| Bahnfahrer | 17.11.2013 15:52 |
Hallo Leo,
vielen Dank für deine rasche Antwort. Ich habe die Schritte ausgeführt, anbei die Logfiles: Code:
ComboFix 13-11-16.01 - ****** 17.11.2013 15:39:48.1.4 - x64
Microsoft Windows 7 Enterprise 6.1.7601.1.1252.49.1031.18.8132.6342 [GMT 1:00]
ausgeführt von:: c:\users\******\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\******\AppData\Local\Microsoft\Windows\Temporary Internet Files\eportoZip
c:\users\******\AppData\Local\Microsoft\Windows\Temporary Internet Files\pplCsv.txt
c:\users\******\AppData\Local\Microsoft\Windows\Temporary Internet Files\tempCsv.txt
c:\users\******\Desktop\Setup.exe
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ofjgnhihlklpobkaloamkankaaoclfjh_0
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ofjgnhihlklpobkaloamkankaaoclfjh_0\1
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\background.html
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\crossriderManifest.json
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\manifest.xml
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins.json
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\1_base.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\101_cortica_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\102_dealply_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\103_intext_5_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\104_jollywallet_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\105_corticas_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\108_icm_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\116_ads_only_5_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\117_coupons_intext_ads_5_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\119_similar_web_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\120_luck_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\123_intext_adv_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\124_superfish_no_search_no_coupons_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\125_arcadi2_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\126_revizer_ws_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\127_revizer_p_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\128_superfish_pricora_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\129_widdit_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\135_arcadi3_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\138_getdeal_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\14_CrossriderUtils.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\141_corticas_ru_m.js.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\142_intext_fa_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\155_ibario_pops_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\158_50onred_ads_only_no_fb_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\159_cortica_rollover_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\17_jQuery.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\170_icm1_5_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\171_arcadi2_sourceID_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\174_arcadi_serp_dynamic_id_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\175_coolmirage_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\178_revizer_ws_dynamic_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\179_revizer_p_dynamic_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\19_CHAppAPIWrapper.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\21_debug.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\22_resources.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\28_initializer.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\4_jquery_1_7_1.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\47_resources_background.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\64_appApiMessage.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\7_hooks.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\72_appApiValidation.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\78_CrossriderInfo.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\80_CHPopupAppAPI.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\87_ginyas_wrapper.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\9_search_engine_hook.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\91_monetizationLoader.js.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\92_superfish_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\plugins\97_resourceApiWrapper.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\userCode\background.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\extensionData\userCode\extension.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\icons\actions\1.png
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\icons\icon128.png
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\icons\icon16.png
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\icons\icon48.png
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\api\chrome.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\api\cookie.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\api\message.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\api\pageAction.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\api\pageActionBG.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\background.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\app_api.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\bg_app_api.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\consts.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\cookie_store.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\crossriderAPI.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\delegate.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\events.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\extensionDataStore.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\installer.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\logFile.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\logging.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\onBGDocumentLoad.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\popupResource\newPopup.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\popupResource\popup.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\reports.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\storageWrapper.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\updateManager.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\util.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\lib\xhr.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\js\main.js
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\manifest.json
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.25.50_0\popup.html
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ofjgnhihlklpobkaloamkankaaoclfjh
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ofjgnhihlklpobkaloamkankaaoclfjh\000003.log
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ofjgnhihlklpobkaloamkankaaoclfjh\CURRENT
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ofjgnhihlklpobkaloamkankaaoclfjh\LOCK
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ofjgnhihlklpobkaloamkankaaoclfjh\LOG
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ofjgnhihlklpobkaloamkankaaoclfjh\MANIFEST-000002
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ofjgnhihlklpobkaloamkankaaoclfjh_0.localstorage-journal
c:\users\Julian\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ofjgnhihlklpobkaloamkankaaoclfjh_0.localstorage
c:\users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A2A87F9E-1742-4AE7-9263-51F7CBCC1AE3}.xps
c:\users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\pplCsv.txt
c:\users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\tempCsv.txt
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\msvcr71.dll
c:\windows\ST6UNST.000
c:\windows\SysWow64\FlashPlayerApp.exe
c:\windows\SysWow64\frapsvid.dll
.
Infizierte Kopie von c:\windows\system32\Services.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe wurde wiederhergestellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-10-17 bis 2013-11-17 ))))))))))))))))))))))))))))))
.
.
2013-11-17 14:42 . 2013-11-17 14:42 -------- d-----w- c:\users\*****\AppData\Local\temp
2013-11-17 14:42 . 2013-11-17 14:42 -------- d-----w- c:\users\Julian\AppData\Local\temp
2013-11-17 14:42 . 2013-11-17 14:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-17 14:36 . 2013-11-17 14:36 -------- d-----w- c:\users\******\AppData\Local\ElevatedDiagnostics
2013-11-17 14:35 . 2013-11-17 14:43 94656 ----a-w- c:\windows\system32\WPRO_41_2001woem.tmp
2013-11-14 17:33 . 2013-11-14 17:33 -------- d-----w- c:\users\*****\AppData\Local\LogMeIn
2013-11-13 19:08 . 2013-11-13 19:08 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2013-11-11 21:39 . 2013-11-11 21:39 -------- d-----w- c:\users\Julian\AppData\Roaming\Doublefine
2013-11-09 14:35 . 2013-11-09 14:35 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-09 14:35 . 2013-11-09 14:35 -------- d-----w- c:\program files\iTunes
2013-11-09 14:35 . 2013-11-09 14:35 -------- d-----w- c:\program files\iPod
2013-10-31 16:40 . 2013-10-31 16:40 -------- d-----w- c:\users\******\AppData\Roaming\Lexware
2013-10-31 16:40 . 2013-10-31 16:40 -------- d-----w- c:\users\******\AppData\Local\Lexware
2013-10-25 20:36 . 2013-10-25 20:36 -------- d-sh--w- c:\programdata\DSS
2013-10-25 20:35 . 2013-10-25 20:35 -------- d-----w- c:\program files\Electronic Arts
2013-10-25 19:41 . 2010-09-16 17:03 2601752 ----a-w- c:\windows\SysWow64\pbsvc_moh.exe
2013-10-25 17:47 . 2013-10-25 17:47 -------- d-----w- c:\program files (x86)\Drakensang Online
2013-10-24 22:18 . 2013-10-24 22:18 -------- d-----w- c:\users\Julian\AppData\Local\Freetec
2013-10-24 22:17 . 2013-10-24 22:20 -------- d-----w- c:\program files (x86)\Web Check
2013-10-21 11:51 . 2013-10-21 11:51 -------- d-----w- c:\users\Julian\AppData\Roaming\Lexware
2013-10-21 11:51 . 2013-10-21 11:51 -------- d-----w- c:\users\Julian\AppData\Local\Lexware
2013-10-21 01:02 . 2013-10-21 01:05 -------- d-----w- c:\users\*****\AppData\Roaming\Lexware
2013-10-21 01:01 . 2013-10-22 12:24 -------- d-----w- c:\programdata\Lexware
2013-10-21 01:01 . 2013-10-21 01:01 -------- d-----w- c:\program files (x86)\Lexware
2013-10-21 01:00 . 2013-03-06 12:02 1929216 ----a-w- c:\windows\SysWow64\cdintf250.dll
2013-10-21 00:59 . 2013-10-21 01:05 -------- d-----w- c:\users\*****\AppData\Local\Lexware
2013-10-21 00:59 . 2013-10-21 01:01 -------- d-----w- c:\program files (x86)\Common Files\Lexware
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-17 14:43 . 2013-01-20 01:16 34752 ----a-w- c:\windows\system32\drivers\WPRO_41_2001.sys
2013-10-25 20:00 . 2013-01-22 15:14 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-10-25 19:41 . 2013-01-22 15:14 75064 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-10-09 19:16 . 2013-01-20 02:16 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-10-08 05:50 . 2013-10-06 20:55 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-09-27 11:25 . 2013-09-27 11:25 799744 ----a-w- c:\windows\SysWow64\rzdevicedll.dll
2013-09-19 02:09 . 2013-09-19 02:09 57344 ----a-w- c:\windows\SysWow64\rzdevinfo.dll
2013-09-19 02:09 . 2013-09-19 02:09 154112 ----a-w- c:\windows\SysWow64\rztouchdll.dll
2013-09-19 02:09 . 2013-09-19 02:09 117248 ----a-w- c:\windows\SysWow64\rzdisplaydll.dll
2013-09-19 02:09 . 2013-09-19 02:09 296448 ----a-w- c:\windows\SysWow64\rzaudiodll.dll
2013-09-13 05:49 . 2013-09-13 05:49 142008 ----a-w- c:\windows\system32\drivers\rzudd.sys
2013-09-02 12:43 . 2013-05-06 11:46 81112 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-09-02 12:43 . 2013-04-01 12:14 132088 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-02 12:43 . 2013-04-01 12:14 105344 ----a-w- c:\windows\system32\drivers\avgntflt.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2013-05-20 19:00 1725128 ----a-w- c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2013-05-20 19:00 1725128 ----a-w- c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2013-05-20 19:00 1725128 ----a-w- c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-09-02 347192]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2013-04-25 1075296]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-12-12 163000]
"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2013-09-28 442200]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-01 152392]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2013-11-11 2349392]
.
