Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? (https://www.trojaner-board.de/149441-win7-home-premium-verdacht-rootkit-nutzung-bitcoin-botnet.html)

Colorlight 08.02.2014 04:38
Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet?
 
Hallo,

mir ist gestern aufgefallen, dass ich im Taskmanager eine Instanz von explorer.exe laufen habe, der mir die Hälfte der Prozessorleistung zieht. Wenn ich den Prozess beende, startet er nach 2-3 Sekunden automatisch wieder neu.

Bei näherer Betrachtung habe ich festgestellt, dass die explorer.exe mit einem langen Parameter gestartet wurde, der auf die Domain fast-pool.com verweist (an den genauen Parameter komme ich gerade nicht ran, da ich mich mit dem betroffenen Windowsaccount im Moment nicht anmelden möchte).

Der Effekt mit der erhöhten Systemlast tritt nur in meinem normalen Arbeitsaccount (eingeschränkte Rechte) auf. Im Adminaccount ist dieser Prozess nicht vorhanden.

Ich habe Malwarebytes, defogger, FRST sowie gmer wie in der Anleitung beschrieben ausgeführt.

Nachstehend die Logs der Programme (in chronologischer Reihenfolge).
Das Log von gmer musste ich aufgrund der Größe leider zippen.

Vielen Dank im voraus!

Gruß
Colorlight



Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.08.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Admin :: VINCENTS-PC [Administrator]

08.02.2014 02:54:32
mbam-log-2014-02-08 (02-54-32).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 312789
Laufzeit: 5 Minute(n), 1 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\Admin\AppData\Local\Temp\CT2438727 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 11
C:\Users\Heiko\AppData\Local\Temp\FIBJeDQZ.exe.part (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Heiko\AppData\Local\Temp\lQdt4XbZ.exe.part (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Heiko\Downloads\FlashPlayersetup__3873_i298808872_il22.exe (PUP.Optional.InstallMonetizer) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Julien\Downloads\FLVPlayerSetup.exe (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Julien\Downloads\iLividSetup-r342-n-bf(1).exe (PUP.Optional.Bandoo) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Julien\Downloads\iLividSetup-r342-n-bf.exe (PUP.Optional.Bandoo) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Julien\Downloads\SoftonicDownloader_fuer_minecraft.exe (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Admin\AppData\Local\Temp\CT2438727\CT2438727.txt (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Admin\AppData\Local\Temp\CT2438727\ddt.csf (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Admin\AppData\Local\Temp\CT2438727\initData.json (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Admin\AppData\Local\Temp\CT2438727\manifest.json (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 03:13 on 08/02/2014 (Admin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2014
Ran by Admin (administrator) on VINCENTS-PC on 08-02-2014 03:16:02
Running from C:\Users\Admin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun32.bin
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Pegtop Software) D:\PortableApps\PStart\PStart.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7284328 2011-08-30] (Realtek Semiconductor)
HKLM\...\Run: [fssui] - C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [892416 2012-09-12] (Microsoft Corporation)
HKLM\...\Run: [SuRun Systemmenü-Erweiterung] - C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
HKLM\...\Run: [tvncontrol] - C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-27] (AVAST Software)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\MountPoints2: {1db13b4c-7ac0-11e2-bd48-806e6f6e6963} - E:\DVDSetup.exe
IFEO\taskmgr.exe: [Debugger] "C:\PortableApps\ProcessExplorerPortable\ProcessExplorerPortable.exe"
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PStart - Verknüpfung.lnk
ShortcutTarget: PStart - Verknüpfung.lnk -> D:\PortableApps\PStart\PStart.exe (Pegtop Software)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.lnk
ShortcutTarget: Core Temp.lnk -> C:\Program Files\Core Temp\Core Temp.exe ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PortableAppsPlatform.exe - Verknüpfung.lnk
ShortcutTarget: PortableAppsPlatform.exe - Verknüpfung.lnk -> C:\PortableApps\PortableApps.com\PortableAppsPlatform.exe (PortableApps.com)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PStart - Verknüpfung.lnk
ShortcutTarget: PStart - Verknüpfung.lnk -> D:\PortableApps\PStart\PStart.exe (Pegtop Software)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XMediaGrabber.lnk
ShortcutTarget: XMediaGrabber.lnk -> C:\Program Files (x86)\XMediaGrabber\XMediaGrabber.exe (hxxp://www.xmediagrabber.de)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x163759EBE10ECE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0F4C14C4-945D-4990-9388-A3C7A2E9336F} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {94AE0E02-5D76-4244-8B5F-783BD0CA7D76} URL = hxxp://www.bing.com/?cc=de
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: No Name - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks: SuRun Shell Extension - {2C7B6088-5A77-4d48-BE43-30337DCA9A86} - C:\Windows\SuRunExt.dll [189952 2013-07-03] (hxxp://kay-bruns.de)
Tcpip\..\Interfaces\{57F85748-9E1C-49A3-89C9-3715B55FD919}: [NameServer]192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-02-20]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-27] (AVAST Software)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S4 MsgPlusService; C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [128000 2013-06-27] (Yuna Software)
R2 SuRunSVC; C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
S4 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-27] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-27] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-27] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-27] ()
R3 dvdfab; C:\Windows\System32\drivers\dvdfab.sys [79232 2011-08-15] (Fengtao Software Inc.)
R3 MsgPlusDriver; C:\Windows\System32\DRIVERS\MsgPlusDriver.sys [125392 2013-05-07] (Yune Software)
S3 ALSysIO; \??\C:\Users\Admin\AppData\Local\Temp\ALSysIO64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-08 03:16 - 2014-02-08 03:16 - 00011803 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-08 03:15 - 2014-02-08 03:16 - 00000000 ____D () C:\FRST
2014-02-08 03:14 - 2014-02-08 03:14 - 02079744 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000472 _____ () C:\Users\Admin\Downloads\defogger_disable.log
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:52 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-08 02:47 - 2014-02-08 02:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:33 - 2014-02-08 00:37 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:32 - 2014-02-08 00:41 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 20:18 - 2014-02-08 00:12 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:20 - 2014-02-07 19:58 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 10:18 - 2011-12-21 13:15 - 00219440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2014-02-05 10:18 - 2011-12-21 13:15 - 00044848 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:11 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 15:11 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-02-03 15:11 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 20:58 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2014-02-02 20:58 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2014-02-02 20:58 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2014-02-02 20:57 - 2014-02-02 20:58 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:57 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2014-02-02 20:57 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2014-02-02 20:57 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-02-02 20:57 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-02-02 20:57 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-02-02 20:57 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-02-02 20:57 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-02-02 20:57 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-02-02 20:57 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-02-02 20:57 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-02-02 20:57 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-02-02 20:57 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-08 00:49 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:07 - 2014-02-02 20:08 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-01-17 06:11 - 2014-01-17 06:12 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:11 - 2014-01-17 06:12 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:11 - 2014-01-17 06:12 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-15 17:55 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 17:55 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 17:55 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software

