905.0311.3832)

CCC Help Turkish (Version: 2013.0905.0311.3832)

ccc-utility (Version: 2013.0905.312.3832)

CCleaner (Version: 4.03)

Dead Island Riptide

Firefox Browser (remove only)

Fraps (remove only)

Google Chrome (Version: 29.0.1547.76)

Google Earth (Version: 7.1.1.1888)

Google Update Helper (Version: 1.3.21.153)

HydraVision (Version: 4.2.252.0)

Java 7 Update 25 (Version: 7.0.250)

Java Auto Updater (Version: 2.1.9.5)

League of Legends (Version: 1.3)

Lyrics-Pal

Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)

McAfee Security Scan Plus (Version: 3.0.285.6)

Microsoft .NET Framework 4.5 (Version: 4.5.50709)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (Version: 11.0.50727.1)

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (Version: 11.0.50727)

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (Version: 11.0.50727)

Nexon Game Manager

Realtek Ethernet Controller Driver (Version: 7.49.927.2011)

Realtek HDMI Audio Driver for ATI (Version: 6.0.1.6650)

Realtek High Definition Audio Driver (Version: 6.0.1.6662)

Renesas Electronics USB 3.0 Host Controller Driver (Version: 2.0.30.0)

Skype™ 6.6 (Version: 6.6.106)

Steam (Version: 1.0.0.0)

TeamSpeak 3 Client (Version: 3.0.13)

Unity Web Player (HKCU Version: )

Uplay (Version: 2.0)

WinRAR 4.20 (32-Bit) (Version: 4.20.0)
 

==================== Restore Points  =========================
 

02-10-2013 12:34:01 Removed Paint.NET v3.5.10
 

==================== Hosts content: ==========================
 

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {07E887E3-D81F-41C3-A282-CA02110C312B} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2013-04-01] ()

Task: {1009E27B-6FC3-4D8B-9163-89EFFC1B6B6D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-06-15] (Google Inc.)

Task: {30769C4E-4BFE-4B1B-9768-B1F23B736DA2} - System32\Tasks\Razer_Game_Booster_AutoUpdate => D:\Program Files\Razer\Razer Game Booster\AutoUpdate.exe

Task: {3363F52E-549D-438D-8BC3-374B6120FE36} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)

Task: {3861583A-86F7-4A98-9CE8-2FB788770FFD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-06-19] (Piriform Ltd)

Task: {6A3CCF2C-528D-40F7-B40F-8AD05F48D3FE} - System32\Tasks\Game_Booster_AutoUpdate => D:\Program Files\IObit\Game Booster 3\AutoUpdate.exe

Task: {BB921791-C88C-424A-ACBC-E138F4D36A97} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-06-15] (Google Inc.)

Task: {EB3651DC-6E87-428A-A75C-2E95E0A1CF6E} - System32\Tasks\Lyrics-Pal Update => C:\Program Files\LyricsPal\Lyrics.exe [2013-09-11] ()

Task: {F912CE69-2F0E-43E6-8854-E8EBD4D5C0DC} - System32\Tasks\Windows Update Check - 0x21BF04DF => C:\ProgramData\win0\bpvttlpxh.exe [2013-07-10] ()

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\Lyrics-Pal Update.job => C:\Program Files\LyricsPal\Lyrics.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-10-01 17:07 - 2013-10-01 11:46 - 02704352 _____ () C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.dll

2013-09-05 03:13 - 2013-09-05 03:13 - 00095744 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

2013-09-26 15:53 - 2013-09-17 05:20 - 00709584 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\libglesv2.dll

2013-09-26 15:53 - 2013-09-17 05:20 - 00099792 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\libegl.dll

2013-09-26 15:53 - 2013-09-17 05:21 - 04053456 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\pdf.dll

2013-09-26 15:53 - 2013-09-17 05:21 - 00410576 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll

2013-09-26 15:53 - 2013-09-17 05:20 - 01604560 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\ffmpegsumo.dll

2013-09-26 15:53 - 2013-09-17 05:21 - 13611984 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Faulty Device Manager Devices =============
 

Name: Marvell 91xx Config ATA Device

Description: Marvell 91xx Config ATA Device

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (10/02/2013 02:19:09 PM) (Source: Application Hang) (User: )

Description: Programm Steam.exe, Version 1.91.87.3 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 2794
 

Startzeit: 01cebf68ac6f5709
 

Endzeit: 42
 

Anwendungspfad: D:\Program Files\Steam\Steam.exe
 

Berichts-ID: d47d6453-2b5c-11e3-9671-6cf04950c1b3
 

Error: (10/02/2013 01:01:30 PM) (Source: Application Hang) (User: )

Description: Programm iw5mp.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1924
 

Startzeit: 01cebf5e8e6a36bd
 

Endzeit: 2098
 

Anwendungspfad: D:\Program Files\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe
 

Berichts-ID: f9ad682a-2b51-11e3-9671-6cf04950c1b3
 

Error: (10/02/2013 00:40:22 PM) (Source: Application Hang) (User: )

Description: Programm iw5mp.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1290
 

Startzeit: 01cebf53576731b9
 

Endzeit: 197
 

Anwendungspfad: D:\Program Files\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe
 

Berichts-ID: 07ab13bd-2b4f-11e3-9671-6cf04950c1b3
 

Error: (10/02/2013 11:20:16 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (10/02/2013 11:19:35 AM) (Source: ESENT) (User: )

Description: taskhost (1424) Versuch, Datei "C:\Users\FLO\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 

Error: (10/02/2013 09:15:35 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: dependant.exe, Version: 0.0.0.0, Zeitstempel: 0x51a843e9

Name des fehlerhaften Moduls: amdocl.dll, Version: 10.0.1307.1, Zeitstempel: 0x520ccecc

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0002f346

ID des fehlerhaften Prozesses: 0x120

Startzeit der fehlerhaften Anwendung: 0xdependant.exe0

Pfad der fehlerhaften Anwendung: dependant.exe1

Pfad des fehlerhaften Moduls: dependant.exe2

Berichtskennung: dependant.exe3
 

Error: (10/02/2013 09:13:26 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (10/01/2013 08:17:10 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (10/01/2013 08:16:30 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: dependant.exe, Version: 0.0.0.0, Zeitstempel: 0x51a843e9

Name des fehlerhaften Moduls: amdocl.dll, Version: 10.0.1307.1, Zeitstempel: 0x520ccecc

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0002f346

ID des fehlerhaften Prozesses: 0xbe4

Startzeit der fehlerhaften Anwendung: 0xdependant.exe0

Pfad der fehlerhaften Anwendung: dependant.exe1

Pfad des fehlerhaften Moduls: dependant.exe2

Berichtskennung: dependant.exe3
 

Error: (10/01/2013 08:10:07 PM) (Source: Application Hang) (User: )

Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: d0
 

Startzeit: 01cebed1399f57f3
 

Endzeit: 9635
 

Anwendungspfad: D:\Program Files\League of Legends\RADS\system\rads_user_kernel.exe
 

Berichts-ID: a93ec7e8-2ac4-11e3-83e0-6cf04950c1b3
 
 

System errors:

=============

Error: (10/02/2013 02:48:35 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (10/02/2013 11:18:24 AM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎02.‎10.‎2013 um 11:17:35 unerwartet heruntergefahren.
 

Error: (10/01/2013 08:15:30 PM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎01.‎10.‎2013 um 20:13:56 unerwartet heruntergefahren.
 

Error: (10/01/2013 06:41:06 PM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎01.‎10.‎2013 um 18:34:13 unerwartet heruntergefahren.
 

Error: (10/01/2013 06:20:26 PM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎01.‎10.‎2013 um 18:19:23 unerwartet heruntergefahren.
 

Error: (10/01/2013 05:06:35 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 

%%-2147014847
 

Error: (10/01/2013 11:18:54 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 

%%-2147014847
 

Error: (09/30/2013 08:46:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 

%%-2147014847
 

Error: (09/30/2013 08:46:06 PM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎30.‎09.‎2013 um 20:44:52 unerwartet heruntergefahren.
 

Error: (09/30/2013 07:51:04 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 

%%-2147014847
 
 

Microsoft Office Sessions:

=========================

Error: (10/02/2013 02:19:09 PM) (Source: Application Hang)(User: )

Description: Steam.exe1.91.87.3279401cebf68ac6f570942D:\Program Files\Steam\Steam.exed47d6453-2b5c-11e3-9671-6cf04950c1b3
 

Error: (10/02/2013 01:01:30 PM) (Source: Application Hang)(User: )

Description: iw5mp.exe0.0.0.0192401cebf5e8e6a36bd2098D:\Program Files\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exef9ad682a-2b51-11e3-9671-6cf04950c1b3
 

Error: (10/02/2013 00:40:22 PM) (Source: Application Hang)(User: )

Description: iw5mp.exe0.0.0.0129001cebf53576731b9197D:\Program Files\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe07ab13bd-2b4f-11e3-9671-6cf04950c1b3
 

Error: (10/02/2013 11:20:16 AM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (10/02/2013 11:19:35 AM) (Source: ESENT)(User: )

Description: taskhost1424C:\Users\FLO\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
 

Error: (10/02/2013 09:15:35 AM) (Source: Application Error)(User: )

Description: dependant.exe0.0.0.051a843e9amdocl.dll10.0.1307.1520cceccc00000050002f34612001cebf3f1b7cdcd8C:\Users\FLO\AppData\Roaming\miner\dependant.exeC:\Windows\system32\amdocl.dll6e190455-2b32-11e3-beac-6cf04950c1b3
 

Error: (10/02/2013 09:13:26 AM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (10/01/2013 08:17:10 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (10/01/2013 08:16:30 PM) (Source: Application Error)(User: )

Description: dependant.exe0.0.0.051a843e9amdocl.dll10.0.1307.1520cceccc00000050002f346be401cebed24fcc9079C:\Users\FLO\AppData\Roaming\miner\dependant.exeC:\Windows\system32\amdocl.dll97fc4f6e-2ac5-11e3-ad62-6cf04950c1b3
 

Error: (10/01/2013 08:10:07 PM) (Source: Application Hang)(User: )

Description: rads_user_kernel.exe0.0.0.0d001cebed1399f57f39635D:\Program Files\League of Legends\RADS\system\rads_user_kernel.exea93ec7e8-2ac4-11e3-83e0-6cf04950c1b3
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 57%

Total physical RAM: 3326.49 MB

Available physical RAM: 1422.29 MB

Total Pagefile: 6322.72 MB

Available Pagefile: 3939.22 MB

Total Virtual: 2047.88 MB

Available Virtual: 1875.82 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:48.73 GB) (Free:25.23 GB) NTFS

Drive d: (FLO) (Fixed) (Total:184.06 GB) (Free:54.5 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: F3246542)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=49 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=184 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Die Logs bitte immer vollständig posten.