c:\users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2013-2-13 0]
.
c:\users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-11-1 29769432]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
2;2 EDPSrv;EDP Server;c:\program files\EDP\server\EDPServer.exe;c:\program files\EDP\server\EDPServer.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 AbilisT;EyeTV DTT Deluxe (2009) Service;c:\windows\system32\DRIVERS\AbilisBdaTuner.sys;c:\windows\SYSNATIVE\DRIVERS\AbilisBdaTuner.sys [x]
R3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x64.sys;c:\windows\TEMP\cpuz136\cpuz136_x64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_1\bin\fbserver.exe;c:\program files\Firebird\Firebird_2_1\bin\fbserver.exe [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys;c:\windows\SYSNATIVE\DRIVERS\ivusb.sys [x]
R3 MSICDSetup;MSICDSetup;d:\cdriver64.sys;d:\CDriver64.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 NTIOLib_1_0_C;NTIOLib_1_0_C;d:\ntiolib_x64.sys;d:\NTIOLib_X64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 PlantronicsGC;PLTGC Interface;c:\windows\system32\drivers\PLTGC.sys;c:\windows\SYSNATIVE\drivers\PLTGC.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);c:\windows\system32\drivers\WPRO_41_2001.sys;c:\windows\SYSNATIVE\drivers\WPRO_41_2001.sys [x]
S0 AppleHFS;AppleHFS; [x]
S0 AppleMNT;AppleMNT; [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_1\bin\fbguard.exe;c:\program files\Firebird\Firebird_2_1\bin\fbguard.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 ISCTAgent;ISCT Always Updated Agent;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [x]
S2 MSSQL$JTLWAWI;SQL Server (JTLWAWI);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe;c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [x]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 ikbevent;Intel Upper keyboard Class Filter Driver;c:\windows\system32\DRIVERS\ikbevent.sys;c:\windows\SYSNATIVE\DRIVERS\ikbevent.sys [x]
S3 imsevent;Intel Upper Mouse Class Filter Driver;c:\windows\system32\DRIVERS\imsevent.sys;c:\windows\SYSNATIVE\DRIVERS\imsevent.sys [x]
S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\DRIVERS\ISCTD64.sys;c:\windows\SYSNATIVE\DRIVERS\ISCTD64.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGPBTDD;LGPBTDD.sys Display Driver;c:\windows\system32\Drivers\LGPBTDD.sys;c:\windows\SYSNATIVE\Drivers\LGPBTDD.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-11-15 14:24 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-20 19:16]
.
2013-11-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-10 01:04]
.
2013-11-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-10 01:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2013-05-20 18:55 2328776 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2013-05-20 18:55 2328776 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2013-05-20 18:55 2328776 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2012-11-29 7406392]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
DPF: {4FF78044-96B4-4312-A5B7-FDA3CB328095} -
FF - ProfilePath - c:\users\******\AppData\Roaming\Mozilla\Firefox\Profiles\lf2hkcfy.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
c:\users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\******\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup
c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\******\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-Harvey - b:\spiele\Harveys Neue Augen\uninstall.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_moh.exe
AddRemove-RGVhZCBJc2xhbmQgUmlwdGlkZSAoYykgRGVlcCBTaWx2ZXI=_is1 - b:\spiele\Dead Island Riptide\unins000.exe
AddRemove-Rocksmith_is1 - b:\spiele\Ubisoft\Rocksmith\unins000.exe
AddRemove-Steam App 13540 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 35140 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 40390 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 500 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 730 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 8190 - c:\program files (x86)\Steam\steam.exe
AddRemove-{01D57CF6-B5BC-4D03-AFF5-7960CFBD05A9} - c:\programdata\{A4FF347C-7353-4B5D-B479-1933EFF12E9A}\Guitar Rig 5 Setup PC.exe
AddRemove-{0886900B-B2F3-452C-B580-60F1253F7F80} - c:\programdata\{B9F6456A-E0C8-4BD3-A6E8-AFA8859EC4C4}\Controller Editor Setup PC.exe
AddRemove-{0B8565BA-BAD5-4732-B122-5FD78EFC50A9} - c:\programdata\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14}\Service Center Setup PC.exe
AddRemove-{2930FB47-6452-4476-BF16-D77F748646DB} - c:\programdata\{B0CAD5CC-867E-473E-B55F-339F9635A45D}\Guitar Rig Mobile IO Setup PC.exe
AddRemove-{7930FB47-6452-4476-BF16-D77F748646DB} - c:\programdata\{CB28D9D3-6B5D-4AFA-BA37-B4AFAAAF71B9}\Guitar Rig Session IO Setup PC.exe
AddRemove-{7F12FECB-1D75-42D7-9074-D6FEA6D91E65}_is1 - c:\program files (x86)\JC2-MP\unins000.exe
AddRemove-{B962AD08-335F-46f7-A182-257D37672E5C} - c:\programdata\{5A23829C-A66E-47B0-AD50-21A3FFE6C325}\Rig Kontrol 3 Setup PC.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:bb,37,a6,30,48,5b,95,bd,cc,b3,ac,ea,ce,28,a2,0c,ec,f9,96,20,cb,
36,3d,29,a8,13,8c,f3,6a,a1,ba,6f,34,10,fd,88,92,59,3d,ea,06,b9,5c,e5,26,1d,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\windows\SysWOW64\PnkBstrB.exe
c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-11-17 15:45:09 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-11-17 14:45
.
Vor Suchlauf: 12 Verzeichnis(se), 18.020.331.520 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 21.391.368.192 Bytes frei
.
- - End Of File - - B9F06493C4A1A96ED9F0054D74C7C179
A36C5E4F47E84449FF07ED3517B43A31
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2013
Ran by ****** (administrator) on ***** on 17-11-2013 15:48:13
Running from C:\Users\******\Desktop
Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hendrik Eifert) C:\Program Files\EDP\server\EDPServer.exe
(Firebird Project) C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Dropbox, Inc.) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Firebird Project) C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [7406392 2012-11-29] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [Razer Synapse] - C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [442200 2013-09-28] (Razer Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2349392 2013-11-11] (LogMeIn Inc.)
HKU\Julian\...\Run: [Spotify Web Helper] - C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-11-13] (Spotify Ltd)
HKU\Julian\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20551328 2013-10-21] (Skype Technologies S.A.)