==================== One Month Modified Files and Folders =======

2014-02-08 03:16 - 2014-02-08 03:16 - 00011803 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-08 03:16 - 2014-02-08 03:15 - 00000000 ____D () C:\FRST
2014-02-08 03:14 - 2014-02-08 03:14 - 02079744 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000472 _____ () C:\Users\Admin\Downloads\defogger_disable.log
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:13 - 2013-02-19 21:23 - 00000000 ____D () C:\Users\Admin
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 03:12 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-08 03:12 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-08 03:09 - 2013-02-19 19:18 - 01374140 _____ () C:\Windows\WindowsUpdate.log
2014-02-08 03:06 - 2013-04-22 19:37 - 00000680 __RSH () C:\Users\Admin\ntuser.pol
2014-02-08 03:05 - 2013-04-05 04:12 - 00027444 _____ () C:\Windows\PFRO.log
2014-02-08 03:05 - 2013-03-30 01:05 - 00039037 _____ () C:\Windows\setupact.log
2014-02-08 03:05 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:48 - 2014-02-08 02:47 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 02:26 - 2013-02-20 07:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-08 02:10 - 2013-02-20 08:04 - 00000000 ____D () C:\Users\Admin\AppData\Local\Mozilla
2014-02-08 02:05 - 2013-04-16 18:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\Windows Live
2014-02-08 02:03 - 2013-08-05 08:37 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA.job
2014-02-08 02:03 - 2013-08-05 08:37 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core.job
2014-02-08 01:58 - 2013-08-05 08:37 - 00003918 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA
2014-02-08 01:58 - 2013-08-05 08:37 - 00003550 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core
2014-02-08 01:57 - 2013-02-22 19:02 - 00000000 ___RD () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:49 - 2014-02-02 20:09 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-08 00:41 - 2014-02-08 00:32 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:37 - 2014-02-08 00:33 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:12 - 2014-02-07 20:18 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-08 00:12 - 2013-08-16 19:19 - 00000000 ____D () C:\Users\Heiko\.xmg
2014-02-08 00:12 - 2013-04-16 18:21 - 00000680 __RSH () C:\Users\Heiko\ntuser.pol
2014-02-08 00:12 - 2013-02-22 19:01 - 00000000 ____D () C:\Users\Heiko
2014-02-07 23:41 - 2013-02-24 22:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\XBMC
2014-02-07 23:32 - 2013-08-25 00:42 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:17 - 2013-12-22 14:59 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\Skype
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 21:13 - 2013-04-16 18:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Windows Live
2014-02-07 19:58 - 2014-02-05 10:20 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-07 09:48 - 2013-08-29 17:05 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{12489FB2-B57C-4A9C-8F29-2291A874BC82}
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 12:09 - 2013-02-20 09:25 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 08:01 - 2013-12-20 07:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-04 22:26 - 2013-02-20 07:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 22:26 - 2013-02-20 07:36 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 22:26 - 2013-02-20 07:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 19:28 - 2013-04-22 19:35 - 00022330 __RSH () C:\Users\Julien\ntuser.pol
2014-02-03 19:28 - 2013-04-22 19:35 - 00000000 ____D () C:\Users\Julien
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:12 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 21:40 - 2013-04-16 18:26 - 00004682 __RSH () C:\Users\Jeremy\ntuser.pol
2014-02-02 21:40 - 2013-02-28 18:40 - 00000000 ____D () C:\Users\Jeremy
2014-02-02 20:58 - 2014-02-02 20:57 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:08 - 2014-02-02 20:07 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-02-02 19:45 - 2013-03-17 21:09 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\.minecraft
2014-02-01 08:52 - 2013-04-22 19:37 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\.minecraft
2014-01-25 19:44 - 2013-11-16 21:58 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Skype
2014-01-17 06:12 - 2014-01-17 06:11 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:12 - 2014-01-17 06:11 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:12 - 2014-01-17 06:11 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 20:18 - 2010-11-21 07:50 - 00697160 _____ () C:\Windows\system32\perfh007.dat
2014-01-16 20:18 - 2010-11-21 07:50 - 00148642 _____ () C:\Windows\system32\perfc007.dat
2014-01-16 20:18 - 2009-07-14 06:13 - 01613340 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-16 03:19 - 2009-07-14 05:45 - 00276968 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:03 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-16 03:00 - 2013-02-20 07:37 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-14 14:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-14 12:25 - 2013-02-20 08:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Admin\AppData\Local\Temp\sfextra.dll
C:\Users\Heiko\AppData\Local\Temp\dateinj01.dll
C:\Users\Heiko\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Heiko\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Heiko\AppData\Local\Temp\jna1090320167789684337.dll
C:\Users\Heiko\AppData\Local\Temp\jna146387679698056849.dll
C:\Users\Heiko\AppData\Local\Temp\jna1889692644574211350.dll
C:\Users\Heiko\AppData\Local\Temp\jna2335009430795990528.dll
C:\Users\Heiko\AppData\Local\Temp\jna2570889650698236768.dll
C:\Users\Heiko\AppData\Local\Temp\jna2579745138073087603.dll
C:\Users\Heiko\AppData\Local\Temp\jna2710169554635638698.dll
C:\Users\Heiko\AppData\Local\Temp\jna317314098607355768.dll
C:\Users\Heiko\AppData\Local\Temp\jna3550376239115613572.dll
C:\Users\Heiko\AppData\Local\Temp\jna3687876397338136285.dll
C:\Users\Heiko\AppData\Local\Temp\jna395911161415364618.dll
C:\Users\Heiko\AppData\Local\Temp\jna5090182510300320974.dll
C:\Users\Heiko\AppData\Local\Temp\jna5173797234473555658.dll
C:\Users\Heiko\AppData\Local\Temp\jna532471048345224569.dll
C:\Users\Heiko\AppData\Local\Temp\jna5331849837104093976.dll
C:\Users\Heiko\AppData\Local\Temp\jna5773945272469302218.dll
C:\Users\Heiko\AppData\Local\Temp\jna5834066976529262566.dll
C:\Users\Heiko\AppData\Local\Temp\jna5966279924322110094.dll
C:\Users\Heiko\AppData\Local\Temp\jna6229537924547466958.dll
C:\Users\Heiko\AppData\Local\Temp\jna6480371944392390404.dll
C:\Users\Heiko\AppData\Local\Temp\jna6629853560495946337.dll
C:\Users\Heiko\AppData\Local\Temp\jna6814767887592814909.dll
C:\Users\Heiko\AppData\Local\Temp\jna7414802737387451775.dll
C:\Users\Heiko\AppData\Local\Temp\jna7980470534759480116.dll
C:\Users\Heiko\AppData\Local\Temp\jna8561117166109762441.dll
C:\Users\Heiko\AppData\Local\Temp\jna8899161736838149126.dll
C:\Users\Heiko\AppData\Local\Temp\libcurl-4.dll
C:\Users\Heiko\AppData\Local\Temp\pthreadGC2.dll
C:\Users\Heiko\AppData\Local\Temp\SDL_1.dll
C:\Users\Heiko\AppData\Local\Temp\SDL_2.dll
C:\Users\Heiko\AppData\Local\Temp\SDL_3.dll
C:\Users\Heiko\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Heiko\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Heiko\AppData\Local\Temp\zlib1.dll
C:\Users\Julien\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Julien\AppData\Local\Temp\Softonic_DE_1-5-1.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-29 17:49

==================== End Of Log ============================
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-02-2014
Ran by Admin at 2014-02-08 03:16:38
Running from C:\Users\Admin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

À plus! 1 Vokabeltrainer interaktiv (x32 Version: 1.0.0.0 - Cornelsen Verlag)
AC-3 ACM Codec x64 2.2 (Version: 2.2 - fccHandler)
Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.71219.1540 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In  (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
Ausnahmen (Version:  - )
Ausnahmen64 (Version:  - )
AutoIt v3.3.8.1 (x32 Version:  - AutoIt Team)
avast! Free Antivirus (x32 Version: 9.0.2008 - Avast Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CloudReading (x32 Version: 1.0.31.1111 - Foxit Corporation)
Core Temp 1.0 RC5 (Version: 1.0 - Alcpu)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diablo II (x32 Version:  - Blizzard Entertainment)
Diablo III (x32 Version: 1.0.8.16603 - Blizzard Entertainment)
DVDFab Passkey 8.1.0.1 (26/06/2013) (x32 Version:  - Fengtao Software Inc.)
Facebook Video Calling 2.0.0.447 (x32 Version: 2.0.447 - Skype Limited)
Foxit Reader (x32 Version: 6.1.1.1031 - Foxit Corporation)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
K-Lite Mega Codec Pack 9.3.0 (x32 Version: 9.3.0 - )
Lame ACM MP3 Codec (Version:  - )
Lame ACM MP3 Codec (x32 Version:  - )
LAME v3.99.3 (for Windows) (x32 Version:  - )
Link Shell Extension (Version: 3.7.1.9 - Hermann Schinagl)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Messenger Plus! for Skype (x32 Version: 2.0.0.150 - Yuna Software)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Compatibility Toolkit 5.6 (x32 Version: 5.6.7324.0 - Microsoft Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
No23 Recorder (x32 Version: 2.1.0.3 - No23)
Oracle VM VirtualBox 4.0.16 (Version: 4.0.16 - Oracle Corporation)
phase-6 2.3.3 (x32 Version: 2.3.3 - phase-6)
Pokémon Trading Card Game Online (x32 Version: 1.0.0 - The Pokémon Company International)
Realtek Ethernet Controller Driver (x32 Version: 7.46.610.2011 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6449 - Realtek Semiconductor Corp.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Sophos Virus Removal Tool (x32 Version: 2.4 - Sophos Limited)
Starbound (x32 Version:  - )
Steam (x32 Version:  - Valve Corporation)
Super User Run (SuRun) (Version: 1.2.1.0 - Kay Bruns)
TeamViewer 8 (x32 Version: 8.0.22298 - TeamViewer)
TightVNC (Version: 2.7.10.0 - GlavSoft LLC.)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
x264vfw - H.264/MPEG-4 AVC codec (remove only) (x32 Version:  - )
XBMC (HKCU Version:  - Team XBMC)

==================== Restore Points  =========================

24-01-2014 15:25:49 Windows Update
28-01-2014 21:09:29 Windows Update
02-02-2014 19:56:44 DirectX wurde installiert
04-02-2014 11:32:50 Windows Update
05-02-2014 09:18:03 Installed Oracle VM VirtualBox 4.0.16
07-02-2014 20:31:17 Windows Update
07-02-2014 23:38:45 Installed Sophos Virus Removal Tool.

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {46D76E1C-8771-4E1C-9BBA-3FF274C05193} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-11-27] (AVAST Software)
Task: {55944064-FDE1-4F63-9305-AD5A84F33076} - System32\Tasks\{F218FF9C-718E-418F-8DFA-5C955E6FDC81} => C:\Program Files (x86)\phase-6\phase-6\phase-6.exe [2013-06-21] (phase-6)
Task: {6166713D-ECD1-4EF7-A763-54F41BB9A50E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA => C:\Users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-05] (Facebook Inc.)
Task: {8AFDF409-76A9-4980-BB04-6E1991ADEF08} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core => C:\Users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-05] (Facebook Inc.)
Task: {B17C2AD9-B4CD-43EB-94F3-A85840D059F6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-04] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core.job => C:\Users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA.job => C:\Users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job => C:\Program Files (x86)\XMediaGrabber\XMGTimerStartupScheduler.exe

==================== Loaded Modules (whitelisted) =============

2004-09-30 19:15 - 2004-09-30 19:15 - 00192000 _____ () C:\Program Files\LinkShellExtension\RockallDLL.dll
2012-12-19 15:32 - 2012-12-19 15:32 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-02-07 20:14 - 2014-02-07 19:49 - 02171904 _____ () C:\Program Files\AVAST Software\Avast\defs\14020701\algo.dll
2013-11-27 22:44 - 2013-11-27 22:44 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-12-20 07:16 - 2013-12-20 07:16 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\temp:1011F76C.dat
AlternateDataStreams: C:\temp:1319E5C0.dat
AlternateDataStreams: C:\temp:1A00BB4B.dat
AlternateDataStreams: C:\temp:list
AlternateDataStreams: C:\temp:pid1
AlternateDataStreams: C:\temp:pid2
AlternateDataStreams: C:\temp:srv

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/08/2014 03:07:09 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/08/2014 02:05:22 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/08/2014 01:19:26 AM) (Source: Application Hang) (User: )
Description: Programm 9638489.exe, Version 11.0.0.1245 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: a60

Startzeit: 01cf24616e46c4e3

Endzeit: 16

Anwendungspfad: C:\Users\Heiko\AppData\Local\Temp\5151293\9638489.exe

Berichts-ID: a42eaf03-9056-11e3-b8c5-8c89a583a54a

Error: (02/08/2014 00:48:17 AM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (02/08/2014 00:06:58 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/07/2014 11:51:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/07/2014 11:48:53 PM) (Source: MsgPlusService) (User: )
Description: MsgPlusServiceService failed to shut down.