Schritt 1

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Schritt 3

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

Log von Adwcleaner
Log von Combofix
Log von FRST

Code:

omboFix 13-10-01.03 - FLO 02.10.2013  16:30:55.1.4 - x86

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3326.2534 [GMT 2:00]

ausgeführt von:: c:\users\FLO\Desktop\ComboFix.exe

AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

Die folgenden Dateien wurden während des Laufs deaktiviert:

c:\program files\ATI Technologies\HydraVision\HydraDMH.dll

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Skype.lnk

c:\users\FLO\AppData\Roaming\WindowsHelp

c:\users\FLO\AppData\Roaming\WindowsHelp\coinutil.dll

c:\users\FLO\AppData\Roaming\WindowsHelp\killer.bat

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\compile.bat

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part1

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part10

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part11

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part12

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part13

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part14

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part15

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part16

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part17

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part18

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part19

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part2

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part20

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part21

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part22

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part23

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part24

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part25

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part26

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part27

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part28

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part29

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part3

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part30

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part31

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part32

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part33

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part34

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part35

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part36

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part37

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part38

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part39

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part4

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part40

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part41

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part42

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part43

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part44

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part45

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part46

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part47

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part48

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part49

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part5

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part50

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part51

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part52

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part53

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part54

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part55

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part56

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part57

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part58

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part59

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part6

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part60

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part61

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part62

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part63

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part64

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part65

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part66

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part67

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part68

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part69

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part7

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part70

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part71

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part72

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part73

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part74

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part75

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part76

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part77

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part78

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part79

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part8

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part80

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part81

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part82

c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part9

c:\users\FLO\AppData\Roaming\WindowsHelp\macromedia.exe

c:\users\FLO\AppData\Roaming\WindowsHelp\miner.dll

c:\users\FLO\AppData\Roaming\WindowsHelp\openssl.dll

c:\users\FLO\AppData\Roaming\WindowsHelp\phatk.cl

c:\users\FLO\AppData\Roaming\WindowsHelp\phatk.ptx

c:\users\FLO\AppData\Roaming\WindowsHelp\puts.vbs

c:\users\FLO\AppData\Roaming\WindowsHelp\serials.txt

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\compile.bat

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part10

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part11

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part12

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part13

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part14

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part15

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part16

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part17

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part18

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part19

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part2

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part20

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part21

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part22

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part23

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part24

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part25

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part26

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part27

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part28

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part29

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part3

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part30

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part31

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part32

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part33

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part34

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part35

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part36

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part37

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part38

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part39

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part4

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part40

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part41

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part42

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part43

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part44

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part45

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part46

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part47

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part48

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part49

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part5

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part50

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part51

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part52

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part53

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part54

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part55

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part56

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part57

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part58

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part59

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part6

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part60

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part61

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part62

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part63

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part64

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part65

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part66

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part67

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part68

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part69

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part7

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part70

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part71

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part72

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part73

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part74

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part75

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part76

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part77

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part78

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part79

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part8

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part80

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part81

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part82

c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part9

c:\users\FLO\AppData\Roaming\WindowsHelp\shell.exe

c:\users\FLO\AppData\Roaming\WindowsHelp\usft_ext.dll

c:\users\FLO\AppData\Roaming\WindowsHelp\usft_ext.exe.vbs

c:\windows\system32\frapsvid.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-09-02 bis 2013-10-02  ))))))))))))))))))))))))))))))

.

.

2013-10-02 14:49 . 2013-10-02 14:51        --------        d-----w-        c:\users\FLO\AppData\Local\temp

2013-10-02 13:58 . 2013-10-02 14:08        --------        d-----w-        C:\AdwCleaner

2013-10-02 13:49 . 2013-10-02 13:49        --------        d-----w-        C:\FRST

2013-10-02 13:09 . 2013-10-02 13:09        --------        d-----w-        c:\programdata\Malwarebytes

2013-10-02 13:09 . 2013-10-02 13:09        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2013-10-02 13:09 . 2013-04-04 12:50        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-10-02 10:59 . 2013-10-02 11:08        --------        d-----w-        c:\users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 10:56 . 2013-10-02 10:56        --------        d-----w-        c:\users\FLO\AppData\Local\ElevatedDiagnostics

2013-10-02 08:43 . 2013-10-02 08:43        --------        d-----w-        c:\users\FLO\AppData\Roaming\Apple Computer

2013-10-02 08:43 . 2013-10-02 08:43        --------        d-----w-        c:\users\FLO\AppData\Local\Apple Computer

2013-10-02 08:43 . 2013-10-02 08:43        --------        d-----w-        c:\users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 08:41 . 2013-10-02 08:41        --------        d-----w-        C:\Game5

2013-10-02 08:37 . 2013-10-02 08:37        --------        d-----w-        c:\programdata\McAfee Security Scan

2013-10-02 08:36 . 2013-10-02 08:36        --------        d-----w-        c:\programdata\McAfee

2013-10-02 08:36 . 2013-10-02 08:36        --------        d-----w-        c:\program files\McAfee Security Scan

2013-10-02 08:36 . 2013-10-02 08:36        --------        d-----w-        c:\program files\Common Files\Adobe

2013-10-02 08:34 . 2013-10-02 08:38        --------        d-----w-        c:\users\FLO\AppData\Local\Adobe

2013-10-02 07:17 . 2013-10-02 07:17        --------        d-----w-        c:\users\FLO\AppData\Roaming\WINSpool

2013-09-27 14:23 . 2013-09-27 14:23        --------        d-----w-        c:\windows\Sun

2013-09-26 12:39 . 2013-09-26 12:45        --------        d-----w-        c:\windows\system32\MRT

2013-09-26 12:38 . 2013-07-09 04:50        652800        ----a-w-        c:\windows\system32\rpcrt4.dll

2013-09-26 12:38 . 2013-07-09 04:52        175104        ----a-w-        c:\windows\system32\wintrust.dll

2013-09-26 12:38 . 2013-07-09 04:46        140288        ----a-w-        c:\windows\system32\cryptsvc.dll

2013-09-26 12:38 . 2013-07-09 04:46        1166848        ----a-w-        c:\windows\system32\crypt32.dll

2013-09-26 12:38 . 2013-07-09 04:46        103936        ----a-w-        c:\windows\system32\cryptnet.dll

2013-09-26 12:38 . 2013-07-06 05:05        1293760        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2013-09-26 12:36 . 2013-06-15 03:38        31232        ----a-w-        c:\windows\system32\drivers\tssecsrv.sys

2013-09-26 11:44 . 2013-09-26 11:44        --------        d-----w-        c:\users\FLO\AppData\Roaming\WINSX

2013-09-22 11:13 . 2013-09-22 11:13        --------        d-----w-        c:\users\FLO\AppData\Roaming\wiiunuws

2013-09-19 13:12 . 2013-09-19 13:12        --------        d-----w-        c:\programdata\ATI

2013-09-19 13:12 . 2013-09-19 13:12        --------        d-----w-        c:\program files\AMD AVT

2013-09-13 18:52 . 2013-09-13 18:52        --------        d-----w-        c:\users\FLO\AppData\Local\fabi.me

2013-09-08 18:31 . 2013-09-08 18:49        --------        d-----w-        c:\users\FLO\AppData\Roaming\Bioshock

2013-09-05 01:51 . 2013-09-05 01:51        38912        ----a-w-        c:\windows\system32\kdbsdk32.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-08-15 13:11 . 2013-08-15 13:11        142304        ----a-w-        c:\windows\system32\amdhcp32.dll

2013-08-15 13:11 . 2013-08-15 13:11        71704        ----a-w-        c:\windows\system32\atimpc32.dll

2013-08-15 13:11 . 2013-08-15 13:11        71704        ----a-w-        c:\windows\system32\amdpcom32.dll

2013-08-15 13:11 . 2012-12-19 19:31        126336        ----a-w-        c:\windows\system32\atiuxpag.dll

2013-08-15 13:11 . 2012-12-19 19:30        98496        ----a-w-        c:\windows\system32\atiu9pag.dll

2013-08-15 13:11 . 2012-12-19 20:09        1052264        ----a-w-        c:\windows\system32\aticfx32.dll

2013-08-15 13:11 . 2012-12-19 20:06        7919328        ----a-w-        c:\windows\system32\atidxx32.dll

2013-08-15 13:10 . 2012-12-19 19:44        6502024        ----a-w-        c:\windows\system32\atiumdva.dll

2013-08-15 13:10 . 2012-12-19 20:50        6549928        ----a-w-        c:\windows\system32\atiumdag.dll

2013-08-15 13:07 . 2013-08-15 13:07        11037696        ----a-w-        c:\windows\system32\drivers\atikmdag.sys

2013-08-15 12:55 . 2013-08-15 12:55        200704        ----a-w-        c:\windows\system32\clinfo.exe

2013-08-15 12:54 . 2013-08-15 12:54        83456        ----a-w-        c:\windows\system32\OpenVideo.dll

2013-08-15 12:54 . 2013-08-15 12:54        73216        ----a-w-        c:\windows\system32\OVDecode.dll

2013-08-15 12:51 . 2013-08-15 12:51        23989248        ----a-w-        c:\windows\system32\amdocl.dll

2013-08-15 12:49 . 2013-08-15 12:49        57344        ----a-w-        c:\windows\system32\OpenCL.dll

2013-08-15 12:45 . 2013-08-15 12:45        114688        ----a-w-        c:\windows\system32\coinst_13.20.11.dll

2013-08-15 12:33 . 2013-08-15 12:33        368640        ----a-w-        c:\windows\system32\atiapfxx.exe

2013-08-15 12:33 . 2013-08-15 12:33        52224        ----a-w-        c:\windows\system32\aticalrt.dll

2013-08-15 12:33 . 2013-08-15 12:33        49152        ----a-w-        c:\windows\system32\aticalcl.dll

2013-08-15 12:29 . 2013-08-15 12:29        14302208        ----a-w-        c:\windows\system32\aticaldd.dll

2013-08-15 12:15 . 2013-08-15 12:15        21624832        ----a-w-        c:\windows\system32\atioglxx.dll

2013-08-15 12:12 . 2013-08-15 12:12        442368        ----a-w-        c:\windows\system32\atidemgy.dll

2013-08-15 12:12 . 2013-08-15 12:12        25600        ----a-w-        c:\windows\system32\atimuixx.dll

2013-08-15 12:11 . 2013-08-15 12:11        483328        ----a-w-        c:\windows\system32\atieclxx.exe

2013-08-15 12:10 . 2013-08-15 12:10        209408        ----a-w-        c:\windows\system32\atiesrxx.exe

2013-08-15 12:09 . 2013-08-15 12:09        164352        ----a-w-        c:\windows\system32\atitmmxx.dll

2013-08-15 11:40 . 2013-08-15 11:40        828416        ----a-w-        c:\windows\system32\atiadlxx.dll

2013-08-15 11:40 . 2013-08-15 11:40        69632        ----a-w-        c:\windows\system32\atiglpxx.dll

2013-08-15 11:40 . 2013-08-15 11:40        96768        ----a-w-        c:\windows\system32\atigktxx.dll

2013-08-15 11:38 . 2013-08-15 11:38        495104        ----a-w-        c:\windows\system32\drivers\atikmpag.sys

2013-08-15 11:37 . 2013-08-15 11:37        90112        ----a-w-        c:\windows\system32\amdave32.dll

2013-08-15 11:37 . 2013-08-15 11:37        80896        ----a-w-        c:\windows\system32\atisamu32.dll

2013-08-15 11:36 . 2013-08-15 11:36        43520        ----a-w-        c:\windows\system32\drivers\ati2erec.dll

2013-08-09 18:45 . 2013-08-09 18:28        290184        ----a-w-        c:\windows\system32\PnkBstrB.xtr

2013-08-09 18:44 . 2013-08-08 10:15        280904        ----a-w-        c:\windows\system32\PnkBstrB.ex0

2013-08-08 10:15 . 2013-08-08 10:15        138056        ----a-w-        c:\users\FLO\AppData\Roaming\PnkBstrK.sys

2013-07-17 11:14 . 2013-07-17 11:14        94632        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll

2013-07-17 11:14 . 2013-07-17 11:14        867240        ----a-w-        c:\windows\system32\npDeployJava1.dll

2013-07-17 11:14 . 2013-07-17 11:14        789416        ----a-w-        c:\windows\system32\deployJava1.dll

2013-07-05 08:40 . 2013-07-05 08:40        78848        ----a-w-        c:\windows\system32\drivers\AtihdW73.sys

2013-07-05 08:40 . 2013-07-05 08:40        84480        ----a-w-        c:\windows\system32\DelayAPO.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="d:\program files\Steam\steam.exe" [2013-09-21 1814440]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-06-21 19875432]

"HKCUwvcs"="c:\users\FLO\AppData\Roaming\wiiunuws\windcis.exe" [2013-09-22 385024]

"HKCUwinfc"="\Windows\Explorer.exe" [2011-02-25 2616320]

"HydraVisionDesktopManager"="c:\program files\ATI Technologies\HydraVision\HydraDM.exe" [2013-03-28 389120]

"HKCUWINStvl"="c:\users\FLO\AppData\Roaming\WINSpool\WINSVch.exe" [2013-10-02 294912]

"svchost"="\Windows\Explorer.exe" [2011-02-25 2616320]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2012-06-11 10996368]

"NUSB3MON"="c:\program files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-07-01 345144]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe" [2013-09-05 747264]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-09-05 958576]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.285\SSScheduler.exe [2012-9-5 271808]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"HideSCAHealth"= 1 (0x1)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"TaskbarNoNotification"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe]

"Debugger"=ntibcp_.exe

.

