Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Win7: Nach unvorsichtigem Klick auf "updateflashplayer.***.exe" lädt iexplore.exe von selbst (https://www.trojaner-board.de/157847-win7-unvorsichtigem-klick-updateflashplayer-exe-laedt-iexplore-exe-selbst.html)

Mittelweser 28.08.2014 21:07
Wie schon geschrieben, dass Problem mit den sich selbstständig ladenden IE-Prozessen scheint gelöst. Mir kommt es aber vor, dass FireFox seitdem recht viel Arbeitsspeicher belegt, sobald ein Tab geöffnet ist. Evtl hält sich da noch irgendwo etwas im System versteckt.

Hier nun die aktuelle FRST Log-Datei:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-08-2014 03
Ran by Michael (administrator) on MICHAEL-PC on 28-08-2014 21:35:59
Running from C:\Users\Michael\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\Agent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\EuWatch.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\Logitech\QCDriver3\LVComS.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [968272 2010-06-22] (Dritek System Inc.)
HKLM-x32\...\Run: [EaseUs Watch] => C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\EuWatch.exe [69000 2011-01-22] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [LVCOMS] => C:\Program Files (x86)\Common Files\Logitech\QCDriver3\LVCOMS.EXE [127022 2002-12-10] (Logitech Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-07-30] (Oracle Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de
BHO: No Name -> {41564952-412D-5637-00A7-7A786E7484D7} ->  No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKCU - No Name - {1392B8D2-5C05-419F-A8F6-B9F15A596612} -  No File
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.3.1

FireFox:
========
FF ProfilePath: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\8ndo486f.default
FF DefaultSearchEngine: Wikipedia (de)
FF SelectedSearchEngine: Wikipedia (de)
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @java.com/DTPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\8ndo486f.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\8ndo486f.default\Extensions\abs@avira.com [2014-08-28]
FF Extension: DownloadHelper - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\8ndo486f.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-08-08]

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 EASEUS Agent; C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\Agent.exe [55688 2011-01-22] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2010-07-15] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2010-07-15] () [File not signed]
R0 EUBAKUP; C:\Windows\System32\drivers\eubakup.sys [36232 2011-01-22] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R3 EuDisk; C:\Windows\System32\DRIVERS\EuDisk.sys [193416 2011-01-22] (CHENGDU YIWO Tech Development Co., Ltd)
R1 EUDSKACS; C:\Windows\system32\drivers\eudskacs.sys [17800 2011-01-22] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R0 EUFS; C:\Windows\System32\drivers\eufs.sys [26504 2011-01-22] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2010-07-15] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2010-07-15] () [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-28 21:35 - 2014-08-28 21:36 - 00015398 _____ () C:\Users\Michael\Desktop\FRST.txt
2014-08-28 11:28 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 11:28 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 11:28 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-28 02:19 - 2014-08-28 02:19 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-08-27 16:25 - 2014-08-27 16:25 - 00291880 _____ () C:\Windows\Minidump\082714-17316-01.dmp
2014-08-27 02:50 - 2014-08-27 02:50 - 00291896 _____ () C:\Windows\Minidump\082714-18532-01.dmp
2014-08-26 15:38 - 2014-08-26 15:38 - 00000128 _____ () C:\Windows\wininit.ini
2014-08-25 22:12 - 2014-08-25 22:11 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-08-25 22:11 - 2014-08-25 22:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-25 22:11 - 2014-08-25 22:11 - 00000000 ____D () C:\Program Files\Java
2014-08-25 22:08 - 2014-08-25 22:10 - 96138664 _____ (Oracle Corporation) C:\Users\Michael\Downloads\jre-8u20-windows-x64.exe
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Oracle
2014-08-25 12:17 - 2014-08-25 12:17 - 00291528 _____ () C:\Windows\Minidump\082514-18626-01.dmp
2014-08-24 13:50 - 2014-08-24 13:50 - 00001619 _____ () C:\Users\Michael\Desktop\log.txt - Verknüpfung.lnk
2014-08-23 01:44 - 2014-08-23 01:44 - 00000000 ____D () C:\Windows\ERUNT
2014-08-23 01:32 - 2014-08-23 01:37 - 00000000 ____D () C:\AdwCleaner
2014-08-23 00:39 - 2014-08-28 13:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-23 00:39 - 2014-08-23 00:39 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-23 00:39 - 2014-08-23 00:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-23 00:39 - 2014-08-23 00:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-23 00:39 - 2014-08-23 00:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-23 00:39 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-23 00:39 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-23 00:39 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-22 10:42 - 2014-08-22 10:42 - 00000000 ____D () C:\Users\Michael\AppData\Local\{84B2BD56-FBBB-41EE-AC4E-C7E2FB21D627}