Error: (02/07/2014 11:48:53 PM) (Source: MsgPlusService) (User: )
Description: MsgPlusServiceReceiving shutdown message.

Error: (02/07/2014 11:15:29 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FreeCommander.exe, Version: 0.0.0.609, Zeitstempel: 0x50b8d9df
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0xa8000002
ID des fehlerhaften Prozesses: 0x2a78
Startzeit der fehlerhaften Anwendung: 0xFreeCommander.exe0
Pfad der fehlerhaften Anwendung: FreeCommander.exe1
Pfad des fehlerhaften Moduls: FreeCommander.exe2
Berichtskennung: FreeCommander.exe3

Error: (02/07/2014 06:41:12 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall


System errors:
=============
Error: (02/03/2014 02:38:48 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR7 gefunden.

Error: (02/03/2014 02:38:48 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR7 gefunden.

Error: (02/02/2014 08:45:18 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 11.

Error: (02/02/2014 08:44:54 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (02/02/2014 08:13:19 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (02/02/2014 08:13:19 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (02/02/2014 02:01:35 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR6 gefunden.

Error: (02/02/2014 02:01:33 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR6 gefunden.

Error: (01/16/2014 03:22:15 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x80080005

Error: (01/16/2014 03:22:15 AM) (Source: DCOM) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}


Microsoft Office Sessions:
=========================
Error: (02/08/2014 03:07:09 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/08/2014 02:05:22 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/08/2014 01:19:26 AM) (Source: Application Hang)(User: )
Description: 9638489.exe11.0.0.1245a6001cf24616e46c4e316C:\Users\Heiko\AppData\Local\Temp\5151293\9638489.exea42eaf03-9056-11e3-b8c5-8c89a583a54a

Error: (02/08/2014 00:48:17 AM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (02/08/2014 00:06:58 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/07/2014 11:51:28 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/07/2014 11:48:53 PM) (Source: MsgPlusService)(User: )
Description: MsgPlusServiceService failed to shut down.

Error: (02/07/2014 11:48:53 PM) (Source: MsgPlusService)(User: )
Description: MsgPlusServiceReceiving shutdown message.

Error: (02/07/2014 11:15:29 PM) (Source: Application Error)(User: )
Description: FreeCommander.exe0.0.0.60950b8d9dfunknown0.0.0.000000000c0000005a80000022a7801cf21147786fa0cD:\PortableApps\FreeCommanderXE\FreeCommander.exeunknown59e87a16-9045-11e3-a710-8c89a583a54a

Error: (02/07/2014 06:41:12 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall


==================== Memory info ===========================

Percentage of memory in use: 22%
Total physical RAM: 7669.41 MB
Available physical RAM: 5937.38 MB
Total Pagefile: 15337 MB
Available Pagefile: 13348.44 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:293.79 GB) (Free:214.67 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:1275.44 GB) (Free:1012.74 GB) NTFS
Drive e: (Iomega HDD) (Fixed) (Total:931.51 GB) (Free:430.46 GB) NTFS
Drive o: (DRIVE-N-GO) (Fixed) (Total:465.76 GB) (Free:45.41 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 183DAD37)
Partition 1: (Active) - (Size=294 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-514082872832) - (Type=OF Extended)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 932 GB) (Disk ID: CBCE2081)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)

========================================================
Disk: 6 (Size: 466 GB) (Disk ID: 9288BBD1)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber 08.02.2014 10:08
hi,
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Colorlight 08.02.2014 11:44
Hallo Schrauber,

hier das Log von Combofix:

Code:
ComboFix 14-02-05.02 - Admin 08.02.2014  11:11:10.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.7669.6010 [GMT 1:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Admin\AppData\Local\lame_enc.dll
c:\users\Admin\AppData\Local\no23xwrapper.dll
c:\users\Admin\AppData\Local\ogg.dll
c:\users\Admin\AppData\Local\vorbis.dll
c:\users\Admin\AppData\Local\vorbisenc.dll
c:\users\Admin\AppData\Local\vorbisfile.dll
d:\portableapps\PStart\PStart.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-01-08 bis 2014-02-08  ))))))))))))))))))))))))))))))
.
.
2014-02-08 10:19 . 2014-02-08 10:19        --------        d-----w-        c:\users\Julien\AppData\Local\temp
2014-02-08 10:19 . 2014-02-08 10:19        --------        d-----w-        c:\users\Jeremy\AppData\Local\temp
2014-02-08 10:19 . 2014-02-08 10:19        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-02-08 10:19 . 2014-02-08 10:19        --------        d-----w-        c:\users\Heiko\AppData\Local\temp
2014-02-08 02:15 . 2014-02-08 02:17        --------        d-----w-        C:\FRST
2014-02-08 01:52 . 2014-02-08 01:52        --------        d-----w-        c:\users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 01:52 . 2014-02-08 01:52        --------        d-----w-        c:\programdata\Malwarebytes
2014-02-08 01:52 . 2014-02-08 01:52        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2014-02-08 01:52 . 2013-04-04 13:50        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys
2014-02-08 00:05 . 2014-02-08 00:05        --------        d-----w-        c:\programdata\Kaspersky Lab
2014-02-07 23:39 . 2014-02-07 23:39        --------        d-----w-        c:\programdata\Sophos
2014-02-07 23:39 . 2014-02-07 23:39        73728        ----a-r-        c:\users\Heiko\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe1_810EDD9E2F0A4E2BACF86673C38D9F48.exe
2014-02-07 23:39 . 2014-02-07 23:39        73728        ----a-r-        c:\users\Heiko\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe_810EDD9E2F0A4E2BACF86673C38D9F48.exe
2014-02-07 23:39 . 2014-02-07 23:39        73728        ----a-r-        c:\users\Heiko\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\ARPPRODUCTICON.exe
2014-02-07 23:39 . 2014-02-07 23:39        --------        d-----w-        c:\program files (x86)\Sophos
2014-02-07 22:27 . 2014-02-07 22:27        --------        d-----w-        c:\users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 20:31 . 2013-12-04 03:28        10315576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{E5A589F3-ECFB-402F-8037-5C6AB3177B37}\mpengine.dll
2014-02-05 23:33 . 2014-02-08 01:02        --------        d---a-w-        C:\temp
2014-02-05 09:25 . 2014-02-05 09:25        --------        d-----w-        c:\users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 09:20 . 2014-02-07 18:58        --------        d-----w-        c:\programdata\Sirrix AG
2014-02-05 09:18 . 2011-12-21 12:15        219440        ----a-w-        c:\windows\system32\drivers\VBoxDrv.sys
2014-02-05 09:18 . 2011-12-21 12:15        44848        ----a-w-        c:\windows\system32\drivers\VBoxUSBMon.sys
2014-02-05 09:18 . 2014-02-05 09:18        --------        d-----w-        c:\program files\Oracle
2014-02-03 14:11 . 2014-02-03 14:12        --------        d-----w-        c:\users\Jamie
2014-02-03 13:07 . 2014-02-03 13:07        --------        d-----w-        c:\users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 19:57 . 2008-03-05 15:03        238088        ----a-w-        c:\windows\SysWow64\xactengine3_0.dll
2014-02-02 19:09 . 2014-02-02 20:41        --------        d-----w-        c:\program files (x86)\Common Files\Steam
2014-02-02 19:09 . 2014-02-07 23:49        --------        d-----w-        c:\program files (x86)\Steam
2014-01-15 16:55 . 2013-11-27 01:41        53248        ----a-w-        c:\windows\system32\drivers\usbehci.sys
2014-01-15 16:55 . 2013-11-27 01:41        325120        ----a-w-        c:\windows\system32\drivers\usbport.sys
2014-01-15 16:55 . 2013-11-27 01:41        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys
2014-01-15 16:55 . 2013-11-27 01:41        99840        ----a-w-        c:\windows\system32\drivers\usbccgp.sys
2014-01-15 16:55 . 2013-11-27 01:41        25600        ----a-w-        c:\windows\system32\drivers\usbohci.sys
2014-01-15 16:55 . 2013-11-27 01:41        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys
2014-01-15 16:55 . 2013-11-27 01:41        7808        ----a-w-        c:\windows\system32\drivers\usbd.sys
2014-01-15 16:55 . 2013-11-26 10:32        3156480        ----a-w-        c:\windows\system32\win32k.sys
2014-01-15 16:55 . 2013-11-26 11:40        376768        ----a-w-        c:\windows\system32\drivers\netio.sys
2014-01-14 15:34 . 2014-01-14 15:34        --------        d-----w-        c:\users\Admin\AppData\Roaming\AVAST Software
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-04 21:26 . 2013-02-20 06:36        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-04 21:26 . 2013-02-20 06:36        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-16 02:00 . 2013-02-20 06:37        86054176        ----a-w-        c:\windows\system32\MRT.exe
2013-12-18 05:13 . 2010-11-21 03:27        270496        ------w-        c:\windows\system32\MpSigStub.exe
2013-11-27 21:44 . 2013-04-24 18:13        65776        ----a-w-        c:\windows\system32\drivers\aswRvrt.sys
2013-11-27 21:44 . 2013-04-24 18:13        205320        ----a-w-        c:\windows\system32\drivers\aswVmm.sys
2013-11-27 21:44 . 2013-02-20 08:25        409832        ----a-w-        c:\windows\system32\drivers\aswSP.sys
2013-11-27 21:44 . 2013-02-20 08:25        38984        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys
2013-11-27 21:44 . 2013-02-20 08:25        92544        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys
2013-11-27 21:44 . 2013-02-20 08:25        65264        ----a-w-        c:\windows\system32\drivers\aswTdi.sys
2013-11-27 21:44 . 2013-02-20 08:25        1032416        ----a-w-        c:\windows\system32\drivers\aswSnx.sys
2013-11-27 21:44 . 2013-02-20 08:25        84328        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys
2013-11-27 21:44 . 2013-02-20 08:25        334648        ----a-w-        c:\windows\system32\aswBoot.exe
2013-11-27 21:44 . 2013-02-20 08:19        43152        ----a-w-        c:\windows\avastSS.scr
2013-11-26 11:54 . 2013-12-13 02:01        23183360        ----a-w-        c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-13 02:01        2724864        ----a-w-        c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-13 02:01        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-13 02:01        66048        ----a-w-        c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-13 02:01        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-13 02:01        2764288        ----a-w-        c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-13 02:01        53760        ----a-w-        c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-13 02:01        33792        ----a-w-        c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-13 02:01        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-13 02:01        574976        ----a-w-        c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-13 02:01        139264        ----a-w-        c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-13 02:01        111616        ----a-w-        c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-13 02:01        708608        ----a-w-        c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-13 02:01        218624        ----a-w-        c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-13 02:01        5769216        ----a-w-        c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-13 02:01        553472        ----a-w-        c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-13 02:01        4243968        ----a-w-        c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-13 02:01        1995264        ----a-w-        c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-13 02:01        12996608        ----a-w-        c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-13 02:01        1928192        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-13 02:01        2334208        ----a-w-        c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-13 02:01        1395200        ----a-w-        c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-13 02:01        817664        ----a-w-        c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-13 02:01        1820160        ----a-w-        c:\windows\SysWow64\wininet.dll
2013-11-23 18:26 . 2013-12-12 03:27        417792        ----a-w-        c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 03:27        465920        ----a-w-        c:\windows\system32\WMPhoto.dll
2013-11-13 02:02 . 2013-11-13 02:02        940032        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-13 02:02 . 2013-11-13 02:02        194048        ----a-w-        c:\windows\SysWow64\elshyph.dll
2013-11-13 02:02 . 2013-11-13 02:02        942592        ----a-w-        c:\windows\system32\jsIntl.dll
2013-11-13 02:02 . 2013-11-13 02:02        90112        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2013-11-13 02:02 . 2013-11-13 02:02        86016        ----a-w-        c:\windows\SysWow64\iesysprep.dll
2013-11-13 02:02 . 2013-11-13 02:02        86016        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2013-11-13 02:02 . 2013-11-13 02:02        84992        ----a-w-        c:\windows\system32\mshtmled.dll
2013-11-13 02:02 . 2013-11-13 02:02        83968        ----a-w-        c:\windows\system32\MshtmlDac.dll
2013-11-13 02:02 . 2013-11-13 02:02        81408        ----a-w-        c:\windows\system32\icardie.dll
2013-11-13 02:02 . 2013-11-13 02:02        774144        ----a-w-        c:\windows\system32\jscript.dll
2013-11-13 02:02 . 2013-11-13 02:02        77312        ----a-w-        c:\windows\system32\tdc.ocx
2013-11-13 02:02 . 2013-11-13 02:02        74240        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-13 02:02 . 2013-11-13 02:02        71680        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-13 02:02 . 2013-11-13 02:02        645120        ----a-w-        c:\windows\SysWow64\jsIntl.dll
2013-11-13 02:02 . 2013-11-13 02:02        626176        ----a-w-        c:\windows\system32\msfeeds.dll
2013-11-13 02:02 . 2013-11-13 02:02        62464        ----a-w-        c:\windows\SysWow64\tdc.ocx
2013-11-13 02:02 . 2013-11-13 02:02        62464        ----a-w-        c:\windows\system32\pngfilt.dll
2013-11-13 02:02 . 2013-11-13 02:02        61952        ----a-w-        c:\windows\SysWow64\MshtmlDac.dll
2013-11-13 02:02 . 2013-11-13 02:02        61952        ----a-w-        c:\windows\SysWow64\iesetup.dll
2013-11-13 02:02 . 2013-11-13 02:02        616104        ----a-w-        c:\windows\system32\ieapfltr.dat
2013-11-13 02:02 . 2013-11-13 02:02        548352        ----a-w-        c:\windows\system32\vbscript.dll
2013-11-13 02:02 . 2013-11-13 02:02        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll
2013-11-13 02:02 . 2013-11-13 02:02        51200        ----a-w-        c:\windows\SysWow64\ieetwproxystub.dll
2013-11-13 02:02 . 2013-11-13 02:02        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2013-11-13 02:02 . 2013-11-13 02:02        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2013-11-13 02:02 . 2013-11-13 02:02        48128        ----a-w-        c:\windows\system32\imgutil.dll
2013-11-13 02:02 . 2013-11-13 02:02        454656        ----a-w-        c:\windows\SysWow64\vbscript.dll
2013-11-13 02:02 . 2013-11-13 02:02        453120        ----a-w-        c:\windows\system32\dxtmsft.dll
2013-11-13 02:02 . 2013-11-13 02:02        413696        ----a-w-        c:\windows\system32\html.iec
2013-11-13 02:02 . 2013-11-13 02:02        40448        ----a-w-        c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-13 02:02 . 2013-11-13 02:02        36352        ----a-w-        c:\windows\SysWow64\imgutil.dll
2013-11-13 02:02 . 2013-11-13 02:02        34816        ----a-w-        c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-13 02:02 . 2013-11-13 02:02        337408        ----a-w-        c:\windows\SysWow64\html.iec
2013-11-13 02:02 . 2013-11-13 02:02        30208        ----a-w-        c:\windows\system32\licmgr10.dll
2013-11-13 02:02 . 2013-11-13 02:02        296960        ----a-w-        c:\windows\system32\dxtrans.dll
2013-11-13 02:02 . 2013-11-13 02:02        263376        ----a-w-        c:\windows\system32\iedkcs32.dll
2013-11-13 02:02 . 2013-11-13 02:02        247808        ----a-w-        c:\windows\system32\msls31.dll
2013-11-13 02:02 . 2013-11-13 02:02        24576        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2013-11-13 02:02 . 2013-11-13 02:02        243200        ----a-w-        c:\windows\system32\webcheck.dll
2013-11-13 02:02 . 2013-11-13 02:02        235520        ----a-w-        c:\windows\system32\url.dll
2013-11-13 02:02 . 2013-11-13 02:02        235008        ----a-w-        c:\windows\system32\elshyph.dll
2013-11-13 02:02 . 2013-11-13 02:02        195584        ----a-w-        c:\windows\system32\msrating.dll
2013-11-13 02:02 . 2013-11-13 02:02        182272        ----a-w-        c:\windows\SysWow64\msls31.dll
2013-11-13 02:02 . 2013-11-13 02:02        167424        ----a-w-        c:\windows\system32\iexpress.exe
2013-11-13 02:02 . 2013-11-13 02:02        151552        ----a-w-        c:\windows\SysWow64\iexpress.exe
2013-11-13 02:02 . 2013-11-13 02:02        147968        ----a-w-        c:\windows\system32\occache.dll
2013-11-13 02:02 . 2013-11-13 02:02        143872        ----a-w-        c:\windows\system32\wextract.exe
2013-11-13 02:02 . 2013-11-13 02:02        139264        ----a-w-        c:\windows\SysWow64\wextract.exe
2013-11-13 02:02 . 2013-11-13 02:02        13824        ----a-w-        c:\windows\system32\mshta.exe
2013-11-13 02:02 . 2013-11-13 02:02        135680        ----a-w-        c:\windows\system32\iepeers.dll
2013-11-13 02:02 . 2013-11-13 02:02        13312        ----a-w-        c:\windows\SysWow64\mshta.exe
2013-11-13 02:02 . 2013-11-13 02:02        13312        ----a-w-        c:\windows\system32\msfeedssync.exe
2013-11-13 02:02 . 2013-11-13 02:02        131072        ----a-w-        c:\windows\system32\IEAdvpack.dll
2013-11-13 02:02 . 2013-11-13 02:02        1228800        ----a-w-        c:\windows\system32\mshtmlmedia.dll
2013-11-13 02:02 . 2013-11-13 02:02        112128        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2013-11-13 02:02 . 2013-11-13 02:02        111616        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2013-11-13 02:02 . 2013-11-13 02:02        105984        ----a-w-        c:\windows\system32\iesysprep.dll
2013-11-13 02:02 . 2013-11-13 02:02        1051136        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll
2013-11-13 02:02 . 2013-11-13 02:02        101376        ----a-w-        c:\windows\system32\inseng.dll
2013-11-12 02:23 . 2013-12-12 03:26        2048        ----a-w-        c:\windows\system32\tzres.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-11-27 3568312]
.
c:\users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Core Temp.lnk - c:\program files\Core Temp\Core Temp.exe [2013-7-6 856016]
PortableAppsPlatform.exe - Verknüpfung.lnk - c:\portableapps\PortableApps.com\PortableAppsPlatform.exe [2013-2-23 2713672]
XMediaGrabber.lnk - c:\program files (x86)\XMediaGrabber\XMediaGrabber.exe [2013-2-22 37888]
.
c:\users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\
FreeNFS.lnk - d:\portableapps\FreeNFS\FreeNFS.exe [2013-7-25 498176]
SynkronPortable.lnk - c:\portableapps\SynkronPortable\SynkronPortable.exe [2011-3-16 134776]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.130\SSScheduler.exe [2013-9-6 324320]
phase-6 Reminder.lnk - c:\program files (x86)\phase-6\phase-6\reminder\reminder.exe [2013-6-21 724992]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\
Core Temp.lnk - c:\program files\Core Temp\Core Temp.exe [2013-7-6 856016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0SmartDefragBootTime.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 ALSysIO;ALSysIO;c:\users\Admin\AppData\Local\Temp\ALSysIO64.sys;c:\users\Admin\AppData\Local\Temp\ALSysIO64.sys [x]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 MsgPlusService;Messenger Plus! Service;c:\program files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe;c:\program files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [x]
R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R4 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
R4 tvnserver;TightVNC Server;c:\program files\TightVNC\tvnserver.exe;c:\program files\TightVNC\tvnserver.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys;c:\windows\SYSNATIVE\drivers\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 SuRunSVC;Super User Run (SuRun) Service;c:\windows\SuRun.exe;c:\windows\SuRun.exe [x]
S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\amdhub30.sys;c:\windows\SYSNATIVE\DRIVERS\amdhub30.sys [x]
S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\amdxhc.sys;c:\windows\SYSNATIVE\DRIVERS\amdxhc.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 dvdfab;dvdfab;c:\windows\system32\drivers\dvdfab.sys;c:\windows\SYSNATIVE\drivers\dvdfab.sys [x]
S3 MsgPlusDriver;Messenger Plus! Virtual Camera;c:\windows\system32\DRIVERS\MsgPlusDriver.sys;c:\windows\SYSNATIVE\DRIVERS\MsgPlusDriver.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-20 21:26]
.
2014-02-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core.job
- c:\users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-05 07:37]
.
2014-02-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA.job
- c:\users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-05 07:37]
.
2014-02-07 c:\windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
- c:\program files (x86)\XMediaGrabber\XMGTimerStartupScheduler.exe [2013-02-22 12:40]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-11-27 21:44        326944        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HardLinkMenu]
@="{0A479751-02BC-11d3-A855-0004AC2568AA}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568AA}]
2012-05-27 19:50        522440        ----a-w-        c:\program files\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHardLink]
@="{0A479751-02BC-11d3-A855-0004AC2568DD}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568DD}]
2012-05-27 19:50        522440        ----a-w-        c:\program files\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlaySymbolicLink]
@="{0A479751-02BC-11d3-A855-0004AC2568EE}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568EE}]
2012-05-27 19:50        522440        ----a-w-        c:\program files\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-08-30 7284328]
"fssui"="c:\program files (x86)\Windows Live\Family Safety\fsui.exe" [2012-09-12 892416]
"SuRun Systemmenü-Erweiterung"="c:\windows\SuRun.exe" [2013-07-03 727552]
"tvncontrol"="c:\program files\TightVNC\tvnserver.exe" [2013-07-19 2179056]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{2C7B6088-5A77-4d48-BE43-30337DCA9A86}"= "SuRunExt.dll" [2013-07-03 189952]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: Interfaces\{57F85748-9E1C-49A3-89C9-3715B55FD919}: NameServer = 192.168.1.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
c:\users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PStart - Verknüpfung.lnk - d:\portableapps\PStart\PStart.exe
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PStart - Verknüpfung.lnk - d:\portableapps\PStart\PStart.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-02-08  11:24:05
ComboFix-quarantined-files.txt  2014-02-08 10:24
.
Vor Suchlauf: 15 Verzeichnis(se), 229.847.916.544 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 230.975.238.144 Bytes frei
.
- - End Of File - - B10931FE20B238A09E8E93CB99F96A17
A36C5E4F47E84449FF07ED3517B43A31