R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-06-21 162408]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]

R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.285\McCHSvc.exe [2012-09-05 234776]

R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys [2013-04-03 29184]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]

R3 WinRing0_1_2_0;WinRing0_1_2_0;d:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-04-13 37352]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2013-08-15 209408]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2013-09-05 276992]

S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-07-01 84024]

S2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2013-06-19 29184]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2013-07-05 78848]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-11-19 62208]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-11-19 141568]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-09-29 490088]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-09-26 13:52        1177552        ----a-w-        c:\program files\Google\Chrome\Application\29.0.1547.76\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2013-06-15 08:23]

.

2013-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2013-06-15 08:23]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.com

uInternet Settings,ProxyOverride = <local>

TCP: DhcpNameServer = 192.168.13.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - c:\program files\Ask.com\GenericAskToolbar.dll

AddRemove-{5526d33c-7120-4326-9097-defcbdfa0dbc} - c:\program files\LyricsPal\Uninstall.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(3944)

c:\program files\ATI Technologies\HydraVision\HydraDMH.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\atieclxx.exe

c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\windows\system32\taskhost.exe

c:\program files\Google\Update\1.3.21.153\GoogleCrashHandler.exe

c:\windows\system32\conhost.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

c:\windows\system32\conhost.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\system32\sppsvc.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2013-10-02  16:58:58 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2013-10-02 14:58

.

Vor Suchlauf: 11 Verzeichnis(se), 27.691.302.912 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 27.579.015.168 Bytes frei

.

- - End Of File - - 491149B456505D6D20C1438A9452EF38

A36C5E4F47E84449FF07ED3517B43A31

Endlich geht wieder alles !;) danke !

Es läuft immer noch Malware!
Ich warte noch auf die anderen Logs und dann geht's weiter.

FRST

Code:

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Renesas Electronics Corporation) C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe

(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avscan.exe

() C:\Users\FLO\AppData\Roaming\miner\dependant.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-01] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-05] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)

HKLM\...\Policies\Explorer: [HideSCAHealth] 1

HKCU\...\Run: [Steam] - D:\Program Files\Steam\steam.exe [1814440 2013-09-21] (Valve Corporation)

HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)

HKCU\...\Run: [HKCUwvcs] - C:\Users\FLO\AppData\Roaming\wiiunuws\windcis.exe [385024 2013-09-22] (Mozilla)

HKCU\...\Run: [HKCUwinfc] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)

HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-03-28] (AMD)

HKCU\...\Run: [HKCUWINStvl] - C:\Users\FLO\AppData\Roaming\WINSpool\WINSVch.exe [294912 2013-10-02] (IKARUS Security)

HKCU\...\Run: [svchost] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)

HKCU\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [35256 2013-08-22] (Overwolf)

HKCU\...\Run: [miner] - "C:\Users\FLO\AppData\Roaming\miner\nircmd.exe" exec hide "C:\Users\FLO\AppData\Roaming\miner\start.bat"

HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA109AF1D4338CE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {FE4C0989-6A69-49E7-8229-4251F93E8597} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8960151d-44c5-4d16-812c-cf913cd117eb&apn_sauid=3E6BEBCA-93F6-40BD-9FE7-AC6F8FCD78A6

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.13.1
 

FireFox:

========

FF ProfilePath: C:\Users\FLO\AppData\Roaming\Mozilla\Firefox\Profiles\ypntwgra.default

FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF HKCU\...\Firefox\Extensions: [{8f5010e2-9577-4aed-ad42-f2098ea15def}] - C:\Program Files\LyricsPal\133.xpi

FF StartMenuInternet: FIREFOX.EXE - C:\Users\FLO\Documents\Firefox Browser\App\Firefox\firefox.exe
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Adblock Plus) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.5_0

CHR Extension: (Google Search) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (GTA5) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjohnmajpleabijkmpeildakhgdfpem\1_0

CHR Extension: (Chrome In-App Payments service) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0

CHR Extension: (Gmail) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR HKLM\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files\LyricsPal\125.crx
 

========================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-09-05] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-01] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-01] (Avira Operations GmbH & Co. KG)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)

S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [29184 2013-06-19] (Advanced Micro Devices)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-13] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-13] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-13] (Avira Operations GmbH & Co. KG)

R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)

S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)

R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [62208 2010-11-19] (Renesas Electronics Corporation)

R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141568 2010-11-19] (Renesas Electronics Corporation)

S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [204432 2012-06-05] (Realtek Semiconductor Corp.)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-13] (Avira GmbH)

S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [29184 2013-04-03] (Anchorfree Inc.)

S3 xnacc; C:\Windows\System32\DRIVERS\xnacc.sys [465408 2009-07-14] (Microsoft Corporation)

R3 catchme; \??\C:\Users\FLO\AppData\Local\Temp\catchme.sys [x]

S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]

S3 WinRing0_1_2_0; \??\D:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]

U3 mbr; \??\C:\ComboFix\mbr.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe

2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt

2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf

2013-10-02 17:04 - 2013-10-02 17:26 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf

2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2013-10-02 17:02 - 2013-10-02 17:04 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe

2013-10-02 16:27 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-10-02 16:27 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-10-02 16:27 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-10-02 16:16 - 2013-10-02 17:59 - 00000000 ____D C:\Qoobox

2013-10-02 16:15 - 2013-10-02 16:54 - 00000000 ____D C:\Windows\erdnt

2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe

2013-10-02 16:10 - 2013-10-02 17:23 - 00001064 _____ C:\Windows\setupact.log

2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log

2013-10-02 16:09 - 2013-10-02 16:50 - 00009136 _____ C:\Windows\PFRO.log

2013-10-02 15:58 - 2013-10-02 16:08 - 00000000 ____D C:\AdwCleaner

2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe

2013-10-02 15:50 - 2013-10-02 15:51 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt

2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST

2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe

2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe

2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-02 15:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-10-02 15:07 - 2013-10-02 15:09 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-02 14:24 - 2013-07-17 22:18 - 00001622 _____ C:\Users\Public\Desktop\LaunchIW4M - Verknüpfung.lnk

2013-10-02 14:24 - 2013-07-15 19:35 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Multiplayer.url

2013-10-02 14:24 - 2013-05-17 15:08 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Zombies.url

2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe

2013-10-02 12:59 - 2013-10-02 13:08 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar

2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip

2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer

2013-10-02 10:42 - 2013-10-02 10:43 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini

2013-10-02 10:41 - 2013-10-02 10:42 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe

2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe

2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5

2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe

2013-10-02 10:34 - 2013-10-02 10:38 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe

2013-10-02 09:47 - 2013-10-02 11:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool

2013-10-01 13:31 - 2013-10-01 13:36 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4

2013-09-29 20:17 - 2013-09-29 20:20 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav

2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun

2013-09-26 15:51 - 2013-09-26 15:52 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe

2013-09-26 14:49 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-09-26 14:49 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-09-26 14:49 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-09-26 14:49 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-09-26 14:49 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-09-26 14:49 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-09-26 14:39 - 2013-09-26 14:45 - 00000000 ____D C:\Windows\system32\MRT

2013-09-26 14:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-09-26 14:38 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-09-26 14:38 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-09-26 14:37 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-09-26 14:37 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2013-09-26 14:37 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2013-09-26 14:37 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2013-09-26 14:37 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2013-09-26 14:37 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2013-09-26 14:37 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

2013-09-26 14:37 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-09-26 14:37 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-09-26 14:37 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2013-09-26 14:37 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-09-26 14:37 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-09-26 14:36 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav

2013-09-24 20:33 - 2013-09-24 20:34 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv

2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws

2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT

2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me

2013-09-13 18:18 - 2013-09-13 18:17 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4

2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url

2013-09-08 20:31 - 2013-09-08 20:49 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock

2013-09-08 20:31 - 2013-09-08 20:42 - 00000000 ____D C:\Users\FLO\Documents\Bioshock

2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll
 

==================== One Month Modified Files and Folders =======
 

2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe

2013-10-02 18:35 - 2013-06-15 10:23 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-10-02 17:59 - 2013-10-02 16:16 - 00000000 ____D C:\Qoobox

2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt

2013-10-02 17:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache

2013-10-02 17:53 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini

2013-10-02 17:44 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing

2013-10-02 17:31 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-10-02 17:31 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-10-02 17:29 - 2013-04-18 14:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Skype

2013-10-02 17:27 - 2013-04-13 13:59 - 01226674 _____ C:\Windows\WindowsUpdate.log

2013-10-02 17:26 - 2013-10-02 17:04 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf

2013-10-02 17:24 - 2013-07-15 12:56 - 00065536 _____ C:\Windows\system32\Ikeext.etl

2013-10-02 17:24 - 2013-06-15 10:23 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-10-02 17:23 - 2013-10-02 16:10 - 00001064 _____ C:\Windows\setupact.log

2013-10-02 17:23 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-10-02 17:22 - 2013-04-18 16:27 - 00000000 ____D C:\Users\FLO\AppData\Roaming\TS3Client

2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf

2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2013-10-02 17:04 - 2013-10-02 17:02 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe

2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default

2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public

2013-10-02 16:54 - 2013-10-02 16:15 - 00000000 ____D C:\Windows\erdnt

2013-10-02 16:50 - 2013-10-02 16:09 - 00009136 _____ C:\Windows\PFRO.log

2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe

2013-10-02 16:11 - 2013-06-03 20:23 - 00000000 ____D C:\Users\FLO\AppData\Local\CrashDumps

2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log

2013-10-02 16:08 - 2013-10-02 15:58 - 00000000 ____D C:\AdwCleaner

2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe

2013-10-02 15:51 - 2013-10-02 15:50 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt

2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST

2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe

2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe

2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-02 15:09 - 2013-10-02 15:07 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-02 14:34 - 2013-06-20 19:18 - 00000000 ____D C:\Program Files\Paint.NET

2013-10-02 14:34 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-10-02 14:33 - 2013-08-08 12:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins

2013-10-02 14:33 - 2013-04-19 17:53 - 00000000 ____D C:\Windows\Minidump

2013-10-02 14:33 - 2013-04-13 14:55 - 00000000 ____D C:\Windows\Panther

2013-10-02 14:25 - 2011-04-12 03:39 - 00000000 ____D C:\Windows\ShellNew

2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe

2013-10-02 13:08 - 2013-10-02 12:59 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar

2013-10-02 12:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF

2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip

2013-10-02 11:07 - 2013-10-02 09:47 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:42 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini

2013-10-02 10:42 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe

2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe

2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5

2013-10-02 10:39 - 2013-04-14 18:15 - 00000000 ____D C:\ProgramData\Adobe

2013-10-02 10:38 - 2013-10-02 10:34 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe

2013-10-02 10:38 - 2013-04-14 18:26 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Adobe

2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe

2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool

2013-10-01 13:36 - 2013-10-01 13:31 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4

2013-10-01 11:48 - 2013-04-13 14:40 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Mozilla

2013-09-29 20:20 - 2013-09-29 20:17 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav

2013-09-28 20:21 - 2013-04-13 14:22 - 00000000 ____D C:\Program Files\ATI Technologies

2013-09-28 18:30 - 2010-11-20 23:01 - 01589442 _____ C:\Windows\system32\PerfStringBackup.INI

2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun

2013-09-26 19:54 - 2013-04-14 18:18 - 00000000 ____D C:\Program Files\Common Files\Steam

2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Users\FLO\AppData\Local\Google

2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Program Files\Google

2013-09-26 15:52 - 2013-09-26 15:51 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe

2013-09-26 15:20 - 2009-07-14 06:33 - 00268272 _____ C:\Windows\system32\FNTCACHE.DAT

2013-09-26 15:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE

2013-09-26 14:45 - 2013-09-26 14:39 - 00000000 ____D C:\Windows\system32\MRT

2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav

2013-09-24 20:34 - 2013-09-24 20:33 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv

2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws

2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT

2013-09-19 15:12 - 2013-04-13 14:29 - 00000000 ____D C:\ProgramData\AMD

2013-09-19 15:04 - 2013-04-13 14:27 - 00000000 ____D C:\AMD

2013-09-19 13:42 - 2013-07-15 10:32 - 00000000 ____D C:\Users\FLO\AppData\Roaming\miner

2013-09-16 15:22 - 2013-05-10 18:10 - 00000000 ____D C:\Users\FLO\AppData\Local\IW4M

2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me

2013-09-13 18:17 - 2013-09-13 18:18 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4

2013-09-12 06:27 - 2013-07-17 13:32 - 00000000 ____D C:\Windows\system32\Extensions

2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url

2013-09-11 17:48 - 2013-07-17 13:21 - 00000000 ____D C:\Users\FLO\AppData\Roaming\.minecraft

2013-09-08 20:49 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock

2013-09-08 20:42 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\Documents\Bioshock

2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll
 

Some content of TEMP:

====================

C:\Users\FLO\AppData\Local\temp\gvytjdpthvm.exe

C:\Users\FLO\AppData\Local\temp\nircmd.exe

C:\Users\FLO\AppData\Local\temp\wget.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-02 17:50
 

==================== End Of Log ============================

Da fehlt der obere Teil des Logs. Bitte vollständig posten.

Also nochmal mit dem oberen

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013

Ran by FLO (administrator) on FLO-PC on 03-10-2013 08:34:38

Running from C:\Users\FLO\Downloads

Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Renesas Electronics Corporation) C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Valve Corporation) D:\Program Files\Steam\Steam.exe

(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe

(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avscan.exe

(Microsoft Corporation) C:\Windows\system32\taskmgr.exe

() C:\Users\FLO\AppData\Roaming\miner\dependant.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-01] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-05] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)

HKLM\...\Policies\Explorer: [HideSCAHealth] 1

HKCU\...\Run: [Steam] - D:\Program Files\Steam\steam.exe [1814440 2013-09-21] (Valve Corporation)

HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)

HKCU\...\Run: [HKCUwvcs] - C:\Users\FLO\AppData\Roaming\wiiunuws\windcis.exe [385024 2013-09-22] (Mozilla)

HKCU\...\Run: [HKCUwinfc] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)

HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-03-28] (AMD)

HKCU\...\Run: [HKCUWINStvl] - C:\Users\FLO\AppData\Roaming\WINSpool\WINSVch.exe [294912 2013-10-02] (IKARUS Security)

HKCU\...\Run: [svchost] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)

HKCU\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [35256 2013-08-22] (Overwolf)

HKCU\...\Run: [miner] - "C:\Users\FLO\AppData\Roaming\miner\nircmd.exe" exec hide "C:\Users\FLO\AppData\Roaming\miner\start.bat"

HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1

IMEO\rstrui.exe: [Debugger] riaicca_.exe
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA109AF1D4338CE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {FE4C0989-6A69-49E7-8229-4251F93E8597} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8960151d-44c5-4d16-812c-cf913cd117eb&apn_sauid=3E6BEBCA-93F6-40BD-9FE7-AC6F8FCD78A6

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.13.1
 

FireFox:

========

FF ProfilePath: C:\Users\FLO\AppData\Roaming\Mozilla\Firefox\Profiles\ypntwgra.default

FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF HKCU\...\Firefox\Extensions: [{8f5010e2-9577-4aed-ad42-f2098ea15def}] - C:\Program Files\LyricsPal\133.xpi

FF StartMenuInternet: FIREFOX.EXE - C:\Users\FLO\Documents\Firefox Browser\App\Firefox\firefox.exe
 

Chrome: 

=======

CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946", "hxxp://www.google.com"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\pdf.dll ()

CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)

CHR Plugin: (ESN Sonar API) - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File

CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Nexon Game Controller) - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

CHR Plugin: (Unity Player) - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll No File

CHR Plugin: (Java Deployment Toolkit 7.0.250.16) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

CHR Extension: (Google Docs) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Adblock Plus) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.5_0

CHR Extension: (Google Search) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (GTA5) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjohnmajpleabijkmpeildakhgdfpem\1_0

CHR Extension: (Chrome In-App Payments service) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0

CHR Extension: (Gmail) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR HKLM\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files\LyricsPal\125.crx
 

========================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-09-05] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-01] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-01] (Avira Operations GmbH & Co. KG)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)

S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [29184 2013-06-19] (Advanced Micro Devices)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-13] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-13] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-13] (Avira Operations GmbH & Co. KG)

R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)

S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)

R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [62208 2010-11-19] (Renesas Electronics Corporation)

R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141568 2010-11-19] (Renesas Electronics Corporation)

S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [204432 2012-06-05] (Realtek Semiconductor Corp.)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-13] (Avira GmbH)

S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [29184 2013-04-03] (Anchorfree Inc.)

S3 xnacc; C:\Windows\System32\DRIVERS\xnacc.sys [465408 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\Users\FLO\AppData\Local\Temp\catchme.sys [x]

S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]

S3 WinRing0_1_2_0; \??\D:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe

2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt

2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf

2013-10-02 17:04 - 2013-10-03 08:15 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf

2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2013-10-02 17:02 - 2013-10-02 17:04 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe

2013-10-02 16:27 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-10-02 16:27 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-10-02 16:27 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-10-02 16:16 - 2013-10-02 17:59 - 00000000 ____D C:\Qoobox

2013-10-02 16:15 - 2013-10-02 16:54 - 00000000 ____D C:\Windows\erdnt

2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe

2013-10-02 16:10 - 2013-10-03 08:14 - 00001120 _____ C:\Windows\setupact.log

2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log

2013-10-02 16:09 - 2013-10-03 08:14 - 00010026 _____ C:\Windows\PFRO.log

2013-10-02 15:58 - 2013-10-02 16:08 - 00000000 ____D C:\AdwCleaner

2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe

2013-10-02 15:50 - 2013-10-02 15:51 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt

2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST

2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe

2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe

2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-02 15:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-10-02 15:07 - 2013-10-02 15:09 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-02 14:24 - 2013-07-17 22:18 - 00001622 _____ C:\Users\Public\Desktop\LaunchIW4M - Verknüpfung.lnk

2013-10-02 14:24 - 2013-07-15 19:35 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Multiplayer.url

2013-10-02 14:24 - 2013-05-17 15:08 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Zombies.url

2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe

2013-10-02 12:59 - 2013-10-02 13:08 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar

2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip

2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer

2013-10-02 10:42 - 2013-10-02 10:43 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini

2013-10-02 10:41 - 2013-10-02 10:42 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe

2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe

2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5

2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe

2013-10-02 10:34 - 2013-10-02 10:38 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe

2013-10-02 09:47 - 2013-10-02 11:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool

2013-10-01 13:31 - 2013-10-01 13:36 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4

2013-09-29 20:17 - 2013-09-29 20:20 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav

2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun

2013-09-26 15:51 - 2013-09-26 15:52 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe

2013-09-26 14:49 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-09-26 14:49 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-09-26 14:49 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-09-26 14:49 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-09-26 14:49 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-09-26 14:49 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-09-26 14:39 - 2013-09-26 14:45 - 00000000 ____D C:\Windows\system32\MRT

2013-09-26 14:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-09-26 14:38 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-09-26 14:38 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-09-26 14:37 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-09-26 14:37 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2013-09-26 14:37 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2013-09-26 14:37 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2013-09-26 14:37 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2013-09-26 14:37 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2013-09-26 14:37 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

2013-09-26 14:37 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-09-26 14:37 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-09-26 14:37 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2013-09-26 14:37 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-09-26 14:37 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-09-26 14:36 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav

2013-09-24 20:33 - 2013-09-24 20:34 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv

2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws

2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT

2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me

2013-09-13 18:18 - 2013-09-13 18:17 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4

2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url

2013-09-08 20:31 - 2013-09-08 20:49 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock

2013-09-08 20:31 - 2013-09-08 20:42 - 00000000 ____D C:\Users\FLO\Documents\Bioshock

2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll
 

==================== One Month Modified Files and Folders =======
 

2013-10-03 08:35 - 2013-06-15 10:23 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-10-03 08:21 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-10-03 08:21 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-10-03 08:15 - 2013-10-02 17:04 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf

2013-10-03 08:15 - 2013-06-03 20:23 - 00000000 ____D C:\Users\FLO\AppData\Local\CrashDumps

2013-10-03 08:15 - 2013-04-18 14:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Skype

2013-10-03 08:14 - 2013-10-02 16:10 - 00001120 _____ C:\Windows\setupact.log

2013-10-03 08:14 - 2013-10-02 16:09 - 00010026 _____ C:\Windows\PFRO.log

2013-10-03 08:14 - 2013-07-15 12:56 - 00065536 _____ C:\Windows\system32\Ikeext.etl

2013-10-03 08:14 - 2013-06-15 10:23 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-10-03 08:14 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-10-02 19:28 - 2013-04-13 13:59 - 01232160 _____ C:\Windows\WindowsUpdate.log

2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe

2013-10-02 17:59 - 2013-10-02 16:16 - 00000000 ____D C:\Qoobox

2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt

2013-10-02 17:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache

2013-10-02 17:53 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini

2013-10-02 17:44 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing

2013-10-02 17:22 - 2013-04-18 16:27 - 00000000 ____D C:\Users\FLO\AppData\Roaming\TS3Client

2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf

2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2013-10-02 17:04 - 2013-10-02 17:02 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe

2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default

2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public

2013-10-02 16:54 - 2013-10-02 16:15 - 00000000 ____D C:\Windows\erdnt

2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe

2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log

2013-10-02 16:08 - 2013-10-02 15:58 - 00000000 ____D C:\AdwCleaner

2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe

2013-10-02 15:51 - 2013-10-02 15:50 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt

2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST

2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe

2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe

2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-02 15:09 - 2013-10-02 15:07 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-02 14:34 - 2013-06-20 19:18 - 00000000 ____D C:\Program Files\Paint.NET

2013-10-02 14:34 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-10-02 14:33 - 2013-08-08 12:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins

2013-10-02 14:33 - 2013-04-19 17:53 - 00000000 ____D C:\Windows\Minidump

2013-10-02 14:33 - 2013-04-13 14:55 - 00000000 ____D C:\Windows\Panther

2013-10-02 14:25 - 2011-04-12 03:39 - 00000000 ____D C:\Windows\ShellNew

2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe

2013-10-02 13:08 - 2013-10-02 12:59 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar

2013-10-02 12:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF

2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip

2013-10-02 11:07 - 2013-10-02 09:47 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:42 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini

2013-10-02 10:42 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe

2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe

2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5

2013-10-02 10:39 - 2013-04-14 18:15 - 00000000 ____D C:\ProgramData\Adobe

2013-10-02 10:38 - 2013-10-02 10:34 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe

2013-10-02 10:38 - 2013-04-14 18:26 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Adobe

2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe

2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool

2013-10-01 13:36 - 2013-10-01 13:31 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4

2013-10-01 11:48 - 2013-04-13 14:40 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Mozilla

2013-09-29 20:20 - 2013-09-29 20:17 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav

2013-09-28 20:21 - 2013-04-13 14:22 - 00000000 ____D C:\Program Files\ATI Technologies

2013-09-28 18:30 - 2010-11-20 23:01 - 01589442 _____ C:\Windows\system32\PerfStringBackup.INI

2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun

2013-09-26 19:54 - 2013-04-14 18:18 - 00000000 ____D C:\Program Files\Common Files\Steam

2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Users\FLO\AppData\Local\Google

2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Program Files\Google

2013-09-26 15:52 - 2013-09-26 15:51 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe

2013-09-26 15:20 - 2009-07-14 06:33 - 00268272 _____ C:\Windows\system32\FNTCACHE.DAT

2013-09-26 15:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE

2013-09-26 14:45 - 2013-09-26 14:39 - 00000000 ____D C:\Windows\system32\MRT

2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav

2013-09-24 20:34 - 2013-09-24 20:33 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv

2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws

2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT

2013-09-19 15:12 - 2013-04-13 14:29 - 00000000 ____D C:\ProgramData\AMD

2013-09-19 15:04 - 2013-04-13 14:27 - 00000000 ____D C:\AMD

2013-09-19 13:42 - 2013-07-15 10:32 - 00000000 ____D C:\Users\FLO\AppData\Roaming\miner

2013-09-16 15:22 - 2013-05-10 18:10 - 00000000 ____D C:\Users\FLO\AppData\Local\IW4M

2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me

2013-09-13 18:17 - 2013-09-13 18:18 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4

2013-09-12 06:27 - 2013-07-17 13:32 - 00000000 ____D C:\Windows\system32\Extensions

2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url

2013-09-11 17:48 - 2013-07-17 13:21 - 00000000 ____D C:\Users\FLO\AppData\Roaming\.minecraft

2013-09-08 20:49 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock

2013-09-08 20:42 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\Documents\Bioshock

2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll
 

Some content of TEMP:

====================

C:\Users\FLO\AppData\Local\temp\dtdasndkufj.exe

C:\Users\FLO\AppData\Local\temp\gvytjdpthvm.exe

C:\Users\FLO\AppData\Local\temp\iuznffnsdug.exe

C:\Users\FLO\AppData\Local\temp\nircmd.exe

C:\Users\FLO\AppData\Local\temp\vxddtxwqyfo.exe

C:\Users\FLO\AppData\Local\temp\wget.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-02 17:50
 

==================== End Of Log ============================

--- --- ---

Ok, da läuft immer noch einiges.. Dann so weiter:

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKCU\...\Run: [HKCUwvcs] - C:\Users\FLO\AppData\Roaming\wiiunuws\windcis.exe [385024 2013-09-22] (Mozilla)

HKCU\...\Run: [HKCUwinfc] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)

C:\Users\FLO\AppData\Roaming\wiiunuws

HKCU\...\Run: [HKCUWINStvl] - C:\Users\FLO\AppData\Roaming\WINSpool\WINSVch.exe [294912 2013-10-02] (IKARUS Security)

HKCU\...\Run: [svchost] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)

C:\Users\FLO\AppData\Roaming\WINSpool

HKCU\...\Run: [miner] - "C:\Users\FLO\AppData\Roaming\miner\nircmd.exe" exec hide "C:\Users\FLO\AppData\Roaming\miner\start.bat"

HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1

IMEO\rstrui.exe: [Debugger] riaicca_.exe

C:\Users\FLO\AppData\Roaming\miner

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {FE4C0989-6A69-49E7-8229-4251F93E8597} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8960151d-44c5-4d16-812c-cf913cd117eb&apn_sauid=3E6BEBCA-93F6-40BD-9FE7-AC6F8FCD78A6

C:\Users\FLO\AppData\Local\temp\*.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

Öffne das Programm Malwarebytes Anti-Malware.
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Klicke auf Aktualisierung --> Suche nach Aktualisierung.
Wenn das Update beendet wurde, aktiviere im Reiter Suchlauf die Option Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan fertig ist, klicke auf Ergebnisse anzeigen.
Versichere dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter dem Reiter Logdateien finden.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

Fixlog von FRST
Log von MBAM
Log von ESET
Log von FRST

Nachdem malwerebyte ding da musdte ich den pc neu starten nun hab ich jetzt einen black screen und es passiert nix!!

Wann genau kommt der Blackscreen? Vor oder nach dem Windows Signet? Vor oder nach der Benutzeranmeldung?
Kannst du dich noch in den abgesicherten Modus einloggen?

PC starten mit einem Blackscreen und einem weißen Cursor

Hallo Community

Als ich heute morgen einen Malware check gemacht habe 5 Funde hatte und er mich aufforderte den PC zu restarten tat ich es.. Als er dann wieder hoch fuhr bekam ich einen blackscreen mit einem weißen cursor... Bitte um schnelle hilfe !

Mfg Flo

Kein Grund ein neues Thema zu eröffnen, ich hab die beiden Themen zusammengeführt.
Beantworte mal die obigen Fragen.

Musste bei dem fund von malware ding da nach dem entfernen den pc neu starteb ich fahre ihn hoch und habe nach dem windows symbol einen blackscreen nur mit dem cursos

In den abgesicherten komm ich

In den abgesicherten modus komm ich noch

Nach dem abgesicherten modus komm ich noch rein

Zitat:

In den abgesicherten modus komm ich noch

Ok, dann hol dort bitte das MBAM-Log raus und poste es hier, um zu sehen, was gelöscht wurde. Das findest du so: http://www.trojaner-board.de/125889-...en-posten.html

Danach mach im abgesicherten Modus einen neuen FRST-Scan:

Starte noch einmal FRST.

Setze bei Optional Scan den Haken bei Addition.txt und drücke Scan.
Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und Addition.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieser beiden Logfiles bitte hier in deinen Thread.

In den abgesicherten modus komm ich rein

Sag mir bitte wie ich dass mache kenns mich da nicht so aus

Gehe in den "abgesicherten Modus mit Netzwerktreibern", starte dort MBAM und finde das Log wie auf nachfolgendem Bild angezeigt. Dann poste den Inhalt des Logs hier in den Thread.

http://img.trojaner-board.de/alle-lo...-alle-logs.png

Wenn ich im abgesicherten modus bin habe ich aber auch einen blackscreen

Task manager komm ich noch rein

Wenn ich im abgesicherten bin.habe ich aber nur ein blackscreen

Du hast doch geschrieben:

Zitat:

In den abgesicherten komm ich

In den abgesicherten modus komm ich noch

Nach dem abgesicherten modus komm ich noch rein

:confused:

Dann anders:

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Ich geh auf abgesicherten dann lädt er auch oben rechts unten links und oben steht überall abgesicherter modus aber ein blackscreen

Der Scan

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013

Ran by SYSTEM on MININT-2CIK4HC on 04-10-2013 20:34:14

Running from G:\

Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Recovery
 

The current controlset is ControlSet002
 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-01] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-05] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)

HKLM\...\Run: [svchost] - "C:\ProgramData\win0\bpvttlpxh.exe"

HKLM\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)

HKLM\...\Runonce: [Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript

HKLM\...\Winlogon: [Shell] Explorer.exe [x ] ()

HKLM\...\Policies\Explorer: [HideSCAHealth] 1

HKU\FLO\...\Run: [Steam] - "D:\Program Files\Steam\steam.exe" -silent

HKU\FLO\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-06-21] (Skype Technologies S.A.)

HKU\FLO\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [ 2013-03-28] (AMD)

HKU\FLO\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [ 2013-08-22] (Overwolf)

HKU\FLO\...\Run: [svchost] - C:\Users\FLO\AppData\Roaming\WINSX\winfvc.exe [ 2013-09-26] (IKARUS Security)
 

========================== Services (Whitelisted) =================
 

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-09-05] (Advanced Micro Devices, Inc.)

S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-01] (Avira Operations GmbH & Co. KG)

S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-01] (Avira Operations GmbH & Co. KG)

S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)

S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
 

==================== Drivers (Whitelisted) ====================
 

S2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [29184 2013-06-19] (Advanced Micro Devices)

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-13] (Avira Operations GmbH & Co. KG)

S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-13] (Avira Operations GmbH & Co. KG)

S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-13] (Avira Operations GmbH & Co. KG)

S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)

S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

S3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [62208 2010-11-19] (Renesas Electronics Corporation)

S3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141568 2010-11-19] (Renesas Electronics Corporation)

S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [204432 2012-06-05] (Realtek Semiconductor Corp.)

S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-13] (Avira GmbH)

S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [29184 2013-04-03] (Anchorfree Inc.)