HKU\Julian\...\Run: [Exetender_148] - "C:\Program Files (x86)\FreeRide Games\GPlayer.exe" /schedule 300000
HKU\Julian\...\Run: [Spotify] - C:\Users\*****\AppData\Roaming\Spotify\spotify.exe [5955072 2013-11-13] (Spotify Ltd)
HKU\*****\...\Run: [AdobeBridge] - [x]
HKU\*****\...\Run: [Spotify] - C:\Users\*****\AppData\Roaming\Spotify\spotify.exe [5955072 2013-11-13] (Spotify Ltd)
HKU\*****\...\Run: [Spotify Web Helper] - C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-11-13] (Spotify Ltd)
Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x0CDCCAFAE7FBCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [326144] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\lf2hkcfy.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nielsen/FirefoxTracker - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter2\FirefoxAddOns\npfirefoxtracker.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF SearchPlugin: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\lf2hkcfy.default\searchplugins\youtube-videosuche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: exif_viewer - C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\lf2hkcfy.default\Extensions\exif_viewer@mozilla.doslash.org.xpi
FF Extension: firefox-hotfix - C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\lf2hkcfy.default\Extensions\firefox-hotfix@mozilla.org.xpi
FF HKLM-x32\...\Firefox\Extensions: [netsight@nielsen.com] - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter2\FirefoxAddOns\netsight@nielsen.xpi
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 EDPSrv; C:\Program Files\EDP\server\EDPServer.exe [1964032 2012-11-30] (Hendrik Eifert)
R2 FirebirdGuardianDefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe [114688 2011-02-01] (Firebird Project)
R3 FirebirdServerDefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe [4000768 2011-02-01] (Firebird Project)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [146984 2012-07-24] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377104 2013-10-11] (LogMeIn, Inc.)
R2 MSSQL$JTLWAWI; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29178224 2007-02-10] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75064 2013-10-25] ()
R2 PnkBstrB; C:\Windows\SysWow64\PnkBstrB.exe [189248 2013-10-25] ()
==================== Drivers (Whitelisted) ====================
S3 AbilisT; C:\Windows\System32\DRIVERS\AbilisBdaTuner.sys [131144 2010-04-12] (ABILIS Systems)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-07-28] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-01] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-06-30] (DT Soft Ltd)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [20968 2012-07-24] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [19944 2012-07-24] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46016 2012-07-24] ()
R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-02-01] ()
S3 PlantronicsGC; C:\Windows\System32\drivers\PLTGC.sys [1327104 2011-11-05] (C-Media Electronics Inc)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2013-11-17] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [x]
S3 MSICDSetup; \??\D:\CDriver64.sys [x]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
hxxp://www.amyuni.com) C:\Windows\SysWOW64\cdintf250.dll
2013-11-17 15:48 - 2013-11-17 15:48 - 00015789 _____ C:\Users\******\Desktop\FRST.txt
2013-11-17 15:47 - 2013-11-17 15:48 - 01958236 _____ (Farbar) C:\Users\******\Desktop\FRST64.exe
2013-11-17 15:45 - 2013-11-17 15:45 - 00043107 _____ C:\ComboFix.txt
2013-11-17 15:38 - 2013-11-17 15:42 - 00028866 _____ C:\Windows\WindowsUpdate.log
2013-11-17 15:38 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-17 15:38 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-17 15:38 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-17 15:38 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-17 15:38 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-17 15:38 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-17 15:38 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-17 15:38 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-17 15:35 - 2013-11-17 15:43 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2013-11-17 15:32 - 2013-11-17 15:45 - 00000000 ____D C:\Qoobox
2013-11-17 15:32 - 2013-11-17 15:44 - 00000000 ____D C:\Windows\erdnt
2013-11-17 15:31 - 2013-11-17 15:31 - 05146587 ____R (Swearware) C:\Users\******\Desktop\ComboFix.exe
2013-11-17 02:18 - 2013-11-17 02:18 - 00377856 _____ C:\Users\******\Downloads\gmer_2.1.19163.exe
2013-11-17 02:12 - 2013-11-17 02:34 - 00000000 ____D C:\Users\******\Desktop\Hilfe
2013-11-17 02:10 - 2013-11-17 02:10 - 00050477 _____ C:\Users\******\Downloads\Defogger.exe
2013-11-17 02:10 - 2013-11-17 02:10 - 00000000 _____ C:\Users\******\defogger_reenable
2013-11-17 01:41 - 2013-11-17 01:41 - 01071224 _____ (Solid State Networks) C:\Users\******\Downloads\install_flashplayer11x32au_mssd_aaa_aih.exe
2013-11-17 01:23 - 2013-11-17 01:23 - 00013347 _____ C:\Users\******\Desktop\Rechnung1.vlg
2013-11-16 17:22 - 2013-11-16 17:23 - 00056963 _____ C:\Users\*****\Downloads\FRST.txt
2013-11-16 13:36 - 2013-11-16 13:36 - 00000000 ____D C:\Users\Julian\Documents\WB Games
2013-11-16 01:06 - 2013-11-16 01:06 - 104513208 _____ C:\Windows\SysWOW64\耴®
2013-11-15 15:47 - 2013-11-15 15:47 - 00056663 _____ C:\Users\Julian\Downloads\avenged_sevenfold_beast_and_the_harlot.gp4
2013-11-15 14:45 - 2013-11-15 14:45 - 104401821 _____ C:\Windows\SysWOW64\ö륡6
2013-11-14 21:16 - 2013-11-14 21:16 - 104278918 _____ C:\Windows\SysWOW64\肴
2013-11-14 20:26 - 2013-11-14 20:26 - 00000209 _____ C:\Users\Julian\Desktop\Gotham City Impostors Free To Play.url
2013-11-14 19:57 - 2013-11-16 11:10 - 00005072 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for *****-Julian *****
2013-11-14 18:35 - 2013-11-16 17:11 - 00005128 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for *****-***** *****
2013-11-14 18:33 - 2013-11-14 18:33 - 00000000 ____D C:\Users\*****\AppData\Local\LogMeIn
2013-11-14 15:17 - 2013-11-14 15:17 - 104225154 _____ C:\Windows\SysWOW64\ﺣŠ