schrauber 09.02.2014 08:48
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

Colorlight 09.02.2014 15:56
Hier die gewünschten Logs:

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.09.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Admin :: VINCENTS-PC [Administrator]

09.02.2014 15:03:36
mbam-log-2014-02-09 (15-03-36).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 314798
Laufzeit: 4 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
# AdwCleaner v3.018 - Bericht erstellt am 09/02/2014 um 15:15:20
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Admin - VINCENTS-PC
# Gestartet von : C:\Users\Admin\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Datei Gelöscht : C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\bxj6o4g7.default-1366913149784\Extensions\browserprotect@browserprotect.com.xpi
Datei Gelöscht : C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.default2\Extensions\browserprotect@browserprotect.com.xpi
Datei Gelöscht : C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\bxj6o4g7.default-1366913149784\searchplugins\bingp.xml

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\smartbar
Schlüssel Gelöscht : HKLM\Software\Freeze.com

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\prefs.js ]


[ Datei : C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\bxj6o4g7.default-1366913149784\prefs.js ]

Zeile gelöscht : user_pref("extensions.browserprotect.searchProviderExceptions", "hxxp://en.wikipedia.org/wiki/Special:Search;hxxp://search.yahoo.com/search;hxxp://www.amazon.com/exec/obidos/external-search/;hxxp://ww[...]

[ Datei : C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.default2\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultenginename", "QIP Search");
Zeile gelöscht : user_pref("extensions.browserprotect.searchProviderExceptions", "hxxp://en.wikipedia.org/wiki/Special:Search;hxxp://search.yahoo.com/search;hxxp://www.amazon.com/exec/obidos/external-search/;hxxp://ww[...]
Zeile gelöscht : user_pref("extensions.browserprotect.urlBarEngine", "hxxp://search.qip.ru/search?from=FF&query=");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.qip.ru/search?from=FF&query=");

[ Datei : C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\pwb30e1g.default\prefs.js ]


[ Datei : C:\Users\Julien\AppData\Roaming\Mozilla\Firefox\Profiles\j4ewmmn2.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [2575 octets] - [09/02/2014 15:11:45]
AdwCleaner[S0].txt - [2500 octets] - [09/02/2014 15:15:20]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2560 octets] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Home Premium x64
Ran by Admin on 09.02.2014 at 15:29:53,95
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Successfully stopped: [Service] msgplusservice
Successfully deleted: [Service] msgplusservice



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{37211D63-CCE9-4780-B182-96538CFC6FED}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{8B9C4F32-044E-491C-893E-362CB8A679D5}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CBC3E05C-F841-452A-A600-E8D8BBEA63D9}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CBC3E05D-F841-452A-A600-E8D8BBEA63DA}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CF2BF214-9D1E-4803-9AEB-38552615FD40}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\yuna software
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\msgplusforskype.animationpackage
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\msgplusforskype.skinpack
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\msgplusforskype.soundpack
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\plusskypeservice_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\messenger plus! for skype