S3 xnacc; C:\Windows\System32\DRIVERS\xnacc.sys [465408 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\Users\FLO\AppData\Local\Temp\catchme.sys [x]

S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]

S3 WinRing0_1_2_0; \??\D:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-10-04 07:35 - 2013-10-04 07:35 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-10-04 07:35 - 2013-10-04 07:35 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Malwarebytes

2013-10-04 07:34 - 2013-10-04 07:34 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (2).exe

2013-10-04 07:33 - 2013-10-04 07:33 - 02347384 _____ (ESET) C:\Users\FLO\Downloads\esetsmartinstaller_enu.exe

2013-10-04 07:33 - 2013-10-04 07:33 - 00000000 ____D C:\Program Files\ESET

2013-10-04 07:27 - 2013-10-04 07:27 - 01087213 _____ (Farbar) C:\Users\FLO\Desktop\FRST (1).exe

2013-10-03 15:32 - 2013-10-03 15:32 - 11935034 _____ C:\Users\FLO\Downloads\AC-MUV3.5.rar

2013-10-03 15:13 - 2013-10-03 15:13 - 00030208 _____ C:\Users\FLO\Desktop\MW3 MP FPS Unlocker.exe

2013-10-03 09:37 - 2013-10-03 09:37 - 00002010 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2013-10-03 08:17 - 2013-10-03 08:17 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader (1).exe

2013-10-03 08:10 - 2013-10-03 08:10 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader.exe

2013-10-03 07:35 - 2013-10-03 07:35 - 00038025 _____ C:\Users\FLO\Downloads\FRST.txt

2013-10-02 18:25 - 2013-10-02 18:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe

2013-10-02 16:58 - 2013-10-02 16:58 - 00024820 _____ C:\ComboFix.txt

2013-10-02 16:11 - 2013-10-02 16:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk

2013-10-02 16:11 - 2013-10-02 16:11 - 00000000 ____D C:\Program Files\Overwolf

2013-10-02 16:11 - 2013-10-02 16:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf

2013-10-02 16:04 - 2013-10-04 07:31 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf

2013-10-02 16:04 - 2013-10-02 16:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2013-10-02 16:02 - 2013-10-02 16:04 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe

2013-10-02 15:27 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2013-10-02 15:27 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2013-10-02 15:27 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-10-02 15:27 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-10-02 15:27 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-10-02 15:27 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2013-10-02 15:27 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2013-10-02 15:27 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2013-10-02 15:16 - 2013-10-02 16:59 - 00000000 ____D C:\Qoobox

2013-10-02 15:15 - 2013-10-02 15:54 - 00000000 ____D C:\Windows\erdnt

2013-10-02 15:13 - 2013-10-02 15:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe

2013-10-02 15:10 - 2013-10-04 17:49 - 00003080 _____ C:\Windows\setupact.log

2013-10-02 15:10 - 2013-10-02 15:10 - 00000000 _____ C:\Windows\setuperr.log

2013-10-02 15:09 - 2013-10-04 07:51 - 00010908 _____ C:\Windows\PFRO.log

2013-10-02 14:58 - 2013-10-02 15:08 - 00000000 ____D C:\AdwCleaner

2013-10-02 14:58 - 2013-10-02 14:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe

2013-10-02 14:50 - 2013-10-02 14:51 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt

2013-10-02 14:49 - 2013-10-04 07:30 - 00000000 ____D C:\FRST

2013-10-02 14:47 - 2013-10-02 14:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe

2013-10-02 14:29 - 2013-10-02 14:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-10-02 14:19 - 2013-10-02 14:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe

2013-10-02 14:17 - 2013-10-02 14:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-02 14:09 - 2013-10-04 07:35 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-02 14:09 - 2013-10-02 14:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-02 14:09 - 2013-04-04 13:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2013-10-02 14:07 - 2013-10-02 14:09 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-02 13:24 - 2013-07-17 21:18 - 00001622 _____ C:\Users\Public\Desktop\LaunchIW4M - Verknüpfung.lnk

2013-10-02 13:24 - 2013-05-17 14:08 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Zombies.url

2013-10-02 13:17 - 2013-10-02 13:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe

2013-10-02 11:59 - 2013-10-02 12:08 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 11:57 - 2013-10-02 11:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar

2013-10-02 10:24 - 2013-10-02 10:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip

2013-10-02 09:47 - 2013-10-02 09:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip

2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer

2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer

2013-10-02 09:42 - 2013-10-02 09:43 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini

2013-10-02 09:41 - 2013-10-02 09:42 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe

2013-10-02 09:41 - 2013-10-02 09:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe

2013-10-02 09:41 - 2013-10-02 09:41 - 00000000 ____D C:\Game5

2013-10-02 09:37 - 2013-10-02 09:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-10-02 09:36 - 2013-10-03 09:37 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\ProgramData\McAfee

2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\Program Files\Adobe

2013-10-02 09:34 - 2013-10-02 09:38 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe

2013-10-01 12:31 - 2013-10-01 12:36 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4

2013-09-29 19:17 - 2013-09-29 19:20 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav

2013-09-27 15:23 - 2013-09-27 15:23 - 00000000 ____D C:\Windows\Sun

2013-09-26 14:51 - 2013-09-26 14:52 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe

2013-09-26 13:49 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-09-26 13:49 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-09-26 13:49 - 2013-08-10 04:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-09-26 13:49 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-09-26 13:49 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-09-26 13:49 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-09-26 13:49 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-09-26 13:49 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-09-26 13:49 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-09-26 13:49 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-09-26 13:49 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-09-26 13:49 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-09-26 13:49 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-09-26 13:49 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-09-26 13:49 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-09-26 13:49 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-09-26 13:39 - 2013-09-26 13:45 - 00000000 ____D C:\Windows\System32\MRT

2013-09-26 13:38 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll

2013-09-26 13:38 - 2013-07-09 05:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll

2013-09-26 13:38 - 2013-07-09 05:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll

2013-09-26 13:38 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll

2013-09-26 13:38 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll

2013-09-26 13:38 - 2013-07-06 06:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

2013-09-26 13:37 - 2013-08-08 02:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-09-26 13:37 - 2013-08-02 02:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll

2013-09-26 13:37 - 2013-08-02 02:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll

2013-09-26 13:37 - 2013-08-02 02:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 01:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe

2013-09-26 13:37 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

2013-09-26 13:37 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

2013-09-26 13:37 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll

2013-09-26 13:37 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll

2013-09-26 13:37 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL

2013-09-26 13:37 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll

2013-09-26 13:37 - 2013-07-09 06:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe

2013-09-26 13:37 - 2013-07-09 06:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

2013-09-26 13:37 - 2013-07-09 05:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll

2013-09-26 13:36 - 2013-06-15 04:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys

2013-09-26 12:44 - 2013-09-26 12:44 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSX

2013-09-24 19:34 - 2013-09-24 19:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav

2013-09-24 19:33 - 2013-09-24 19:34 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv

2013-09-19 14:12 - 2013-09-19 14:12 - 00059023 _____ C:\Windows\System32\CCCInstall_201309191512339893.log

2013-09-19 14:12 - 2013-09-19 14:12 - 00000000 ____D C:\ProgramData\ATI

2013-09-19 14:12 - 2013-09-19 14:12 - 00000000 ____D C:\Program Files\AMD AVT

2013-09-13 19:52 - 2013-09-13 19:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me

2013-09-13 17:18 - 2013-09-13 17:17 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4

2013-09-08 19:31 - 2013-09-08 19:49 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock

2013-09-08 19:31 - 2013-09-08 19:42 - 00000000 ____D C:\Users\FLO\Documents\Bioshock

2013-09-05 02:51 - 2013-09-05 02:51 - 00038912 _____ C:\Windows\System32\kdbsdk32.dll
 

==================== One Month Modified Files and Folders =======
 

2013-10-04 19:26 - 2013-04-13 13:04 - 00000000 ____D C:\users\FLO

2013-10-04 17:56 - 2009-07-14 05:34 - 00021088 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-10-04 17:56 - 2009-07-14 05:34 - 00021088 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-10-04 17:52 - 2013-04-13 12:59 - 01316127 _____ C:\Windows\WindowsUpdate.log

2013-10-04 17:49 - 2013-10-02 15:10 - 00003080 _____ C:\Windows\setupact.log

2013-10-04 17:49 - 2013-07-15 11:56 - 00065536 _____ C:\Windows\System32\Ikeext.etl

2013-10-04 17:09 - 2009-07-14 05:34 - 00012288 _____ C:\Windows\System32\umstartup.etl

2013-10-04 16:54 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\tracing

2013-10-04 10:32 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\LogFiles

2013-10-04 07:51 - 2013-10-02 15:09 - 00010908 _____ C:\Windows\PFRO.log

2013-10-04 07:51 - 2013-07-15 09:29 - 00000000 __SHD C:\ProgramData\win0

2013-10-04 07:51 - 2013-04-13 13:55 - 00000000 ____D C:\Windows\Panther

2013-10-04 07:45 - 2010-11-20 22:01 - 01616098 _____ C:\Windows\System32\PerfStringBackup.INI

2013-10-04 07:35 - 2013-10-04 07:35 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-10-04 07:35 - 2013-10-04 07:35 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Malwarebytes

2013-10-04 07:35 - 2013-10-02 14:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-04 07:34 - 2013-10-04 07:34 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (2).exe

2013-10-04 07:33 - 2013-10-04 07:33 - 02347384 _____ (ESET) C:\Users\FLO\Downloads\esetsmartinstaller_enu.exe

2013-10-04 07:33 - 2013-10-04 07:33 - 00000000 ____D C:\Program Files\ESET

2013-10-04 07:31 - 2013-10-02 16:04 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf

2013-10-04 07:31 - 2013-04-18 13:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Skype

2013-10-04 07:30 - 2013-10-02 14:49 - 00000000 ____D C:\FRST

2013-10-04 07:27 - 2013-10-04 07:27 - 01087213 _____ (Farbar) C:\Users\FLO\Desktop\FRST (1).exe

2013-10-04 07:19 - 2013-06-03 19:23 - 00000000 ____D C:\Users\FLO\AppData\Local\CrashDumps

2013-10-03 16:38 - 2013-04-18 15:27 - 00000000 ____D C:\Users\FLO\AppData\Roaming\TS3Client

2013-10-03 15:32 - 2013-10-03 15:32 - 11935034 _____ C:\Users\FLO\Downloads\AC-MUV3.5.rar

2013-10-03 15:13 - 2013-10-03 15:13 - 00030208 _____ C:\Users\FLO\Desktop\MW3 MP FPS Unlocker.exe

2013-10-03 09:37 - 2013-10-03 09:37 - 00002010 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2013-10-03 09:37 - 2013-10-02 09:36 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-10-03 08:17 - 2013-10-03 08:17 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader (1).exe

2013-10-03 08:10 - 2013-10-03 08:10 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader.exe

2013-10-03 07:35 - 2013-10-03 07:35 - 00038025 _____ C:\Users\FLO\Downloads\FRST.txt

2013-10-02 18:25 - 2013-10-02 18:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe

2013-10-02 16:59 - 2013-10-02 15:16 - 00000000 ____D C:\Qoobox

2013-10-02 16:58 - 2013-10-02 16:58 - 00024820 _____ C:\ComboFix.txt

2013-10-02 16:57 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache

2013-10-02 16:53 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini

2013-10-02 16:11 - 2013-10-02 16:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk

2013-10-02 16:11 - 2013-10-02 16:11 - 00000000 ____D C:\Program Files\Overwolf

2013-10-02 16:11 - 2013-10-02 16:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf

2013-10-02 16:04 - 2013-10-02 16:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2013-10-02 16:04 - 2013-10-02 16:02 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe

2013-10-02 15:59 - 2009-07-14 03:37 - 00000000 __RHD C:\users\Default

2013-10-02 15:59 - 2009-07-14 03:37 - 00000000 ___RD C:\users\Public

2013-10-02 15:54 - 2013-10-02 15:15 - 00000000 ____D C:\Windows\erdnt

2013-10-02 15:13 - 2013-10-02 15:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe

2013-10-02 15:10 - 2013-10-02 15:10 - 00000000 _____ C:\Windows\setuperr.log

2013-10-02 15:08 - 2013-10-02 14:58 - 00000000 ____D C:\AdwCleaner

2013-10-02 14:58 - 2013-10-02 14:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe

2013-10-02 14:51 - 2013-10-02 14:50 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt

2013-10-02 14:47 - 2013-10-02 14:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe

2013-10-02 14:29 - 2013-10-02 14:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-10-02 14:19 - 2013-10-02 14:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe

2013-10-02 14:17 - 2013-10-02 14:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-02 14:09 - 2013-10-02 14:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-02 14:09 - 2013-10-02 14:07 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-02 13:34 - 2013-06-20 18:18 - 00000000 ____D C:\Program Files\Paint.NET

2013-10-02 13:34 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-10-02 13:33 - 2013-08-08 11:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins

2013-10-02 13:33 - 2013-04-19 16:53 - 00000000 ____D C:\Windows\Minidump

2013-10-02 13:25 - 2011-04-12 02:39 - 00000000 ____D C:\Windows\ShellNew

2013-10-02 13:17 - 2013-10-02 13:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe

2013-10-02 12:08 - 2013-10-02 11:59 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 11:57 - 2013-10-02 11:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar

2013-10-02 11:56 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF

2013-10-02 10:24 - 2013-10-02 10:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip

2013-10-02 09:47 - 2013-10-02 09:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip

2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer

2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer

2013-10-02 09:43 - 2013-10-02 09:42 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini

2013-10-02 09:42 - 2013-10-02 09:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe

2013-10-02 09:41 - 2013-10-02 09:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe

2013-10-02 09:41 - 2013-10-02 09:41 - 00000000 ____D C:\Game5

2013-10-02 09:39 - 2013-04-14 17:15 - 00000000 ____D C:\ProgramData\Adobe

2013-10-02 09:38 - 2013-10-02 09:34 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe

2013-10-02 09:38 - 2013-04-14 17:26 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Adobe

2013-10-02 09:37 - 2013-10-02 09:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\ProgramData\McAfee

2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\Program Files\Adobe

2013-10-01 12:36 - 2013-10-01 12:31 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4

2013-10-01 10:48 - 2013-04-13 13:40 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Mozilla

2013-09-29 19:20 - 2013-09-29 19:17 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav

2013-09-28 19:21 - 2013-04-13 13:22 - 00000000 ____D C:\Program Files\ATI Technologies

2013-09-27 15:23 - 2013-09-27 15:23 - 00000000 ____D C:\Windows\Sun

2013-09-26 18:54 - 2013-04-14 17:18 - 00000000 ____D C:\Program Files\Common Files\Steam

2013-09-26 14:53 - 2013-06-15 09:23 - 00000000 ____D C:\Users\FLO\AppData\Local\Google

2013-09-26 14:53 - 2013-06-15 09:23 - 00000000 ____D C:\Program Files\Google

2013-09-26 14:52 - 2013-09-26 14:51 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe

2013-09-26 14:20 - 2009-07-14 05:33 - 00268272 _____ C:\Windows\System32\FNTCACHE.DAT

2013-09-26 14:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE

2013-09-26 13:45 - 2013-09-26 13:39 - 00000000 ____D C:\Windows\System32\MRT

2013-09-26 12:44 - 2013-09-26 12:44 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSX

2013-09-24 19:34 - 2013-09-24 19:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav

2013-09-24 19:34 - 2013-09-24 19:33 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv

2013-09-19 14:12 - 2013-09-19 14:12 - 00059023 _____ C:\Windows\System32\CCCInstall_201309191512339893.log

2013-09-19 14:12 - 2013-09-19 14:12 - 00000000 ____D C:\ProgramData\ATI

2013-09-19 14:12 - 2013-09-19 14:12 - 00000000 ____D C:\Program Files\AMD AVT

2013-09-19 14:12 - 2013-04-13 13:29 - 00000000 ____D C:\ProgramData\AMD

2013-09-19 14:04 - 2013-04-13 13:27 - 00000000 ____D C:\AMD

2013-09-16 14:22 - 2013-05-10 17:10 - 00000000 ____D C:\Users\FLO\AppData\Local\IW4M

2013-09-13 19:52 - 2013-09-13 19:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me

2013-09-13 17:17 - 2013-09-13 17:18 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4

2013-09-12 05:27 - 2013-07-17 12:32 - 00000000 ____D C:\Windows\System32\Extensions

2013-09-11 16:48 - 2013-07-17 12:21 - 00000000 ____D C:\Users\FLO\AppData\Roaming\.minecraft

2013-09-08 19:49 - 2013-09-08 19:31 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock

2013-09-08 19:42 - 2013-09-08 19:31 - 00000000 ____D C:\Users\FLO\Documents\Bioshock

2013-09-05 02:51 - 2013-09-05 02:51 - 00038912 _____ C:\Windows\System32\kdbsdk32.dll
 

==================== Known DLLs (Whitelisted) ============
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe IS MISSING <==== ATTENTION!.

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 

1

Restore point made on: 2013-10-04 18:19:44
 

==================== Memory info =========================== 
 

Percentage of memory in use: 12%

Total physical RAM: 4094.49 MB

Available physical RAM: 3576.97 MB

Total Pagefile: 4092.78 MB

Available Pagefile: 3571.37 MB

Total Virtual: 2047.88 MB

Available Virtual: 1944.69 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:48.73 GB) (Free:24.81 GB) NTFS

Drive e: (FLO) (Fixed) (Total:184.06 GB) (Free:49.69 GB) NTFS

Drive g: () (Removable) (Total:14.83 GB) (Free:10.26 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: F3246542)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=49 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=184 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)

Partition 1: (Active) - (Size=15 GB) - (Type=0C)
 
 

LastRegBack: 2013-10-02 16:50
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Tatsächlich, da ist die explorer.exe flöten gegangen.. Ohne die bleibts natürlich dunkel..
Wir müssen einen Ersatz finden:

Starte FRST wieder wie zuvor in den Reperaturoptionen.
Gib dann folgendes in die Search: Box von FRST ein:

Code:

explorer.exe

und drücke auf Search File(s).
FRST erstellt nach Ablauf des Scans eine Logdatei Search.txt auf dem USB-Stick.
Poste deren Inhalt bitte hier.

Werde es gleich nach dem aufstehen machen! Wie kann denn die explorer exe flöten gehen? Habe ichvetwas falsch gemacht ?

Code:

Farbar Recovery Scan Tool (x86) Version: 03-10-2013

Ran by SYSTEM at 2013-10-05 08:11:11

Running from G:\

Boot Mode: Recovery
 

================== Search: "explorer.exe" ===================
 

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe

[2013-04-13 14:09] - [2011-02-26 06:19] - 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746
 

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe

[2013-04-13 14:09] - [2011-02-25 06:30] - 2616320 ____N (Microsoft Corporation) 8B88EBBB05A0E56B7DCC708498C02B3E
 

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe

[2010-11-20 22:29] - [2010-11-20 22:29] - 2616320 ____A (Microsoft Corporation) 40D777B7A95E00593EB1568C68514493
 

C:\Windows\erdnt\cache\explorer.exe

[2013-10-02 15:54] - [2011-02-25 06:30] - 2616320 ____A (Microsoft Corporation) 8B88EBBB05A0E56B7DCC708498C02B3E
 

=== End Of Search ===

Zitat:

Wie kann denn die explorer exe flöten gehen? Habe ichvetwas falsch gemacht ?

Ich kann dir im Moment noch nicht sagen, wie und wo das passiert ist..

Mach bitte folgenden Fix. Kannst du den Rechner danach wieder normal starten? Falls ja, dann suche und poste ebenfalls das MBAM-Log wie oben angegeben. (Und ebenfalls das alte FRST-Fixlog, welches du vor dem MBAM-Scan erstellt hast.)

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

Replace: C:\Windows\erdnt\cache\explorer.exe C:\Windows\explorer.exe

HKLM\...\Run: [svchost] - "C:\ProgramData\win0\bpvttlpxh.exe"

C:\ProgramData\win0

HKU\FLO\...\Run: [svchost] - C:\Users\FLO\AppData\Roaming\WINSX\winfvc.exe [ 2013-09-26] (IKARUS Security)

C:\Users\FLO\AppData\Roaming\WINSX

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-10-2013

Ran by SYSTEM at 2013-10-05 13:43:01 Run:2

Running from G:\

Boot Mode: Recovery
 

==============================================
 

Content of fixlist:

*****************

Replace: C:\Windows\erdnt\cache\explorer.exe C:\Windows\explorer.exe

HKLM\...\Run: [svchost] - "C:\ProgramData\win0\bpvttlpxh.exe"

C:\ProgramData\win0

HKU\FLO\...\Run: [svchost] - C:\Users\FLO\AppData\Roaming\WINSX\winfvc.exe [ 2013-09-26] (IKARUS Security)

C:\Users\FLO\AppData\Roaming\WINSX

*****************
 

Could not find C:\Windows\explorer.exe

C:\Windows\erdnt\cache\explorer.exe copied successfully to C:\Windows\explorer.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\svchost => Value deleted successfully.

C:\ProgramData\win0 => Moved successfully.

HKU\FLO\Software\Microsoft\Windows\CurrentVersion\Run\\svchost => Value deleted successfully.

C:\Users\FLO\AppData\Roaming\WINSX => Moved successfully.
 

==== End of Fixlog ====

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013

Ran by FLO (administrator) on FLO-PC on 05-10-2013 13:51:37

Running from C:\Users\FLO\Downloads

Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Renesas Electronics Corporation) C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe

(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Valve Corporation) D:\Program Files\Steam\Steam.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-01] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-05] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)

HKLM\...\Policies\Explorer: [HideSCAHealth] 1

HKCU\...\Run: [Steam] - D:\Program Files\Steam\steam.exe [1814440 2013-09-21] (Valve Corporation)

HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)

HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-03-28] (AMD)

HKCU\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [35256 2013-08-22] (Overwolf)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA109AF1D4338CE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.13.1
 

FireFox:

========

FF ProfilePath: C:\Users\FLO\AppData\Roaming\Mozilla\Firefox\Profiles\ypntwgra.default

FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF HKCU\...\Firefox\Extensions: [{8f5010e2-9577-4aed-ad42-f2098ea15def}] - C:\Program Files\LyricsPal\133.xpi

FF StartMenuInternet: FIREFOX.EXE - C:\Users\FLO\Documents\Firefox Browser\App\Firefox\firefox.exe
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Adblock Plus) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.5_0

CHR Extension: (Google Search) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (GTA5) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjohnmajpleabijkmpeildakhgdfpem\1_0

CHR Extension: (Chrome In-App Payments service) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0

CHR Extension: (Gmail) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

CHR HKLM\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files\LyricsPal\125.crx
 

========================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-09-05] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-01] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-01] (Avira Operations GmbH & Co. KG)

S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)

S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [29184 2013-06-19] (Advanced Micro Devices)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-13] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-13] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-13] (Avira Operations GmbH & Co. KG)

R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)

S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [62208 2010-11-19] (Renesas Electronics Corporation)

R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141568 2010-11-19] (Renesas Electronics Corporation)

S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [204432 2012-06-05] (Realtek Semiconductor Corp.)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-13] (Avira GmbH)

S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [29184 2013-04-03] (Anchorfree Inc.)