2013-11-13 22:37 - 2013-11-13 22:37 - 00000000 ____D C:\Users\Julian\Desktop\Neuer Ordner
2013-11-13 20:08 - 2013-11-13 20:08 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2013-11-12 13:59 - 2013-11-12 19:59 - 103974937 _____ C:\Windows\SysWOW64\鳴핡ž
2013-11-11 22:39 - 2013-11-11 22:39 - 00000000 ____D C:\Users\Julian\AppData\Roaming\Doublefine
2013-11-11 14:12 - 2013-11-11 14:12 - 103716811 _____ C:\Windows\SysWOW64\ᑈ狊£
2013-11-10 22:24 - 2013-11-10 22:24 - 00000209 _____ C:\Users\Julian\Desktop\Brtal Legend.url
2013-11-10 15:16 - 2013-11-10 22:12 - 103551423 _____ C:\Windows\SysWOW64\寗惞–
2013-11-09 21:37 - 2013-11-09 21:37 - 00078979 _____ C:\Users\Julian\Downloads\slipknot_til_we_die.gp5
2013-11-09 21:36 - 2013-11-09 21:36 - 00047441 _____ C:\Users\Julian\Downloads\slipknot_people_shit.gp4
2013-11-09 21:35 - 2013-11-09 21:35 - 00175948 _____ C:\Users\Julian\Downloads\slipknot_dead_memories.gpx
2013-11-09 16:12 - 2013-11-09 16:12 - 103387443 _____ C:\Windows\SysWOW64\惽㷚Ÿ
2013-11-09 16:06 - 2013-11-09 16:06 - 00061746 _____ C:\Users\Julian\Downloads\in_extremo_liam.gp5
2013-11-09 15:35 - 2013-11-09 15:35 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-09 15:35 - 2013-11-09 15:35 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-09 15:35 - 2013-11-09 15:35 - 00000000 ____D C:\Program Files\iTunes
2013-11-09 15:35 - 2013-11-09 15:35 - 00000000 ____D C:\Program Files\iPod
2013-11-09 10:12 - 2013-11-09 10:12 - 103347145 _____ C:\Windows\SysWOW64\ꠓ
2013-11-08 21:07 - 2013-11-08 21:07 - 103316092 _____ C:\Windows\SysWOW64\퓠�‰
2013-11-08 16:58 - 2013-11-08 16:58 - 00055959 _____ C:\Users\Julian\Downloads\iron_maiden_the_trooper.gp3
2013-11-08 14:11 - 2013-11-08 14:11 - 103148646 _____ C:\Windows\SysWOW64\㩐쮶
2013-11-07 22:05 - 2013-11-07 22:05 - 05366672 _____ C:\Users\Julian\Downloads\DeponiaPaperFigurines.zip
2013-11-07 22:04 - 2013-11-07 22:04 - 00000209 _____ C:\Users\Julian\Desktop\Edna & Harvey Harvey's New Eyes.url
2013-11-07 21:34 - 2013-11-01 14:32 - 00000000 ____D C:\Users\Julian\Desktop\Daedalic Wallpapers
2013-11-07 21:28 - 2013-11-07 21:29 - 57475151 _____ C:\Users\Julian\Downloads\DaedalicWallpapers.zip
2013-11-07 21:26 - 2013-11-07 21:26 - 103000967 _____ C:\Windows\SysWOW64\ೱ篦‘
2013-11-07 15:26 - 2013-11-07 15:26 - 102946670 _____ C:\Windows\SysWOW64\㎒
2013-11-06 20:58 - 2013-11-16 12:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-06 20:26 - 2013-11-06 20:26 - 102844835 _____ C:\Windows\SysWOW64\嵧¤
2013-11-06 14:11 - 2013-11-06 14:11 - 102722523 _____ C:\Windows\SysWOW64\葜炄¤
2013-11-05 20:19 - 2013-11-14 20:12 - 00001281 _____ C:\Users\Julian\Desktop\KEEEEEYS ! Batman, Fear.txt
2013-11-05 20:14 - 2013-11-05 20:14 - 105085299 _____ C:\Windows\SysWOW64\ꙣడ’
2013-11-05 14:21 - 2013-11-05 14:21 - 00103191 _____ C:\Users\Julian\Downloads\amon_amarth_deceiver_of_the_gods.gp5
2013-11-05 13:48 - 2013-11-05 13:48 - 00127786 _____ C:\Users\Julian\Downloads\slipknot_psychosocial.gp5
2013-11-05 13:19 - 2013-11-05 13:19 - 105043933 _____ C:\Windows\SysWOW64\䶾⒒˜
2013-11-04 23:00 - 2013-11-04 23:00 - 00061685 _____ C:\Users\Julian\Downloads\amon_amarth_war_of_the_gods.gp4
2013-11-04 22:55 - 2013-11-04 22:55 - 00080266 _____ C:\Users\Julian\Downloads\amon_amarth_twilight_of_the_thunder_god.gp5
2013-11-04 22:49 - 2013-11-04 22:49 - 00071169 _____ C:\Users\Julian\Downloads\amon_amarth_guardians_of_asgaard.gp5
2013-11-04 22:41 - 2013-11-04 22:41 - 00027402 _____ C:\Users\Julian\Downloads\amon_amarth_pursuit_of_vikings.gp4
2013-11-04 21:55 - 2013-11-04 21:55 - 00050413 _____ C:\Users\Julian\Downloads\nightwish_dark_chest_of_wonders.gp4
2013-11-04 21:53 - 2013-11-04 21:53 - 00142780 _____ C:\Users\Julian\Downloads\nightwish_nemo.gpx
2013-11-04 21:51 - 2013-11-04 21:51 - 00083186 _____ C:\Users\Julian\Downloads\nightwish_amaranth.gp5
2013-11-04 21:21 - 2013-11-04 21:21 - 00053055 _____ C:\Users\Julian\Downloads\all_time_low_damned_if_i_do_ya_damned_if_i_dont.gp5
2013-11-04 21:14 - 2013-11-04 21:14 - 00058488 _____ C:\Users\Julian\Downloads\paramore_still_into_you.gp5
2013-11-04 20:18 - 2013-11-04 20:18 - 104964650 _____ C:\Windows\SysWOW64\渎歍©
2013-11-04 14:13 - 2013-11-04 14:13 - 104867914 _____ C:\Windows\SysWOW64\�濃
2013-11-03 17:54 - 2013-11-03 17:54 - 104814100 _____ C:\Windows\SysWOW64\쀽䄦R
2013-11-03 11:54 - 2013-11-03 11:54 - 104760586 _____ C:\Windows\SysWOW64\킨¦
2013-11-02 22:25 - 2013-11-02 22:25 - 104684788 _____ C:\Windows\SysWOW64\눮�¦
2013-11-02 14:07 - 2013-11-02 14:09 - 00011812 _____ C:\Users\Julian\Desktop\RADIO.WAV
2013-11-02 13:14 - 2013-11-02 13:14 - 104620600 _____ C:\Windows\SysWOW64\뜐쳳™
2013-11-01 22:14 - 2013-11-01 22:14 - 104569497 _____ C:\Windows\SysWOW64\廾㫃‹
2013-11-01 16:05 - 2013-11-01 16:05 - 00000208 _____ C:\Users\Julian\Desktop\Worms Ultimate Mayhem.url
2013-11-01 12:40 - 2013-11-01 12:40 - 00001456 _____ C:\Users\*****\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2013-11-01 12:22 - 2013-11-01 13:15 - 00000000 ____D C:\Users\*****\Desktop\Hochwasser
2013-11-01 12:17 - 2013-11-01 12:17 - 104500486 _____ C:\Windows\SysWOW64\꜇뺚h
2013-10-31 17:40 - 2013-10-31 17:40 - 00000000 ____D C:\Users\******\AppData\Roaming\Lexware
2013-10-31 17:40 - 2013-10-31 17:40 - 00000000 ____D C:\Users\******\AppData\Local\Lexware
2013-10-31 16:03 - 2013-10-31 16:03 - 104348737 _____ C:\Windows\SysWOW64\甲㧽‰
2013-10-30 22:20 - 2013-10-30 22:20 - 00084933 _____ C:\Users\Julian\Downloads\system_of_a_down_toxicity.gp5
2013-10-30 22:02 - 2013-10-30 22:02 - 00035113 _____ C:\Users\Julian\Downloads\system_of_a_down_kill_rock_n_roll.gp5
2013-10-30 21:54 - 2013-10-30 21:54 - 00113403 _____ C:\Users\Julian\Downloads\system_of_a_down_lost_in_hollywood.gp5
2013-10-30 13:16 - 2013-10-30 13:16 - 104098187 _____ C:\Windows\SysWOW64\냈뼑X
2013-10-29 21:08 - 2013-10-29 21:08 - 104021456 _____ C:\Windows\SysWOW64\嶐牘œ
2013-10-29 14:10 - 2013-10-29 14:10 - 103932228 _____ C:\Windows\SysWOW64\批⭘J
2013-10-28 21:06 - 2013-10-28 21:06 - 00045483 _____ C:\Users\Julian\Downloads\queen_we_are_the_champions.gp5
2013-10-28 20:18 - 2013-10-28 20:18 - 103792972 _____ C:\Windows\SysWOW64\嶅B