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\messenger plus! for skype"
Successfully deleted: [Folder] "C:\Users\Admin\appdata\local\cre"
Successfully deleted: [Folder] "C:\Program Files (x86)\yuna software"



~~~ FireFox

Emptied folder: C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\k9c3t3zj.default\minidumps [6 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.02.2014 at 15:38:01,87
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-02-2014
Ran by Admin (administrator) on VINCENTS-PC on 09-02-2014 15:47:04
Running from C:\Users\Admin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun32.bin
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7284328 2011-08-30] (Realtek Semiconductor)
HKLM\...\Run: [fssui] - C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [892416 2012-09-12] (Microsoft Corporation)
HKLM\...\Run: [SuRun Systemmenü-Erweiterung] - C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
HKLM\...\Run: [tvncontrol] - C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-27] (AVAST Software)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.lnk
ShortcutTarget: Core Temp.lnk -> C:\Program Files\Core Temp\Core Temp.exe ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PortableAppsPlatform.exe - Verknüpfung.lnk
ShortcutTarget: PortableAppsPlatform.exe - Verknüpfung.lnk -> C:\PortableApps\PortableApps.com\PortableAppsPlatform.exe (PortableApps.com)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XMediaGrabber.lnk
ShortcutTarget: XMediaGrabber.lnk -> C:\Program Files (x86)\XMediaGrabber\XMediaGrabber.exe (hxxp://www.xmediagrabber.de)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x163759EBE10ECE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0F4C14C4-945D-4990-9388-A3C7A2E9336F} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKLM-x32 - {94AE0E02-5D76-4244-8B5F-783BD0CA7D76} URL = hxxp://www.bing.com/?cc=de
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: No Name - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks: SuRun Shell Extension - {2C7B6088-5A77-4d48-BE43-30337DCA9A86} - C:\Windows\SuRunExt.dll [189952 2013-07-03] (hxxp://kay-bruns.de)
Tcpip\..\Interfaces\{57F85748-9E1C-49A3-89C9-3715B55FD919}: [NameServer]192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NoScript - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-08]
FF Extension: Adblock Plus - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-08]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-02-20]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-27] (AVAST Software)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 SuRunSVC; C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
S4 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-27] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-27] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-27] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-27] ()
R3 dvdfab; C:\Windows\System32\drivers\dvdfab.sys [79232 2011-08-15] (Fengtao Software Inc.)
R3 MsgPlusDriver; C:\Windows\System32\DRIVERS\MsgPlusDriver.sys [125392 2013-05-07] (Yune Software)
S3 ALSysIO; \??\C:\Users\Admin\AppData\Local\Temp\ALSysIO64.sys [X]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-09 15:47 - 2014-02-09 15:47 - 00011301 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-09 15:44 - 2014-02-09 15:44 - 00000000 ____D () C:\Users\Admin\Downloads\FRST-OlderVersion
2014-02-09 15:38 - 2014-02-09 15:38 - 00002209 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-02-09 15:29 - 2014-02-09 15:29 - 00000000 ____D () C:\Windows\ERUNT
2014-02-09 15:28 - 2014-02-09 15:28 - 01037530 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2014-02-09 15:11 - 2014-02-09 15:15 - 00000000 ____D () C:\AdwCleaner
2014-02-09 15:10 - 2014-02-09 15:10 - 01166132 _____ () C:\Users\Admin\Downloads\adwcleaner.exe
2014-02-09 02:31 - 2014-02-09 02:31 - 10779656 ____N (Marek Jasinski) C:\Users\Admin\Downloads\SandboxFreeCommander.cameyo.exe
2014-02-08 21:24 - 2014-02-08 21:24 - 00001142 _____ () C:\Users\Admin\Desktop\FreeCommander - Verknüpfung.lnk
2014-02-08 20:54 - 2014-02-08 20:54 - 00000000 ____D () C:\Users\Admin\Downloads\Jamie
2014-02-08 20:52 - 2014-02-08 20:52 - 00000000 ____D () C:\Users\Admin\Downloads\Jeremy
2014-02-08 20:29 - 2014-02-08 20:30 - 00000000 ____D () C:\Users\Admin\Downloads\Julien
2014-02-08 18:31 - 2014-02-08 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Local\Cameyo
2014-02-08 18:24 - 2014-02-08 19:05 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\VOS
2014-02-08 18:19 - 2014-02-08 18:20 - 18807821 _____ (Cameyo) C:\Users\Admin\Downloads\Cameyo.exe
2014-02-08 11:24 - 2014-02-08 11:24 - 00028654 _____ () C:\ComboFix.txt
2014-02-08 11:08 - 2014-02-08 11:24 - 00000000 ____D () C:\Qoobox
2014-02-08 11:08 - 2014-02-08 11:22 - 00000000 ____D () C:\Windows\erdnt
2014-02-08 11:08 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-08 11:08 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-08 11:08 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-08 11:04 - 2014-02-08 11:04 - 05180173 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-02-08 05:10 - 2014-02-08 05:10 - 589632224 _____ () C:\Windows\MEMORY.DMP
2014-02-08 05:10 - 2014-02-08 05:10 - 00455520 _____ () C:\Windows\Minidump\020814-14726-01.dmp
2014-02-08 03:26 - 2014-02-08 03:26 - 00380416 _____ () C:\Users\Admin\Downloads\2euv8v11.exe
2014-02-08 03:15 - 2014-02-09 15:47 - 00000000 ____D () C:\FRST
2014-02-08 03:14 - 2014-02-09 15:44 - 02170368 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:52 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-08 02:47 - 2014-02-08 02:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:33 - 2014-02-08 00:37 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:32 - 2014-02-08 00:41 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 20:18 - 2014-02-08 00:12 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:20 - 2014-02-07 19:58 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 10:18 - 2011-12-21 13:15 - 00219440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2014-02-05 10:18 - 2011-12-21 13:15 - 00044848 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:11 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 15:11 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-02-03 15:11 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 20:58 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2014-02-02 20:58 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2014-02-02 20:58 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2014-02-02 20:57 - 2014-02-02 20:58 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:57 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2014-02-02 20:57 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2014-02-02 20:57 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-02-02 20:57 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-02-02 20:57 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-02-02 20:57 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-02-02 20:57 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-02-02 20:57 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-02-02 20:57 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-02-02 20:57 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-02-02 20:57 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-02-02 20:57 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-08 00:49 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:07 - 2014-02-02 20:08 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-01-17 06:11 - 2014-01-17 06:12 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:11 - 2014-01-17 06:12 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:11 - 2014-01-17 06:12 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-15 17:55 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 17:55 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 17:55 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software

==================== One Month Modified Files and Folders =======

2014-02-09 15:47 - 2014-02-09 15:47 - 00011301 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-09 15:47 - 2014-02-08 03:15 - 00000000 ____D () C:\FRST
2014-02-09 15:46 - 2013-04-22 19:37 - 00000680 __RSH () C:\Users\Admin\ntuser.pol
2014-02-09 15:46 - 2013-02-19 21:23 - 00000000 ____D () C:\Users\Admin
2014-02-09 15:45 - 2013-03-30 01:05 - 00039317 _____ () C:\Windows\setupact.log
2014-02-09 15:45 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-09 15:44 - 2014-02-09 15:44 - 00000000 ____D () C:\Users\Admin\Downloads\FRST-OlderVersion
2014-02-09 15:44 - 2014-02-08 03:14 - 02170368 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-09 15:44 - 2013-02-19 19:18 - 01453937 _____ () C:\Windows\WindowsUpdate.log
2014-02-09 15:38 - 2014-02-09 15:38 - 00002209 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-02-09 15:29 - 2014-02-09 15:29 - 00000000 ____D () C:\Windows\ERUNT
2014-02-09 15:29 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-09 15:29 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-09 15:28 - 2014-02-09 15:28 - 01037530 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2014-02-09 15:26 - 2013-02-20 07:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-09 15:15 - 2014-02-09 15:11 - 00000000 ____D () C:\AdwCleaner
2014-02-09 15:10 - 2014-02-09 15:10 - 01166132 _____ () C:\Users\Admin\Downloads\adwcleaner.exe
2014-02-09 13:18 - 2013-04-16 18:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\Windows Live
2014-02-09 13:18 - 2013-02-20 09:25 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-09 02:31 - 2014-02-09 02:31 - 10779656 ____N (Marek Jasinski) C:\Users\Admin\Downloads\SandboxFreeCommander.cameyo.exe
2014-02-08 21:24 - 2014-02-08 21:24 - 00001142 _____ () C:\Users\Admin\Desktop\FreeCommander - Verknüpfung.lnk
2014-02-08 20:54 - 2014-02-08 20:54 - 00000000 ____D () C:\Users\Admin\Downloads\Jamie
2014-02-08 20:52 - 2014-02-08 20:52 - 00000000 ____D () C:\Users\Admin\Downloads\Jeremy
2014-02-08 20:30 - 2014-02-08 20:29 - 00000000 ____D () C:\Users\Admin\Downloads\Julien
2014-02-08 19:05 - 2014-02-08 18:24 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\VOS
2014-02-08 18:31 - 2014-02-08 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Local\Cameyo
2014-02-08 18:20 - 2014-02-08 18:19 - 18807821 _____ (Cameyo) C:\Users\Admin\Downloads\Cameyo.exe
2014-02-08 11:38 - 2013-04-05 04:12 - 00027990 _____ () C:\Windows\PFRO.log
2014-02-08 11:24 - 2014-02-08 11:24 - 00028654 _____ () C:\ComboFix.txt
2014-02-08 11:24 - 2014-02-08 11:08 - 00000000 ____D () C:\Qoobox
2014-02-08 11:22 - 2014-02-08 11:08 - 00000000 ____D () C:\Windows\erdnt
2014-02-08 11:22 - 2013-02-22 19:02 - 00000000 ___RD () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 11:22 - 2013-02-19 21:23 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 11:21 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-08 11:04 - 2014-02-08 11:04 - 05180173 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-02-08 05:10 - 2014-02-08 05:10 - 589632224 _____ () C:\Windows\MEMORY.DMP
2014-02-08 05:10 - 2014-02-08 05:10 - 00455520 _____ () C:\Windows\Minidump\020814-14726-01.dmp
2014-02-08 05:10 - 2013-03-25 07:31 - 00000000 ____D () C:\Windows\Minidump
2014-02-08 03:26 - 2014-02-08 03:26 - 00380416 _____ () C:\Users\Admin\Downloads\2euv8v11.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:48 - 2014-02-08 02:47 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 02:10 - 2013-02-20 08:04 - 00000000 ____D () C:\Users\Admin\AppData\Local\Mozilla
2014-02-08 02:03 - 2013-08-05 08:37 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA.job
2014-02-08 02:03 - 2013-08-05 08:37 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core.job
2014-02-08 01:58 - 2013-08-05 08:37 - 00003918 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA
2014-02-08 01:58 - 2013-08-05 08:37 - 00003550 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:49 - 2014-02-02 20:09 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-08 00:41 - 2014-02-08 00:32 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:37 - 2014-02-08 00:33 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:12 - 2014-02-07 20:18 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-08 00:12 - 2013-08-16 19:19 - 00000000 ____D () C:\Users\Heiko\.xmg
2014-02-08 00:12 - 2013-04-16 18:21 - 00000680 __RSH () C:\Users\Heiko\ntuser.pol
2014-02-08 00:12 - 2013-02-22 19:01 - 00000000 ____D () C:\Users\Heiko
2014-02-07 23:41 - 2013-02-24 22:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\XBMC