2014-08-22 10:38 - 2014-08-22 10:38 - 00000000 ____D () C:\Users\Michael\AppData\Local\{10ABC367-1C41-4F2A-AFB7-D35A242592E0}
2014-08-21 12:45 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-21 12:45 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-21 12:45 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-21 12:45 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-21 12:45 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-21 12:45 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-21 12:45 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-21 12:45 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-21 12:44 - 2014-08-21 13:08 - 00000000 ____D () C:\Qoobox
2014-08-21 12:44 - 2014-08-21 13:06 - 00000000 ____D () C:\Windows\erdnt
2014-08-21 11:32 - 2014-08-21 11:32 - 00000000 ____D () C:\Users\Michael\AppData\Local\{F5AD1383-6808-4242-90EB-8565D83E6426}
2014-08-21 01:30 - 2014-08-21 01:30 - 00000000 ____D () C:\Users\Michael\AppData\Local\{9E9223FE-F6FB-4A0E-AD38-B3FB7F54EB42}
2014-08-21 01:22 - 2014-08-21 01:22 - 00291864 _____ () C:\Windows\Minidump\082114-25537-01.dmp
2014-08-20 21:19 - 2014-08-28 21:36 - 00000000 ____D () C:\FRST
2014-08-20 21:17 - 2014-08-20 21:17 - 00000000 _____ () C:\Users\Michael\defogger_reenable
2014-08-20 20:50 - 2014-08-20 20:50 - 00000000 ____D () C:\Users\Michael\AppData\Local\{3D2DD5FB-6969-4999-B157-B2A43AC4ECE1}
2014-08-20 20:24 - 2014-08-28 21:35 - 00000000 ____D () C:\Users\Michael\Desktop\System-Säuberung
2014-08-20 20:21 - 2014-08-24 21:57 - 02103296 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2014-08-20 11:36 - 2014-08-20 11:36 - 00046873 _____ () C:\Windows\SysWOW64\unil.exe
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 ____D () C:\Michael
2014-08-19 21:44 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 21:44 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 21:44 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 21:44 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 21:44 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 21:44 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 21:44 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 21:44 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 21:44 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 21:44 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 21:44 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 21:44 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 21:44 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 21:44 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-19 21:44 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 21:44 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 21:44 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-19 21:44 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 21:44 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-19 21:44 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-19 21:44 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-19 21:44 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-19 21:44 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-19 21:44 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-19 21:44 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 21:44 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-19 21:44 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-19 21:44 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-19 21:44 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-19 21:44 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-19 21:44 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-19 21:44 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-19 21:44 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-19 21:44 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-19 21:44 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-19 21:44 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 21:44 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-19 21:44 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-19 21:44 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-19 21:44 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-19 21:44 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-19 21:44 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-19 21:44 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-19 21:44 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-19 21:44 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-19 21:44 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-19 21:44 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-19 21:44 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-19 21:44 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-19 21:44 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-19 21:44 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-19 21:44 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-19 21:44 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-19 21:44 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-19 21:44 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-19 21:44 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-19 15:51 - 2014-08-19 15:51 - 00000000 ____D () C:\Users\Michael\AppData\Local\{38B2E845-4D07-4961-B970-98EC8CD0CEAD}