2013-10-28 14:15 - 2013-10-28 14:15 - 103734365 _____ C:\Windows\SysWOW64\著ꤣŒ
2013-10-27 21:08 - 2013-10-27 21:08 - 103533600 _____ C:\Windows\SysWOW64\�Ᏸ
2013-10-27 13:12 - 2013-10-27 13:12 - 103334033 _____ C:\Windows\SysWOW64\咅鲅V
2013-10-26 18:50 - 2013-10-26 18:50 - 103214166 _____ C:\Windows\SysWOW64\㞋嘂*
2013-10-25 23:17 - 2013-10-25 23:17 - 00000682 _____ C:\Users\Public\Desktop\Dead Space 3.lnk
2013-10-25 21:36 - 2013-10-25 21:36 - 00000000 __SHD C:\ProgramData\DSS
2013-10-25 21:35 - 2013-10-25 21:35 - 00000000 ____D C:\Program Files\Electronic Arts
2013-10-25 20:41 - 2010-09-16 18:03 - 02601752 _____ C:\Windows\SysWOW64\pbsvc_moh.exe
2013-10-25 20:40 - 2013-10-25 23:17 - 00037022 _____ C:\Windows\DirectX.log
2013-10-25 19:18 - 2013-10-26 03:02 - 103054676 _____ C:\Windows\SysWOW64\╀‹
2013-10-25 18:47 - 2013-10-25 18:47 - 08959704 _____ C:\Users\Julian\Downloads\DrakensangOnlineSetup.exe
2013-10-25 18:47 - 2013-10-25 18:47 - 00000000 ____D C:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online
2013-10-25 18:47 - 2013-10-25 18:47 - 00000000 ____D C:\Program Files (x86)\Drakensang Online
2013-10-24 23:28 - 2013-11-17 15:43 - 00020242 _____ C:\Windows\PFRO.log
2013-10-24 23:28 - 2013-11-17 15:43 - 00005208 _____ C:\Windows\setupact.log
2013-10-24 23:28 - 2013-10-24 23:28 - 00000000 _____ C:\Windows\setuperr.log
2013-10-24 23:18 - 2013-10-24 23:18 - 00000000 ____D C:\Users\Julian\Documents\Free YouTube Download Manager
2013-10-24 23:18 - 2013-10-24 23:18 - 00000000 ____D C:\Users\Julian\AppData\Local\Freetec
2013-10-24 23:17 - 2013-10-24 23:20 - 00000000 ____D C:\Program Files (x86)\Web Check
2013-10-24 23:16 - 2013-10-24 23:16 - 00733192 _____ C:\Users\Julian\Downloads\youtube-dlm_1.0_en-US.exe
2013-10-24 22:00 - 2013-10-24 22:00 - 00915368 _____ (Oracle Corporation) C:\Users\Julian\Downloads\jxpiinstall.exe
2013-10-24 17:49 - 2013-10-24 17:49 - 00000701 _____ C:\Users\Julian\Desktop\Rocksmith 2014 Edition.lnk
2013-10-24 16:36 - 2013-10-24 16:36 - 00021623 _____ C:\Users\Julian\Downloads\alice_cooper_poison.gp3
2013-10-24 12:50 - 2013-10-24 18:50 - 102837954 _____ C:\Windows\SysWOW64\ꌬ⟨—
2013-10-23 15:26 - 2013-10-24 02:11 - 102674996 _____ C:\Windows\SysWOW64\贒䓎@
2013-10-23 09:26 - 2013-10-23 09:26 - 102541796 _____ C:\Windows\SysWOW64\芉漌˜
2013-10-23 01:09 - 2013-10-23 01:09 - 00098254 _____ C:\Users\Julian\Downloads\andrew_lloyd_webber_phantom_of_the_opera.gp5
2013-10-22 18:44 - 2013-10-23 00:44 - 102486297 _____ C:\Windows\SysWOW64\㘝�“
2013-10-22 12:44 - 2013-10-22 12:44 - 102327253 _____ C:\Windows\SysWOW64\—
2013-10-21 23:59 - 2013-10-21 23:59 - 00051831 _____ C:\Users\Julian\Downloads\children_of_bodom_scream_for_silence.gp5
2013-10-21 20:00 - 2013-10-21 20:00 - 01679157 _____ C:\Users\Julian\Downloads\metal_hell_frost_melodic_death_metal_richard_band_roland_the_unguided_1600x1200_wallpaper_Art
2013-10-21 19:33 - 2013-10-22 01:33 - 102278179 _____ C:\Windows\SysWOW64\㱰ˆ
2013-10-21 13:22 - 2013-10-21 13:22 - 00004278 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-21 12:51 - 2013-10-21 12:51 - 102130367 _____ C:\Windows\SysWOW64\ҫ렞¦
2013-10-21 12:51 - 2013-10-21 12:51 - 00000000 ____D C:\Users\Julian\AppData\Roaming\Lexware
2013-10-21 12:51 - 2013-10-21 12:51 - 00000000 ____D C:\Users\Julian\AppData\Local\Lexware
2013-10-21 02:02 - 2013-10-21 02:05 - 00000000 ____D C:\Users\*****\AppData\Roaming\Lexware
2013-10-21 02:01 - 2013-10-22 13:24 - 00000000 ____D C:\ProgramData\Lexware
2013-10-21 02:01 - 2013-10-21 02:01 - 00000305 _____ C:\Windows\ODBCINST.INI
2013-10-21 02:01 - 2013-10-21 02:01 - 00000000 ____D C:\Program Files (x86)\Lexware
2013-10-21 02:00 - 2013-03-06 13:02 - 01929216 _____ (Amyuni Technologies
2013-10-21 01:59 - 2013-10-21 02:05 - 00000000 ____D C:\Users\*****\AppData\Local\Lexware
2013-10-20 20:24 - 2013-10-20 20:24 - 27632008 _____ C:\Users\Julian\Desktop\Metal Idee.wav
2013-10-20 11:38 - 2013-10-20 17:38 - 102068998 _____ C:\Windows\SysWOW64\尻殁;
2013-10-19 15:36 - 2013-10-19 15:36 - 101983560 _____ C:\Windows\SysWOW64\叛ᗌF
2013-10-18 18:23 - 2013-10-19 00:22 - 101890677 _____ C:\Windows\SysWOW64\냦膁ˆ
2013-10-18 11:12 - 2013-10-18 11:12 - 101760430 _____ C:\Windows\SysWOW64\ꖘ焤M
2013-10-18 01:18 - 2013-10-18 01:18 - 00077355 _____ C:\Users\Julian\Desktop\kreator_violent_revolution.gpx
2013-10-18 00:45 - 2013-10-18 00:45 - 00048403 _____ C:\Users\Julian\Downloads\kreator_violent_revolution.gp4
==================== One Month Modified Files and Folders =======
2013-11-17 15:48 - 2013-11-17 15:48 - 00015789 _____ C:\Users\******\Desktop\FRST.txt
2013-11-17 15:48 - 2013-11-17 15:47 - 01958236 _____ (Farbar) C:\Users\******\Desktop\FRST64.exe
2013-11-17 15:47 - 2013-11-17 15:38 - 00028866 _____ C:\Windows\WindowsUpdate.log
2013-11-17 15:47 - 2011-04-12 09:06 - 00758184 _____ C:\Windows\system32\perfh007.dat
2013-11-17 15:47 - 2011-04-12 09:06 - 00172956 _____ C:\Windows\system32\perfc007.dat
2013-11-17 15:47 - 2009-07-14 06:13 - 01772838 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-17 15:45 - 2013-11-17 15:45 - 00043107 _____ C:\ComboFix.txt
2013-11-17 15:45 - 2013-11-17 15:32 - 00000000 ____D C:\Qoobox
2013-11-17 15:45 - 2013-01-22 15:22 - 00000000 ____D C:\Users\******\AppData\Local\Apps\2.0
2013-11-17 15:45 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2013-11-17 15:44 - 2013-11-17 15:32 - 00000000 ____D C:\Windows\erdnt
2013-11-17 15:44 - 2013-01-22 14:15 - 00000000 ____D C:\Users\******\AppData\Roaming\Dropbox
2013-11-17 15:44 - 2013-01-22 14:10 - 00000000 ___RD C:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-17 15:44 - 2013-01-20 01:54 - 00000000 ___RD C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-17 15:43 - 2013-11-17 15:35 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2013-11-17 15:43 - 2013-10-24 23:28 - 00020242 _____ C:\Windows\PFRO.log
2013-11-17 15:43 - 2013-10-24 23:28 - 00005208 _____ C:\Windows\setupact.log
2013-11-17 15:43 - 2013-07-10 02:04 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-17 15:43 - 2013-01-22 13:39 - 00000000 ____D C:\Users\******\AppData\Local\LogMeIn Hamachi