2014-02-07 23:32 - 2013-08-25 00:42 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:17 - 2013-12-22 14:59 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\Skype
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 21:13 - 2013-04-16 18:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Windows Live
2014-02-07 19:58 - 2014-02-05 10:20 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-07 09:48 - 2013-08-29 17:05 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{12489FB2-B57C-4A9C-8F29-2291A874BC82}
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 08:01 - 2013-12-20 07:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-04 22:26 - 2013-02-20 07:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 22:26 - 2013-02-20 07:36 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 22:26 - 2013-02-20 07:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 19:28 - 2013-04-22 19:35 - 00022330 __RSH () C:\Users\Julien\ntuser.pol
2014-02-03 19:28 - 2013-04-22 19:35 - 00000000 ____D () C:\Users\Julien
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:12 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 21:40 - 2013-04-16 18:26 - 00004682 __RSH () C:\Users\Jeremy\ntuser.pol
2014-02-02 21:40 - 2013-02-28 18:40 - 00000000 ____D () C:\Users\Jeremy
2014-02-02 20:58 - 2014-02-02 20:57 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:08 - 2014-02-02 20:07 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-02-02 19:45 - 2013-03-17 21:09 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\.minecraft
2014-02-01 08:52 - 2013-04-22 19:37 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\.minecraft
2014-01-25 19:44 - 2013-11-16 21:58 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Skype
2014-01-17 06:12 - 2014-01-17 06:11 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:12 - 2014-01-17 06:11 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:12 - 2014-01-17 06:11 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 20:18 - 2010-11-21 07:50 - 00697160 _____ () C:\Windows\system32\perfh007.dat
2014-01-16 20:18 - 2010-11-21 07:50 - 00148642 _____ () C:\Windows\system32\perfc007.dat
2014-01-16 20:18 - 2009-07-14 06:13 - 01613340 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-16 03:19 - 2009-07-14 05:45 - 00276968 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:03 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-16 03:00 - 2013-02-20 07:37 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-14 14:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-14 12:25 - 2013-02-20 08:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-08 05:39

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 10.02.2014 10:15

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Colorlight 11.02.2014 08:23
Hallo Schrauber,

hier die Logs der letzten Nacht:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=7df079b1324f2d4f920512ea0694230c
# engine=17018
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-10 11:27:56
# local_time=2014-02-11 12:27:56 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 83 6486091 168781148 0 0
# compatibility_mode=5893 16776573 100 94 119244 143704726 0 0
# scanned=634425
# found=6
# cleaned=0
# scan_time=14999
sh=0A7A819A37F7DECC122BEE248C22D6F7E4F38B57 ft=1 fh=a37716ba891ceb75 vn="Win32/CoinMiner.KX trojan" ac=I fn="C:\temp:1011F76C.dat"
sh=293E9FD449441B6157F4253B14BC1C4FE6B20394 ft=1 fh=a37716ba6f24d9f4 vn="a variant of Win32/Injector.AXBQ trojan" ac=I fn="C:\temp:1319E5C0.dat"
sh=BB4C1C887BEB20333EF68B8D2F743C3DBDD581B0 ft=1 fh=619666096b676d4b vn="a variant of Win32/Injector.AXGJ trojan" ac=I fn="C:\temp:1A00BB4B.dat"
sh=0A7A819A37F7DECC122BEE248C22D6F7E4F38B57 ft=1 fh=a37716ba891ceb75 vn="Win32/CoinMiner.KX trojan" ac=I fn="C:\temp\fbsgen.dat"
sh=93B0442BBB2FFBDC303DDB8B854A00098B4A8ED0 ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.AN trojan" ac=I fn="C:\Users\Heiko\Downloads\_x3\YAIX3T 1.0.4.1.zip"
sh=2483ED987A0C85B80495BB0082BC33B03F76D64F ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.AN trojan" ac=I fn="C:\Users\Heiko\Downloads\_x3\YAIX3T\Root\zergRush"
Code:
Results of screen317's Security Check version 0.99.79 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware Version 1.75.0.1300 
 Java 7 Update 45 
 Java version out of Date!
 Adobe Flash Player 11.9.900.170 
 Mozilla Firefox (26.0)
````````Process Check: objlist.exe by Laurent```````` 
 AVAST Software Avast AvastSvc.exe 
 AVAST Software Avast AvastUI.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-02-2014 01
Ran by Admin (administrator) on VINCENTS-PC on 11-02-2014 08:18:23
Running from C:\Users\Admin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun32.bin
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(PortableApps.com) C:\PortableApps\PortableApps.com\PortableAppsPlatform.exe
(Marek Jasinski) D:\PortableApps\FreeCommanderXE\FreeCommander.exe
(Nenad Hrg (SoftwareOK.com)) C:\PortableApps\DontSleepPortable\DontSleepPortable.exe
(Marek Jasinski) D:\PortableApps\FreeCommanderXE\FcContextMenu64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7284328 2011-08-30] (Realtek Semiconductor)
HKLM\...\Run: [fssui] - C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [892416 2012-09-12] (Microsoft Corporation)
HKLM\...\Run: [SuRun Systemmenü-Erweiterung] - C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
HKLM\...\Run: [tvncontrol] - C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-27] (AVAST Software)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.lnk
ShortcutTarget: Core Temp.lnk -> C:\Program Files\Core Temp\Core Temp.exe ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PortableAppsPlatform.exe - Verknüpfung.lnk
ShortcutTarget: PortableAppsPlatform.exe - Verknüpfung.lnk -> C:\PortableApps\PortableApps.com\PortableAppsPlatform.exe (PortableApps.com)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XMediaGrabber.lnk
ShortcutTarget: XMediaGrabber.lnk -> C:\Program Files (x86)\XMediaGrabber\XMediaGrabber.exe (hxxp://www.xmediagrabber.de)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x163759EBE10ECE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0F4C14C4-945D-4990-9388-A3C7A2E9336F} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKLM-x32 - {94AE0E02-5D76-4244-8B5F-783BD0CA7D76} URL = hxxp://www.bing.com/?cc=de
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: No Name - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks: SuRun Shell Extension - {2C7B6088-5A77-4d48-BE43-30337DCA9A86} - C:\Windows\SuRunExt.dll [189952 2013-07-03] (hxxp://kay-bruns.de)
Tcpip\..\Interfaces\{57F85748-9E1C-49A3-89C9-3715B55FD919}: [NameServer]192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NoScript - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-08]
FF Extension: Adblock Plus - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-08]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-02-20]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-27] (AVAST Software)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 SuRunSVC; C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
S4 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-27] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-27] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-27] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-27] ()
R3 dvdfab; C:\Windows\System32\drivers\dvdfab.sys [79232 2011-08-15] (Fengtao Software Inc.)
R3 MsgPlusDriver; C:\Windows\System32\DRIVERS\MsgPlusDriver.sys [125392 2013-05-07] (Yune Software)
S3 ALSysIO; \??\C:\Users\Admin\AppData\Local\Temp\ALSysIO64.sys [X]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-11 08:18 - 2014-02-11 08:18 - 00011680 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-11 08:11 - 2014-02-11 08:11 - 00987425 _____ () C:\Users\Admin\Downloads\SecurityCheck.exe
2014-02-10 20:13 - 2014-02-10 20:14 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu.exe
2014-02-09 15:44 - 2014-02-11 08:18 - 00000000 ____D () C:\Users\Admin\Downloads\FRST-OlderVersion
2014-02-09 15:38 - 2014-02-09 15:38 - 00002209 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-02-09 15:29 - 2014-02-09 15:29 - 00000000 ____D () C:\Windows\ERUNT
2014-02-09 15:28 - 2014-02-09 15:28 - 01037530 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2014-02-09 15:11 - 2014-02-09 15:15 - 00000000 ____D () C:\AdwCleaner
2014-02-09 15:10 - 2014-02-09 15:10 - 01166132 _____ () C:\Users\Admin\Downloads\adwcleaner.exe
2014-02-09 02:31 - 2014-02-09 02:31 - 10779656 ____N (Marek Jasinski) C:\Users\Admin\Downloads\SandboxFreeCommander.cameyo.exe
2014-02-08 21:24 - 2014-02-08 21:24 - 00001142 _____ () C:\Users\Admin\Desktop\FreeCommander - Verknüpfung.lnk
2014-02-08 20:54 - 2014-02-08 20:54 - 00000000 ____D () C:\Users\Admin\Downloads\Jamie
2014-02-08 20:52 - 2014-02-08 20:52 - 00000000 ____D () C:\Users\Admin\Downloads\Jeremy
2014-02-08 20:29 - 2014-02-08 20:30 - 00000000 ____D () C:\Users\Admin\Downloads\Julien
2014-02-08 18:31 - 2014-02-08 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Local\Cameyo
2014-02-08 18:24 - 2014-02-08 19:05 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\VOS
2014-02-08 18:19 - 2014-02-08 18:20 - 18807821 _____ (Cameyo) C:\Users\Admin\Downloads\Cameyo.exe
2014-02-08 11:24 - 2014-02-08 11:24 - 00028654 _____ () C:\ComboFix.txt
2014-02-08 11:08 - 2014-02-08 11:24 - 00000000 ____D () C:\Qoobox
2014-02-08 11:08 - 2014-02-08 11:22 - 00000000 ____D () C:\Windows\erdnt
2014-02-08 11:08 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-08 11:08 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-08 11:08 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-08 11:04 - 2014-02-08 11:04 - 05180173 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-02-08 05:10 - 2014-02-08 05:10 - 589632224 _____ () C:\Windows\MEMORY.DMP
2014-02-08 05:10 - 2014-02-08 05:10 - 00455520 _____ () C:\Windows\Minidump\020814-14726-01.dmp
2014-02-08 03:26 - 2014-02-08 03:26 - 00380416 _____ () C:\Users\Admin\Downloads\2euv8v11.exe
2014-02-08 03:15 - 2014-02-11 08:18 - 00000000 ____D () C:\FRST
2014-02-08 03:14 - 2014-02-11 08:18 - 02151424 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:52 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-08 02:47 - 2014-02-08 02:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:33 - 2014-02-08 00:37 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:32 - 2014-02-08 00:41 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 20:18 - 2014-02-08 00:12 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:20 - 2014-02-07 19:58 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 10:18 - 2011-12-21 13:15 - 00219440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2014-02-05 10:18 - 2011-12-21 13:15 - 00044848 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:11 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 15:11 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-02-03 15:11 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 20:58 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2014-02-02 20:58 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2014-02-02 20:58 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2014-02-02 20:57 - 2014-02-02 20:58 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:57 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2014-02-02 20:57 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2014-02-02 20:57 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-02-02 20:57 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-02-02 20:57 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-02-02 20:57 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-02-02 20:57 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-02-02 20:57 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-02-02 20:57 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-02-02 20:57 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-02-02 20:57 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-02-02 20:57 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-08 00:49 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:07 - 2014-02-02 20:08 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-01-17 06:11 - 2014-01-17 06:12 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:11 - 2014-01-17 06:12 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:11 - 2014-01-17 06:12 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-15 17:55 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 17:55 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 17:55 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software