S3 xnacc; C:\Windows\System32\DRIVERS\xnacc.sys [465408 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\Users\FLO\AppData\Local\Temp\catchme.sys [x]

S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]

S3 WinRing0_1_2_0; \??\D:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-10-05 14:43 - 2011-02-25 07:30 - 02616320 ____N (Microsoft Corporation) C:\Windows\explorer.exe

2013-10-04 08:35 - 2013-10-04 08:35 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Malwarebytes

2013-10-04 08:34 - 2013-10-04 08:34 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (2).exe

2013-10-04 08:33 - 2013-10-04 08:33 - 02347384 _____ (ESET) C:\Users\FLO\Downloads\esetsmartinstaller_enu.exe

2013-10-04 08:33 - 2013-10-04 08:33 - 00000000 ____D C:\Program Files\ESET

2013-10-03 16:13 - 2013-10-03 16:13 - 00030208 _____ C:\Users\FLO\Desktop\MW3 MP FPS Unlocker.exe

2013-10-03 10:37 - 2013-10-03 10:37 - 00002010 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2013-10-03 09:17 - 2013-10-03 09:17 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader (1).exe

2013-10-03 09:10 - 2013-10-03 09:10 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader.exe

2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe

2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt

2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf

2013-10-02 17:04 - 2013-10-05 13:45 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf

2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2013-10-02 17:02 - 2013-10-02 17:04 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe

2013-10-02 16:27 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-10-02 16:27 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-10-02 16:27 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-10-02 16:27 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-10-02 16:16 - 2013-10-02 17:59 - 00000000 ____D C:\Qoobox

2013-10-02 16:15 - 2013-10-02 16:54 - 00000000 ____D C:\Windows\erdnt

2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe

2013-10-02 16:10 - 2013-10-05 13:44 - 00003248 _____ C:\Windows\setupact.log

2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log

2013-10-02 16:09 - 2013-10-04 08:51 - 00010908 _____ C:\Windows\PFRO.log

2013-10-02 15:58 - 2013-10-02 16:08 - 00000000 ____D C:\AdwCleaner

2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe

2013-10-02 15:50 - 2013-10-02 15:51 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt

2013-10-02 15:49 - 2013-10-04 08:30 - 00000000 ____D C:\FRST

2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe

2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe

2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-02 15:09 - 2013-10-04 08:35 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-02 15:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-10-02 15:07 - 2013-10-02 15:09 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-02 14:24 - 2013-07-17 22:18 - 00001622 _____ C:\Users\Public\Desktop\LaunchIW4M - Verknüpfung.lnk

2013-10-02 14:24 - 2013-05-17 15:08 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Zombies.url

2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe

2013-10-02 12:59 - 2013-10-02 13:08 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar

2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer

2013-10-02 10:42 - 2013-10-02 10:43 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini

2013-10-02 10:41 - 2013-10-02 10:42 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe

2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe

2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5

2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-10-02 10:36 - 2013-10-03 10:37 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe

2013-10-02 10:34 - 2013-10-02 10:38 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe

2013-10-02 09:47 - 2013-10-02 11:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2013-10-01 13:31 - 2013-10-01 13:36 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4

2013-09-29 20:17 - 2013-09-29 20:20 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav

2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun

2013-09-26 15:51 - 2013-09-26 15:52 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe

2013-09-26 14:49 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-09-26 14:49 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-09-26 14:49 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-09-26 14:49 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-09-26 14:49 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-09-26 14:49 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-09-26 14:49 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-09-26 14:39 - 2013-09-26 14:45 - 00000000 ____D C:\Windows\system32\MRT

2013-09-26 14:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2013-09-26 14:38 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-09-26 14:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-09-26 14:38 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-09-26 14:37 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-09-26 14:37 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2013-09-26 14:37 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2013-09-26 14:37 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2013-09-26 14:37 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2013-09-26 14:37 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2013-09-26 14:37 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2013-09-26 14:37 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

2013-09-26 14:37 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-09-26 14:37 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-09-26 14:37 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2013-09-26 14:37 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-09-26 14:37 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-09-26 14:36 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav

2013-09-24 20:33 - 2013-09-24 20:34 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv

2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT

2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me

2013-09-13 18:18 - 2013-09-13 18:17 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4

2013-09-08 20:31 - 2013-09-08 20:49 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock

2013-09-08 20:31 - 2013-09-08 20:42 - 00000000 ____D C:\Users\FLO\Documents\Bioshock

2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll
 

==================== One Month Modified Files and Folders =======
 

2013-10-05 13:51 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-10-05 13:51 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-10-05 13:45 - 2013-10-02 17:04 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf

2013-10-05 13:45 - 2013-04-18 14:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Skype

2013-10-05 13:44 - 2013-10-02 16:10 - 00003248 _____ C:\Windows\setupact.log

2013-10-05 13:44 - 2013-07-15 12:56 - 00065536 _____ C:\Windows\system32\Ikeext.etl

2013-10-05 13:44 - 2013-06-15 10:23 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-10-05 13:44 - 2013-04-13 14:04 - 00000000 ____D C:\Users\FLO

2013-10-05 13:44 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-10-05 13:44 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing

2013-10-04 19:35 - 2013-06-15 10:23 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-10-04 18:52 - 2013-04-13 13:59 - 01321102 _____ C:\Windows\WindowsUpdate.log

2013-10-04 18:09 - 2009-07-14 06:34 - 00012288 _____ C:\Windows\system32\umstartup.etl

2013-10-04 11:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\LogFiles

2013-10-04 08:51 - 2013-10-02 16:09 - 00010908 _____ C:\Windows\PFRO.log

2013-10-04 08:51 - 2013-04-13 14:55 - 00000000 ____D C:\Windows\Panther

2013-10-04 08:45 - 2010-11-20 23:01 - 01616098 _____ C:\Windows\system32\PerfStringBackup.INI

2013-10-04 08:35 - 2013-10-04 08:35 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Malwarebytes

2013-10-04 08:35 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-10-04 08:34 - 2013-10-04 08:34 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (2).exe

2013-10-04 08:33 - 2013-10-04 08:33 - 02347384 _____ (ESET) C:\Users\FLO\Downloads\esetsmartinstaller_enu.exe

2013-10-04 08:33 - 2013-10-04 08:33 - 00000000 ____D C:\Program Files\ESET

2013-10-04 08:30 - 2013-10-02 15:49 - 00000000 ____D C:\FRST

2013-10-04 08:19 - 2013-06-03 20:23 - 00000000 ____D C:\Users\FLO\AppData\Local\CrashDumps

2013-10-03 17:38 - 2013-04-18 16:27 - 00000000 ____D C:\Users\FLO\AppData\Roaming\TS3Client

2013-10-03 16:13 - 2013-10-03 16:13 - 00030208 _____ C:\Users\FLO\Desktop\MW3 MP FPS Unlocker.exe

2013-10-03 10:37 - 2013-10-03 10:37 - 00002010 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2013-10-03 10:37 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan

2013-10-03 09:17 - 2013-10-03 09:17 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader (1).exe

2013-10-03 09:13 - 2009-07-14 06:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-10-03 09:10 - 2013-10-03 09:10 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader.exe

2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe

2013-10-02 17:59 - 2013-10-02 16:16 - 00000000 ____D C:\Qoobox

2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt

2013-10-02 17:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache

2013-10-02 17:53 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini

2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf

2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf

2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2013-10-02 17:04 - 2013-10-02 17:02 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe

2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default

2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public

2013-10-02 16:54 - 2013-10-02 16:15 - 00000000 ____D C:\Windows\erdnt

2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe

2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log

2013-10-02 16:08 - 2013-10-02 15:58 - 00000000 ____D C:\AdwCleaner

2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe

2013-10-02 15:51 - 2013-10-02 15:50 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt

2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe

2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe

2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe

2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-10-02 15:09 - 2013-10-02 15:07 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe

2013-10-02 14:34 - 2013-06-20 19:18 - 00000000 ____D C:\Program Files\Paint.NET

2013-10-02 14:34 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-10-02 14:33 - 2013-08-08 12:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins

2013-10-02 14:33 - 2013-04-19 17:53 - 00000000 ____D C:\Windows\Minidump

2013-10-02 14:25 - 2011-04-12 03:39 - 00000000 ____D C:\Windows\ShellNew

2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe

2013-10-02 13:08 - 2013-10-02 12:59 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock

2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar

2013-10-02 12:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF

2013-10-02 11:07 - 2013-10-02 09:47 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive

2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer

2013-10-02 10:43 - 2013-10-02 10:42 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini

2013-10-02 10:42 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe

2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe

2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5

2013-10-02 10:39 - 2013-04-14 18:15 - 00000000 ____D C:\ProgramData\Adobe

2013-10-02 10:38 - 2013-10-02 10:34 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe

2013-10-02 10:38 - 2013-04-14 18:26 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Adobe

2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe

2013-10-01 13:36 - 2013-10-01 13:31 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4

2013-10-01 11:48 - 2013-04-13 14:40 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Mozilla

2013-09-29 20:20 - 2013-09-29 20:17 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav

2013-09-28 20:21 - 2013-04-13 14:22 - 00000000 ____D C:\Program Files\ATI Technologies

2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun

2013-09-26 19:54 - 2013-04-14 18:18 - 00000000 ____D C:\Program Files\Common Files\Steam

2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Users\FLO\AppData\Local\Google

2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Program Files\Google

2013-09-26 15:52 - 2013-09-26 15:51 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe

2013-09-26 15:20 - 2009-07-14 06:33 - 00268272 _____ C:\Windows\system32\FNTCACHE.DAT

2013-09-26 15:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE

2013-09-26 14:45 - 2013-09-26 14:39 - 00000000 ____D C:\Windows\system32\MRT

2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav

2013-09-24 20:34 - 2013-09-24 20:33 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv

2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI

2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT

2013-09-19 15:12 - 2013-04-13 14:29 - 00000000 ____D C:\ProgramData\AMD

2013-09-19 15:04 - 2013-04-13 14:27 - 00000000 ____D C:\AMD

2013-09-16 15:22 - 2013-05-10 18:10 - 00000000 ____D C:\Users\FLO\AppData\Local\IW4M

2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me

2013-09-13 18:17 - 2013-09-13 18:18 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4

2013-09-12 06:27 - 2013-07-17 13:32 - 00000000 ____D C:\Windows\system32\Extensions

2013-09-11 17:48 - 2013-07-17 13:21 - 00000000 ____D C:\Users\FLO\AppData\Roaming\.minecraft

2013-09-08 20:49 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock

2013-09-08 20:42 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\Documents\Bioshock

2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-02 17:50
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Kannst du jetzt bitte noch das Log von MBAM suchen und hier posten wie folgt.
Danach hier weiter machen mit Schritt 3.

http://img.trojaner-board.de/alle-lo...-alle-logs.png

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.10.04.03
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 10.0.9200.16686

FLO :: FLO-PC [Administrator]
 

Schutz: Aktiviert
 

04.10.2013 08:43:24

mbam-log-2013-10-04 (08-43-24).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 193596

Laufzeit: 6 Minute(n), 8 Sekunde(n)
 

Infizierte Speicherprozesse: 1

C:\ProgramData\win0\bpvttlpxh.exe (Backdoor.Bot) -> 3624 -> Löschen bei Neustart.
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 1

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 2

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|svchost (Backdoor.Bot) -> Daten: \Windows\Explorer.exe -> Löschen bei Neustart.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|svchost (Backdoor.Bot) -> Daten: "C:\ProgramData\win0\bpvttlpxh.exe" -> Löschen bei Neustart.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 2

\Windows\explorer.exe (Backdoor.Bot) -> Löschen bei Neustart.

C:\ProgramData\win0\bpvttlpxh.exe (Backdoor.Bot) -> Löschen bei Neustart.
 

(Ende)

Tatsächlich, MBAM hat die explorer.exe gelöscht...
Jetzt weiter mit ESET und FRST:

Schritt 1

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 2

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Hi,

ich hab schon länger keine Antwort mehr von dir erhalten. Brauchst du weiterhin noch Hilfe?

Wenn ich in den nächsten 24 Stunden nichts von dir höre, gehe ich davon aus, dass sich das Thema erledigt hat und lösche es aus meinen Abos.

Hinweis: Wir sind noch nicht fertig! Auch wenn die Symptome verschwunden sein sollten, kann dein System weiterhin infiziert sein und über Sicherheitslücken verfügen, welche eine erneute Infektion möglich machen.

Fehlende Rückmeldung
Dieses Thema wurde aus meinen Abos gelöscht. Somit bekomme ich keine Benachrichtigung mehr über neue Antworten.
Schreib mir eine PM, falls du das Thema doch wieder fortsetzen möchtest. Dann machen wir hier weiter.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass dein Rechner schon sauber ist.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.