2013-11-17 15:43 - 2013-01-20 02:16 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys
2013-11-17 15:43 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-17 15:43 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-11-17 15:42 - 2009-07-14 05:45 - 00022176 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-17 15:42 - 2009-07-14 05:45 - 00022176 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-17 15:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-11-17 15:31 - 2013-11-17 15:31 - 05146587 ____R (Swearware) C:\Users\******\Desktop\ComboFix.exe
2013-11-17 02:34 - 2013-11-17 02:12 - 00000000 ____D C:\Users\******\Desktop\Hilfe
2013-11-17 02:24 - 2013-07-10 02:04 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-17 02:18 - 2013-11-17 02:18 - 00377856 _____ C:\Users\******\Downloads\gmer_2.1.19163.exe
2013-11-17 02:16 - 2013-01-20 03:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-17 02:10 - 2013-11-17 02:10 - 00050477 _____ C:\Users\******\Downloads\Defogger.exe
2013-11-17 02:10 - 2013-11-17 02:10 - 00000000 _____ C:\Users\******\defogger_reenable
2013-11-17 02:10 - 2013-01-22 13:39 - 00000000 ____D C:\Users\******
2013-11-17 02:00 - 2013-01-22 14:54 - 00000000 ____D C:\Users\******\AppData\Local\Adobe
2013-11-17 01:41 - 2013-11-17 01:41 - 01071224 _____ (Solid State Networks) C:\Users\******\Downloads\install_flashplayer11x32au_mssd_aaa_aih.exe
2013-11-17 01:34 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-17 01:23 - 2013-11-17 01:23 - 00013347 _____ C:\Users\******\Desktop\Rechnung1.vlg
2013-11-16 17:24 - 2013-01-20 03:15 - 00000000 ____D C:\Users\*****\AppData\Roaming\Spotify
2013-11-16 17:23 - 2013-11-16 17:22 - 00056963 _____ C:\Users\*****\Downloads\FRST.txt
2013-11-16 17:11 - 2013-11-14 18:35 - 00005128 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for *****-***** *****
2013-11-16 17:11 - 2013-01-20 13:40 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox
2013-11-16 17:10 - 2013-01-27 16:10 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe
2013-11-16 17:10 - 2013-01-21 15:15 - 00000000 ____D C:\Users\*****\AppData\Local\LogMeIn Hamachi
2013-11-16 16:14 - 2013-10-09 21:11 - 00000000 ____D C:\Users\Julian\AppData\Local\Battle.net
2013-11-16 15:55 - 2013-02-13 17:58 - 00000000 ____D C:\Users\Julian\AppData\Local\Deployment
2013-11-16 15:55 - 2013-01-23 17:20 - 00000000 ____D C:\Users\Julian\AppData\Roaming\Skype
2013-11-16 15:13 - 2013-01-23 22:12 - 00000000 ____D C:\Users\Julian\AppData\Roaming\Spotify
2013-11-16 13:43 - 2013-01-20 16:41 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-11-16 13:36 - 2013-11-16 13:36 - 00000000 ____D C:\Users\Julian\Documents\WB Games
2013-11-16 12:04 - 2013-11-06 20:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-16 11:10 - 2013-11-14 19:57 - 00005072 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for *****-Julian *****
2013-11-16 10:58 - 2013-01-23 19:30 - 00000000 ____D C:\Users\Julian\AppData\Local\Adobe
2013-11-16 10:48 - 2013-02-08 22:19 - 00000000 ___RD C:\Users\Julian\Dropbox
2013-11-16 10:48 - 2013-02-08 22:19 - 00000000 ____D C:\Users\Julian\AppData\Roaming\Dropbox
2013-11-16 10:48 - 2013-01-22 14:10 - 00000000 ____D C:\Users\Julian\AppData\Local\LogMeIn Hamachi
2013-11-16 01:06 - 2013-11-16 01:06 - 104513208 _____ C:\Windows\SysWOW64\耴®
2013-11-15 15:47 - 2013-11-15 15:47 - 00056663 _____ C:\Users\Julian\Downloads\avenged_sevenfold_beast_and_the_harlot.gp4
2013-11-15 14:45 - 2013-11-15 14:45 - 104401821 _____ C:\Windows\SysWOW64\ö륡6
2013-11-14 21:16 - 2013-11-14 21:16 - 104278918 _____ C:\Windows\SysWOW64\肴
2013-11-14 20:26 - 2013-11-14 20:26 - 00000209 _____ C:\Users\Julian\Desktop\Gotham City Impostors Free To Play.url
2013-11-14 20:12 - 2013-11-05 20:19 - 00001281 _____ C:\Users\Julian\Desktop\KEEEEEYS ! Batman, Fear.txt
2013-11-14 19:38 - 2013-02-20 15:07 - 00000000 ____D C:\Users\******\AppData\Roaming\FileZilla
2013-11-14 18:35 - 2013-01-20 13:41 - 00001024 _____ C:\Users\*****\Desktop\Dropbox.lnk
2013-11-14 18:35 - 2013-01-20 13:40 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-14 18:33 - 2013-11-14 18:33 - 00000000 ____D C:\Users\*****\AppData\Local\LogMeIn
2013-11-14 18:33 - 2013-01-20 03:16 - 00000000 ____D C:\Users\*****\AppData\Local\Spotify
2013-11-14 15:25 - 2013-01-23 22:12 - 00000000 ____D C:\Users\Julian\AppData\Local\Spotify
2013-11-14 15:17 - 2013-11-14 15:17 - 104225154 _____ C:\Windows\SysWOW64\ﺣŠ
2013-11-13 22:37 - 2013-11-13 22:37 - 00000000 ____D C:\Users\Julian\Desktop\Neuer Ordner
2013-11-13 20:08 - 2013-11-13 20:08 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2013-11-12 19:59 - 2013-11-12 13:59 - 103974937 _____ C:\Windows\SysWOW64\鳴핡ž
2013-11-11 22:39 - 2013-11-11 22:39 - 00000000 ____D C:\Users\Julian\AppData\Roaming\Doublefine
2013-11-11 20:27 - 2013-01-20 15:48 - 00000000 ____D C:\ProgramData\Skype
2013-11-11 14:49 - 2013-01-25 21:56 - 00000000 ____D C:\Users\Julian\AppData\Roaming\vlc
2013-11-11 14:12 - 2013-11-11 14:12 - 103716811 _____ C:\Windows\SysWOW64\ᑈ狊£
2013-11-10 22:24 - 2013-11-10 22:24 - 00000209 _____ C:\Users\Julian\Desktop\Brtal Legend.url
2013-11-10 22:12 - 2013-11-10 15:16 - 103551423 _____ C:\Windows\SysWOW64\寗惞–
2013-11-09 21:56 - 2009-07-14 03:34 - 00000571 _____ C:\Windows\win.ini
2013-11-09 21:37 - 2013-11-09 21:37 - 00078979 _____ C:\Users\Julian\Downloads\slipknot_til_we_die.gp5
2013-11-09 21:36 - 2013-11-09 21:36 - 00047441 _____ C:\Users\Julian\Downloads\slipknot_people_shit.gp4
2013-11-09 21:35 - 2013-11-09 21:35 - 00175948 _____ C:\Users\Julian\Downloads\slipknot_dead_memories.gpx
2013-11-09 17:34 - 2013-07-10 13:31 - 00000000 ____D C:\Users\Julian\AppData\Roaming\BitTorrent
2013-11-09 17:32 - 2013-02-07 17:01 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-11-09 16:12 - 2013-11-09 16:12 - 103387443 _____ C:\Windows\SysWOW64\惽㷚Ÿ
2013-11-09 16:06 - 2013-11-09 16:06 - 00061746 _____ C:\Users\Julian\Downloads\in_extremo_liam.gp5
2013-11-09 15:35 - 2013-11-09 15:35 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-09 15:35 - 2013-11-09 15:35 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-09 15:35 - 2013-11-09 15:35 - 00000000 ____D C:\Program Files\iTunes