2014-08-19 15:39 - 2014-08-19 15:39 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-08-19 15:39 - 2014-08-19 15:39 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-08-19 15:39 - 2014-08-19 15:39 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-08-19 15:39 - 2014-08-19 15:39 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-08-19 15:39 - 2014-08-19 15:39 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-08-19 15:39 - 2014-08-19 15:39 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-08-19 15:39 - 2014-08-19 15:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-08-19 15:37 - 2014-08-19 15:37 - 02077392 _____ (Microsoft Corporation) C:\Users\Michael\Downloads\IE11-Windows6.1.exe
2014-08-19 15:15 - 2014-08-19 15:15 - 00000000 ____D () C:\Users\Michael\AppData\Local\{C44E66C8-D51D-495E-BA97-4304D70E0182}
2014-08-19 15:10 - 2014-08-19 15:11 - 04574968 _____ (Avira Operations GmbH & Co. KG) C:\Users\Michael\Downloads\avira_de_av___ws.exe
2014-08-19 12:40 - 2014-08-19 15:50 - 00001417 _____ () C:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-18 22:44 - 2014-08-18 22:44 - 00000000 ____D () C:\Users\Michael\AppData\Local\{731D6040-732C-4DE9-98FC-709267031DBD}
2014-08-18 15:06 - 2014-08-18 15:06 - 00000000 ____D () C:\Users\Michael\AppData\Local\{99AC47CD-5F49-4750-A2FF-426C684CBE8E}
2014-08-18 14:01 - 2014-08-18 14:01 - 00000000 ____D () C:\Users\Michael\AppData\Local\{F0D04E7A-FEB5-4741-AEDF-E437370C8C62}
2014-08-18 13:02 - 2014-08-18 13:02 - 00000000 ____D () C:\Users\Michael\AppData\Local\{153F9F39-0933-4147-AE57-91E7DA2D8CAA}
2014-08-18 11:04 - 2014-08-18 11:04 - 00000000 ____D () C:\Users\Michael\AppData\Local\{5D930934-5124-466B-AE81-79A4AF65A101}
2014-08-17 22:20 - 2014-08-17 22:20 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-17 22:19 - 2014-08-17 22:20 - 02347384 _____ (ESET) C:\Users\Michael\Downloads\esetsmartinstaller_deu.exe
2014-08-17 21:30 - 2014-08-19 11:56 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\QuickScan
2014-08-17 18:05 - 2014-08-17 18:06 - 04813544 _____ (Piriform Ltd) C:\Users\Michael\Downloads\ccsetup416.exe
2014-08-17 17:57 - 2014-08-17 17:57 - 00000000 ____D () C:\Users\Michael\AppData\Local\{1BC41C44-349C-4656-B3E0-26163AA28D42}
2014-08-17 17:10 - 2014-08-17 17:10 - 00000000 ____D () C:\Users\Michael\AppData\Local\{0107BFDA-B12C-48F6-8E47-B4AB6B8CDE05}
2014-08-17 01:04 - 2014-08-17 01:04 - 00000000 ____D () C:\Users\Michael\AppData\Local\{34A4F854-7900-4862-8F65-6E12975E9D54}
2014-08-15 09:23 - 2014-08-15 09:23 - 00000000 ____D () C:\Users\Michael\AppData\Local\{1442DB7E-FFC6-4E4C-91D8-99B7C9E1E12B}
2014-08-14 10:36 - 2014-08-14 10:37 - 00000000 ____D () C:\Users\Michael\AppData\Local\{C42E855C-4B60-429C-B1B3-4D95D47F24DA}
2014-08-13 12:19 - 2014-08-13 12:20 - 00000000 ____D () C:\Users\Michael\AppData\Local\{D1DF6F7D-6F82-4F22-ABDE-0C7640A75E89}
2014-08-13 10:51 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 10:51 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-13 10:51 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 10:51 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 10:51 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-13 10:51 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 10:50 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-13 10:50 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 10:49 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 10:49 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 10:49 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 10:49 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-13 10:49 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 10:49 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 10:49 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 10:49 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 10:49 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 10:49 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 10:49 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 10:49 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 10:49 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 10:48 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 10:47 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 10:47 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 10:41 - 2014-08-13 10:41 - 00000000 ____D () C:\Users\Michael\AppData\Local\{42D91D13-48AF-4C95-AC18-F5C8ED438B6B}