==================== One Month Modified Files and Folders =======

2014-02-11 08:18 - 2014-02-11 08:18 - 00011680 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-11 08:18 - 2014-02-09 15:44 - 00000000 ____D () C:\Users\Admin\Downloads\FRST-OlderVersion
2014-02-11 08:18 - 2014-02-08 03:15 - 00000000 ____D () C:\FRST
2014-02-11 08:18 - 2014-02-08 03:14 - 02151424 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-11 08:11 - 2014-02-11 08:11 - 00987425 _____ () C:\Users\Admin\Downloads\SecurityCheck.exe
2014-02-11 07:56 - 2013-04-16 18:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\Windows Live
2014-02-11 07:42 - 2013-02-19 19:18 - 01502750 _____ () C:\Windows\WindowsUpdate.log
2014-02-11 07:26 - 2013-02-20 07:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-10 20:14 - 2014-02-10 20:13 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu.exe
2014-02-10 19:55 - 2013-02-20 09:25 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-09 20:21 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-09 20:21 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-09 20:16 - 2013-02-22 22:01 - 00000000 ____D () C:\Users\Admin\.xmg
2014-02-09 20:15 - 2013-04-22 19:37 - 00000680 __RSH () C:\Users\Admin\ntuser.pol
2014-02-09 20:15 - 2013-02-19 21:23 - 00000000 ____D () C:\Users\Admin
2014-02-09 20:14 - 2013-03-30 01:05 - 00039373 _____ () C:\Windows\setupact.log
2014-02-09 20:14 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-09 15:38 - 2014-02-09 15:38 - 00002209 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-02-09 15:29 - 2014-02-09 15:29 - 00000000 ____D () C:\Windows\ERUNT
2014-02-09 15:28 - 2014-02-09 15:28 - 01037530 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2014-02-09 15:15 - 2014-02-09 15:11 - 00000000 ____D () C:\AdwCleaner
2014-02-09 15:10 - 2014-02-09 15:10 - 01166132 _____ () C:\Users\Admin\Downloads\adwcleaner.exe
2014-02-09 02:31 - 2014-02-09 02:31 - 10779656 ____N (Marek Jasinski) C:\Users\Admin\Downloads\SandboxFreeCommander.cameyo.exe
2014-02-08 21:24 - 2014-02-08 21:24 - 00001142 _____ () C:\Users\Admin\Desktop\FreeCommander - Verknüpfung.lnk
2014-02-08 20:54 - 2014-02-08 20:54 - 00000000 ____D () C:\Users\Admin\Downloads\Jamie
2014-02-08 20:52 - 2014-02-08 20:52 - 00000000 ____D () C:\Users\Admin\Downloads\Jeremy
2014-02-08 20:30 - 2014-02-08 20:29 - 00000000 ____D () C:\Users\Admin\Downloads\Julien
2014-02-08 19:05 - 2014-02-08 18:24 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\VOS
2014-02-08 18:31 - 2014-02-08 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Local\Cameyo
2014-02-08 18:20 - 2014-02-08 18:19 - 18807821 _____ (Cameyo) C:\Users\Admin\Downloads\Cameyo.exe
2014-02-08 11:38 - 2013-04-05 04:12 - 00027990 _____ () C:\Windows\PFRO.log
2014-02-08 11:24 - 2014-02-08 11:24 - 00028654 _____ () C:\ComboFix.txt
2014-02-08 11:24 - 2014-02-08 11:08 - 00000000 ____D () C:\Qoobox
2014-02-08 11:22 - 2014-02-08 11:08 - 00000000 ____D () C:\Windows\erdnt
2014-02-08 11:22 - 2013-02-22 19:02 - 00000000 ___RD () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 11:22 - 2013-02-19 21:23 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 11:21 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-08 11:04 - 2014-02-08 11:04 - 05180173 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-02-08 05:10 - 2014-02-08 05:10 - 589632224 _____ () C:\Windows\MEMORY.DMP
2014-02-08 05:10 - 2014-02-08 05:10 - 00455520 _____ () C:\Windows\Minidump\020814-14726-01.dmp
2014-02-08 05:10 - 2013-03-25 07:31 - 00000000 ____D () C:\Windows\Minidump
2014-02-08 03:26 - 2014-02-08 03:26 - 00380416 _____ () C:\Users\Admin\Downloads\2euv8v11.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:48 - 2014-02-08 02:47 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 02:10 - 2013-02-20 08:04 - 00000000 ____D () C:\Users\Admin\AppData\Local\Mozilla
2014-02-08 02:03 - 2013-08-05 08:37 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA.job
2014-02-08 02:03 - 2013-08-05 08:37 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core.job
2014-02-08 01:58 - 2013-08-05 08:37 - 00003918 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA
2014-02-08 01:58 - 2013-08-05 08:37 - 00003550 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:49 - 2014-02-02 20:09 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-08 00:41 - 2014-02-08 00:32 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:37 - 2014-02-08 00:33 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:12 - 2014-02-07 20:18 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-08 00:12 - 2013-08-16 19:19 - 00000000 ____D () C:\Users\Heiko\.xmg
2014-02-08 00:12 - 2013-04-16 18:21 - 00000680 __RSH () C:\Users\Heiko\ntuser.pol
2014-02-08 00:12 - 2013-02-22 19:01 - 00000000 ____D () C:\Users\Heiko
2014-02-07 23:41 - 2013-02-24 22:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\XBMC
2014-02-07 23:32 - 2013-08-25 00:42 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:17 - 2013-12-22 14:59 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\Skype
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 21:13 - 2013-04-16 18:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Windows Live
2014-02-07 19:58 - 2014-02-05 10:20 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-07 09:48 - 2013-08-29 17:05 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{12489FB2-B57C-4A9C-8F29-2291A874BC82}
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 08:01 - 2013-12-20 07:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-04 22:26 - 2013-02-20 07:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 22:26 - 2013-02-20 07:36 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 22:26 - 2013-02-20 07:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 19:28 - 2013-04-22 19:35 - 00022330 __RSH () C:\Users\Julien\ntuser.pol
2014-02-03 19:28 - 2013-04-22 19:35 - 00000000 ____D () C:\Users\Julien
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:12 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 21:40 - 2013-04-16 18:26 - 00004682 __RSH () C:\Users\Jeremy\ntuser.pol
2014-02-02 21:40 - 2013-02-28 18:40 - 00000000 ____D () C:\Users\Jeremy
2014-02-02 20:58 - 2014-02-02 20:57 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:08 - 2014-02-02 20:07 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-02-02 19:45 - 2013-03-17 21:09 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\.minecraft
2014-02-01 08:52 - 2013-04-22 19:37 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\.minecraft
2014-01-25 19:44 - 2013-11-16 21:58 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Skype
2014-01-17 06:12 - 2014-01-17 06:11 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:12 - 2014-01-17 06:11 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:12 - 2014-01-17 06:11 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 20:18 - 2010-11-21 07:50 - 00697160 _____ () C:\Windows\system32\perfh007.dat
2014-01-16 20:18 - 2010-11-21 07:50 - 00148642 _____ () C:\Windows\system32\perfc007.dat
2014-01-16 20:18 - 2009-07-14 06:13 - 01613340 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-16 03:19 - 2009-07-14 05:45 - 00276968 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:03 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-16 03:00 - 2013-02-20 07:37 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-14 14:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-14 12:25 - 2013-02-20 08:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-08 05:39

==================== End Of Log ============================
--- --- ---

schrauber 11.02.2014 18:55
Java updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.



Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Colorlight 13.02.2014 19:48
Hallo Schrauber,

nochmal vielen vielen Dank für Deine Hilfe!!! :dankeschoen:

Ein einziges Problem hatte ich nach der Bereinigung noch:

Eines der Bereinigungsprogramme hat in den eingeschränkten Accounts die Rechte der Konfigurationsdatei pref.js neu gesetzt. Zugriff auf die Datei hatten dann nur noch
SYSTEM, die Gruppe der Administratoren sowie der Admin-Account, von dem aus ich
die Bereinigung durchgeführt habe. Die User der eingeschränkten Accounts konnten Firefox zwar starten, aber jegliche Änderungen der Einstellungen gingen beim Beenden des Programms verloren, da die prefs.js nicht gespeichert werden konnte.

Ich weiß nicht, ob das bei mir ein Einzelfall war. Falls nicht, hilft euch die Info vielleicht weiter.

Den Thread kannst du schließen und aus Deinen Abos löschen.

LG Colorlight

schrauber 14.02.2014 15:54
Werd ich mir anschauen.

Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:45 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131