2013-11-09 15:35 - 2013-11-09 15:35 - 00000000 ____D C:\Program Files\iPod
2013-11-09 15:35 - 2013-03-13 18:12 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-09 10:12 - 2013-11-09 10:12 - 103347145 _____ C:\Windows\SysWOW64\ꠓ
2013-11-08 21:07 - 2013-11-08 21:07 - 103316092 _____ C:\Windows\SysWOW64\퓠�‰
2013-11-08 16:58 - 2013-11-08 16:58 - 00055959 _____ C:\Users\Julian\Downloads\iron_maiden_the_trooper.gp3
2013-11-08 14:11 - 2013-11-08 14:11 - 103148646 _____ C:\Windows\SysWOW64\㩐쮶
2013-11-07 22:05 - 2013-11-07 22:05 - 05366672 _____ C:\Users\Julian\Downloads\DeponiaPaperFigurines.zip
2013-11-07 22:04 - 2013-11-07 22:04 - 00000209 _____ C:\Users\Julian\Desktop\Edna & Harvey Harvey's New Eyes.url
2013-11-07 22:02 - 2013-05-12 21:21 - 00000000 ____D C:\Users\Julian\AppData\Local\Daedalic Entertainment
2013-11-07 21:29 - 2013-11-07 21:28 - 57475151 _____ C:\Users\Julian\Downloads\DaedalicWallpapers.zip
2013-11-07 21:26 - 2013-11-07 21:26 - 103000967 _____ C:\Windows\SysWOW64\ೱ篦‘
2013-11-07 21:10 - 2013-01-20 02:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-07 15:26 - 2013-11-07 15:26 - 102946670 _____ C:\Windows\SysWOW64\㎒
2013-11-06 20:26 - 2013-11-06 20:26 - 102844835 _____ C:\Windows\SysWOW64\嵧¤
2013-11-06 14:11 - 2013-11-06 14:11 - 102722523 _____ C:\Windows\SysWOW64\葜炄¤
2013-11-05 20:14 - 2013-11-05 20:14 - 105085299 _____ C:\Windows\SysWOW64\ꙣడ’
2013-11-05 17:30 - 2013-02-23 16:54 - 00000000 ____D C:\Users\Julian\Desktop\GP Dateien
2013-11-05 14:21 - 2013-11-05 14:21 - 00103191 _____ C:\Users\Julian\Downloads\amon_amarth_deceiver_of_the_gods.gp5
2013-11-05 13:48 - 2013-11-05 13:48 - 00127786 _____ C:\Users\Julian\Downloads\slipknot_psychosocial.gp5
2013-11-05 13:19 - 2013-11-05 13:19 - 105043933 _____ C:\Windows\SysWOW64\䶾⒒˜
2013-11-04 23:00 - 2013-11-04 23:00 - 00061685 _____ C:\Users\Julian\Downloads\amon_amarth_war_of_the_gods.gp4
2013-11-04 22:55 - 2013-11-04 22:55 - 00080266 _____ C:\Users\Julian\Downloads\amon_amarth_twilight_of_the_thunder_god.gp5
2013-11-04 22:49 - 2013-11-04 22:49 - 00071169 _____ C:\Users\Julian\Downloads\amon_amarth_guardians_of_asgaard.gp5
2013-11-04 22:41 - 2013-11-04 22:41 - 00027402 _____ C:\Users\Julian\Downloads\amon_amarth_pursuit_of_vikings.gp4
2013-11-04 21:55 - 2013-11-04 21:55 - 00050413 _____ C:\Users\Julian\Downloads\nightwish_dark_chest_of_wonders.gp4
2013-11-04 21:53 - 2013-11-04 21:53 - 00142780 _____ C:\Users\Julian\Downloads\nightwish_nemo.gpx
2013-11-04 21:51 - 2013-11-04 21:51 - 00083186 _____ C:\Users\Julian\Downloads\nightwish_amaranth.gp5
2013-11-04 21:21 - 2013-11-04 21:21 - 00053055 _____ C:\Users\Julian\Downloads\all_time_low_damned_if_i_do_ya_damned_if_i_dont.gp5
2013-11-04 21:14 - 2013-11-04 21:14 - 00058488 _____ C:\Users\Julian\Downloads\paramore_still_into_you.gp5
2013-11-04 20:18 - 2013-11-04 20:18 - 104964650 _____ C:\Windows\SysWOW64\渎歍©
2013-11-04 14:13 - 2013-11-04 14:13 - 104867914 _____ C:\Windows\SysWOW64\�濃
2013-11-03 17:54 - 2013-11-03 17:54 - 104814100 _____ C:\Windows\SysWOW64\쀽䄦R
2013-11-03 11:54 - 2013-11-03 11:54 - 104760586 _____ C:\Windows\SysWOW64\킨¦
2013-11-02 22:25 - 2013-11-02 22:25 - 104684788 _____ C:\Windows\SysWOW64\눮�¦
2013-11-02 14:09 - 2013-11-02 14:07 - 00011812 _____ C:\Users\Julian\Desktop\RADIO.WAV
2013-11-02 13:40 - 2013-07-28 18:46 - 00000000 ____D C:\Users\Julian\Documents\Vegas Movie Studio HD Platinum 11.0 Projekte
2013-11-02 13:14 - 2013-11-02 13:14 - 104620600 _____ C:\Windows\SysWOW64\뜐쳳™
2013-11-01 22:14 - 2013-11-01 22:14 - 104569497 _____ C:\Windows\SysWOW64\廾㫃‹
2013-11-01 16:05 - 2013-11-01 16:05 - 00000208 _____ C:\Users\Julian\Desktop\Worms Ultimate Mayhem.url
2013-11-01 14:32 - 2013-11-07 21:34 - 00000000 ____D C:\Users\Julian\Desktop\Daedalic Wallpapers
2013-11-01 13:28 - 2013-01-27 16:20 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-11-01 13:27 - 2013-01-22 14:49 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-11-01 13:18 - 2013-01-22 15:22 - 00000000 ____D C:\Users\******\AppData\Local\Deployment
2013-11-01 13:15 - 2013-11-01 12:22 - 00000000 ____D C:\Users\*****\Desktop\Hochwasser
2013-11-01 12:52 - 2013-01-26 18:04 - 00000000 ____D C:\Users\******\AppData\Roaming\Spotify
2013-11-01 12:40 - 2013-11-01 12:40 - 00001456 _____ C:\Users\*****\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2013-11-01 12:39 - 2013-01-20 03:17 - 00000000 ____D C:\Users\*****\AppData\Roaming\Adobe
2013-11-01 12:18 - 2013-01-22 15:25 - 00000000 ____D C:\Windows\pss
2013-11-01 12:18 - 2013-01-22 13:39 - 00000000 ___RD C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-01 12:17 - 2013-11-01 12:17 - 104500486 _____ C:\Windows\SysWOW64\꜇뺚h
2013-10-31 17:40 - 2013-10-31 17:40 - 00000000 ____D C:\Users\******\AppData\Roaming\Lexware
2013-10-31 17:40 - 2013-10-31 17:40 - 00000000 ____D C:\Users\******\AppData\Local\Lexware
2013-10-31 17:40 - 2013-01-26 18:04 - 00000000 ____D C:\Users\******\AppData\Local\Spotify
2013-10-31 17:40 - 2013-01-22 13:39 - 00117840 _____ C:\Users\******\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-31 16:03 - 2013-10-31 16:03 - 104348737 _____ C:\Windows\SysWOW64\甲㧽‰
2013-10-30 22:20 - 2013-10-30 22:20 - 00084933 _____ C:\Users\Julian\Downloads\system_of_a_down_toxicity.gp5
2013-10-30 22:02 - 2013-10-30 22:02 - 00035113 _____ C:\Users\Julian\Downloads\system_of_a_down_kill_rock_n_roll.gp5
2013-10-30 21:54 - 2013-10-30 21:54 - 00113403 _____ C:\Users\Julian\Downloads\system_of_a_down_lost_in_hollywood.gp5
2013-10-30 13:16 - 2013-10-30 13:16 - 104098187 _____ C:\Windows\SysWOW64\냈뼑X
2013-10-29 21:08 - 2013-10-29 21:08 - 104021456 _____ C:\Windows\SysWOW64\嶐牘œ
2013-10-29 14:10 - 2013-10-29 14:10 - 103932228 _____ C:\Windows\SysWOW64\批⭘J
2013-10-28 21:06 - 2013-10-28 21:06 - 00045483 _____ C:\Users\Julian\Downloads\queen_we_are_the_champions.gp5
2013-10-28 20:18 - 2013-10-28 20:18 - 103792972 _____ C:\Windows\SysWOW64\嶅B
2013-10-28 14:15 - 2013-10-28 14:15 - 103734365 _____ C:\Windows\SysWOW64\著ꤣŒ
2013-10-27 21:08 - 2013-10-27 21:08 - 103533600 _____ C:\Windows\SysWOW64\�Ᏸ
2013-10-27 13:12 - 2013-10-27 13:12 - 103334033 _____ C:\Windows\SysWOW64\咅鲅V
2013-10-26 18:50 - 2013-10-26 18:50 - 103214166 _____ C:\Windows\SysWOW64\㞋嘂*
2013-10-26 03:02 - 2013-10-25 19:18 - 103054676 _____ C:\Windows\SysWOW64\╀‹
2013-10-25 23:17 - 2013-10-25 23:17 - 00000682 _____ C:\Users\Public\Desktop\Dead Space 3.lnk
2013-10-25 23:17 - 2013-10-25 20:40 - 00037022 _____ C:\Windows\DirectX.log
2013-10-25 21:36 - 2013-10-25 21:36 - 00000000 __SHD C:\ProgramData\DSS
2013-10-25 21:36 - 2013-01-30 16:42 - 00000000 ____D C:\Users\Julian\Documents\EA Games
2013-10-25 21:35 - 2013-10-25 21:35 - 00000000 ____D C:\Program Files\Electronic Arts
2013-10-25 21:00 - 2013-01-22 16:14 - 00189248 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-10-25 20:41 - 2013-01-22 16:14 - 00075064 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-10-25 18:47 - 2013-10-25 18:47 - 08959704 _____ C:\Users\Julian\Downloads\DrakensangOnlineSetup.exe
2013-10-25 18:47 - 2013-10-25 18:47 - 00000000 ____D C:\Users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online
2013-10-25 18:47 - 2013-10-25 18:47 - 00000000 ____D C:\Program Files (x86)\Drakensang Online
2013-10-24 23:57 - 2013-01-24 16:37 - 00000000 ____D C:\Users\Julian\AppData\Local\CrashDumps
2013-10-24 23:28 - 2013-10-24 23:28 - 00000000 _____ C:\Windows\setuperr.log
2013-10-24 23:27 - 2013-08-14 13:30 - 00000000 ____D C:\AdwCleaner
2013-10-24 23:26 - 2013-09-28 12:24 - 00000000 ____D C:\Users\Julian\Desktop\Programme
2013-10-24 23:22 - 2013-06-30 21:39 - 00000000 ____D C:\Users\Julian\AppData\Roaming\DAEMON Tools Lite
2013-10-24 23:20 - 2013-10-24 23:17 - 00000000 ____D C:\Program Files (x86)\Web Check
2013-10-24 23:20 - 2013-01-30 17:44 - 00000000 ____D C:\ProgramData\Package Cache
2013-10-24 23:18 - 2013-10-24 23:18 - 00000000 ____D C:\Users\Julian\Documents\Free YouTube Download Manager
2013-10-24 23:18 - 2013-10-24 23:18 - 00000000 ____D C:\Users\Julian\AppData\Local\Freetec
2013-10-24 23:16 - 2013-10-24 23:16 - 00733192 _____ C:\Users\Julian\Downloads\youtube-dlm_1.0_en-US.exe
2013-10-24 22:00 - 2013-10-24 22:00 - 00915368 _____ (Oracle Corporation) C:\Users\Julian\Downloads\jxpiinstall.exe
2013-10-24 18:50 - 2013-10-24 12:50 - 102837954 _____ C:\Windows\SysWOW64\ꌬ⟨—
2013-10-24 17:49 - 2013-10-24 17:49 - 00000701 _____ C:\Users\Julian\Desktop\Rocksmith 2014 Edition.lnk
2013-10-24 16:36 - 2013-10-24 16:36 - 00021623 _____ C:\Users\Julian\Downloads\alice_cooper_poison.gp3
2013-10-24 13:52 - 2013-02-03 19:31 - 00000000 ____D C:\Users\Julian\AppData\Local\SKIDROW
2013-10-24 13:51 - 2013-10-24 13:51 - 00636059 _____ C:\Users\Julian\Downloads\rock2014crackonly-dlc.rar
2013-10-24 02:11 - 2013-10-23 15:26 - 102674996 _____ C:\Windows\SysWOW64\贒䓎@
2013-10-23 09:26 - 2013-10-23 09:26 - 102541796 _____ C:\Windows\SysWOW64\芉漌˜
2013-10-23 01:09 - 2013-10-23 01:09 - 00098254 _____ C:\Users\Julian\Downloads\andrew_lloyd_webber_phantom_of_the_opera.gp5
2013-10-23 00:44 - 2013-10-22 18:44 - 102486297 _____ C:\Windows\SysWOW64\㘝�“
2013-10-22 13:24 - 2013-10-21 02:01 - 00000000 ____D C:\ProgramData\Lexware
2013-10-22 13:06 - 2013-01-20 15:48 - 00000000 ____D C:\Users\*****\AppData\Roaming\Skype
2013-10-22 12:44 - 2013-10-22 12:44 - 102327253 _____ C:\Windows\SysWOW64\—
2013-10-22 02:52 - 2013-10-16 20:47 - 00000872 _____ C:\Users\Public\Desktop\REAPER (x64).lnk
2013-10-22 01:33 - 2013-10-21 19:33 - 102278179 _____ C:\Windows\SysWOW64\㱰ˆ
2013-10-21 23:59 - 2013-10-21 23:59 - 00051831 _____ C:\Users\Julian\Downloads\children_of_bodom_scream_for_silence.gp5
2013-10-21 20:00 - 2013-10-21 20:00 - 01679157 _____ C:\Users\Julian\Downloads\metal_hell_frost_melodic_death_metal_richard_band_roland_the_unguided_1600x1200_wallpaper_Art
2013-10-21 13:22 - 2013-10-21 13:22 - 00004278 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-21 13:22 - 2013-10-06 21:55 - 00000000 ____D C:\ProgramData\Oracle
2013-10-21 13:22 - 2013-01-21 14:30 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-21 12:51 - 2013-10-21 12:51 - 102130367 _____ C:\Windows\SysWOW64\ҫ렞¦
2013-10-21 12:51 - 2013-10-21 12:51 - 00000000 ____D C:\Users\Julian\AppData\Roaming\Lexware
2013-10-21 12:51 - 2013-10-21 12:51 - 00000000 ____D C:\Users\Julian\AppData\Local\Lexware
2013-10-21 12:51 - 2013-01-22 14:10 - 00117840 _____ C:\Users\Julian\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-21 12:50 - 2009-07-14 05:45 - 09704592 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-21 02:11 - 2013-02-17 02:33 - 00000000 ____D C:\Users\*****\AppData\Roaming\FileZilla
2013-10-21 02:05 - 2013-10-21 02:02 - 00000000 ____D C:\Users\*****\AppData\Roaming\Lexware
2013-10-21 02:05 - 2013-10-21 01:59 - 00000000 ____D C:\Users\*****\AppData\Local\Lexware
2013-10-21 02:02 - 2013-01-20 02:05 - 00117840 _____ C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-21 02:01 - 2013-10-21 02:01 - 00000305 _____ C:\Windows\ODBCINST.INI
2013-10-21 02:01 - 2013-10-21 02:01 - 00000000 ____D C:\Program Files (x86)\Lexware
2013-10-20 20:24 - 2013-10-20 20:24 - 27632008 _____ C:\Users\Julian\Desktop\Metal Idee.wav
2013-10-20 17:47 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-10-20 17:38 - 2013-10-20 11:38 - 102068998 _____ C:\Windows\SysWOW64\尻殁;
2013-10-19 15:36 - 2013-10-19 15:36 - 101983560 _____ C:\Windows\SysWOW64\叛ᗌF
2013-10-19 09:34 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-19 00:22 - 2013-10-18 18:23 - 101890677 _____ C:\Windows\SysWOW64\냦膁ˆ
2013-10-18 11:12 - 2013-10-18 11:12 - 101760430 _____ C:\Windows\SysWOW64\ꖘ焤M
2013-10-18 01:19 - 2013-07-10 02:04 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-18 01:19 - 2013-07-10 02:04 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-18 01:18 - 2013-10-18 01:18 - 00077355 _____ C:\Users\Julian\Desktop\kreator_violent_revolution.gpx
2013-10-18 00:45 - 2013-10-18 00:45 - 00048403 _____ C:\Users\Julian\Downloads\kreator_violent_revolution.gp4
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-10 15:54
==================== End Of Log ============================
--- --- --- |
Malwarebytes Anti-Malware 
Aktualität von System und Software