2014-08-12 20:25 - 2014-08-12 20:25 - 00001442 _____ () C:\Users\Public\Desktop\Free Audio Converter.lnk
2014-08-12 20:25 - 2014-08-12 20:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-08-12 20:24 - 2014-08-12 20:25 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-08-12 20:23 - 2014-08-12 20:24 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\DVDVideoSoft
2014-08-12 20:21 - 2014-08-12 20:21 - 28401992 _____ (DVDVideoSoft Ltd. ) C:\Users\Michael\Downloads\FreeAudioConverter-5.0.45.806.exe
2014-08-12 09:54 - 2014-08-12 09:55 - 00000000 ____D () C:\Users\Michael\AppData\Local\{16A1732A-8B23-43D9-B2F8-08B5350750A4}
2014-08-10 14:04 - 2014-08-10 14:05 - 00000000 ____D () C:\Users\Michael\AppData\Local\{F467A3D9-869E-4765-9078-E3264A274CF0}
2014-08-09 22:23 - 2014-08-09 22:23 - 00000000 ____D () C:\Users\Michael\AppData\Local\{F7399A5B-CD27-486F-A1D5-FD6C3D51BCEA}
2014-08-08 22:33 - 2014-08-08 22:33 - 00000000 ____D () C:\Users\Michael\AppData\Local\{7D239DDE-821E-4374-AB96-548753FFCF88}
2014-08-07 10:42 - 2014-08-07 10:42 - 00000000 ____D () C:\Users\Michael\AppData\Local\{5CA6A5DA-5962-42D5-85A3-DD0C8C5E074A}
2014-08-05 23:24 - 2014-08-05 23:24 - 00000000 ____D () C:\Users\Michael\AppData\Local\{4259FC1B-9E4C-4327-8682-FDFA031883E7}
2014-08-05 10:44 - 2014-08-05 10:44 - 00000000 ____D () C:\Users\Michael\AppData\Local\{02E8177A-A326-430D-9F87-8695E6E7A536}
2014-08-04 10:30 - 2014-08-18 15:10 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-04 10:30 - 2014-08-18 15:09 - 00001141 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-04 10:21 - 2014-08-04 10:21 - 00000000 ____D () C:\Users\Michael\AppData\Local\{0ED40260-078E-4866-808C-6365BF7B08E7}
2014-08-03 10:42 - 2014-08-03 10:42 - 00000000 ____D () C:\Users\Michael\AppData\Local\{7FDF989D-B9F7-4C21-AF30-B584D8B06731}
2014-08-02 10:44 - 2014-08-02 10:44 - 00000000 ____D () C:\Users\Michael\AppData\Local\{0AB8EE49-D6F2-4F5A-A331-5A29BAB69788}
2014-08-01 16:43 - 2014-08-01 16:43 - 00000000 ____D () C:\Users\Michael\AppData\Local\{E4EC2F12-65F1-4545-8BAC-BE4850219F5D}
2014-08-01 11:43 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-01 11:43 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-01 11:43 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-01 11:43 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-01 11:43 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-01 11:43 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-01 11:43 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-01 11:43 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-01 11:43 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-01 11:43 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-01 11:42 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-01 11:42 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-01 11:42 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-01 11:42 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-01 11:40 - 2014-08-01 11:40 - 00000000 ____D () C:\Users\Michael\AppData\Local\{56FDFAE9-4B17-4F4B-9C85-E6BE0DC83F9D}
2014-07-31 10:13 - 2014-07-31 10:13 - 00000000 ____D () C:\Users\Michael\AppData\Local\{9ED1D688-C768-4252-837E-9EED3F2C7C81}
2014-07-30 10:06 - 2014-07-30 10:06 - 00000000 ____D () C:\Users\Michael\AppData\Local\{DF2A5F04-B151-45D0-B89C-5B72B809C057}

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-28 21:36 - 2014-08-28 21:35 - 00015398 _____ () C:\Users\Michael\Desktop\FRST.txt
2014-08-28 21:36 - 2014-08-20 21:19 - 00000000 ____D () C:\FRST
2014-08-28 21:35 - 2014-08-20 20:24 - 00000000 ____D () C:\Users\Michael\Desktop\System-Säuberung
2014-08-28 21:35 - 2011-02-08 22:20 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Skype
2014-08-28 20:53 - 2010-09-17 18:57 - 01182498 _____ () C:\Windows\WindowsUpdate.log
2014-08-28 17:56 - 2011-02-07 23:29 - 00000000 ____D () C:\ProgramData\boost_interprocess
2014-08-28 17:14 - 2009-07-14 06:51 - 00189927 _____ () C:\Windows\setupact.log
2014-08-28 13:56 - 2014-08-23 00:39 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-28 12:03 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-28 12:03 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-28 11:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-28 11:55 - 2009-07-14 06:45 - 00285736 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-28 02:19 - 2014-08-28 02:19 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-08-27 16:25 - 2014-08-27 16:25 - 00291880 _____ () C:\Windows\Minidump\082714-17316-01.dmp
2014-08-27 16:25 - 2011-09-18 23:19 - 554376415 _____ () C:\Windows\MEMORY.DMP
2014-08-27 16:25 - 2011-09-18 23:19 - 00000000 ____D () C:\Windows\Minidump
2014-08-27 02:50 - 2014-08-27 02:50 - 00291896 _____ () C:\Windows\Minidump\082714-18532-01.dmp
2014-08-26 23:18 - 2011-10-05 03:30 - 00000000 ____D () C:\Users\Michael\AppData\Local\FreePDF_XP
2014-08-26 22:43 - 2010-09-17 18:54 - 00172686 _____ () C:\Windows\PFRO.log
2014-08-26 15:38 - 2014-08-26 15:38 - 00000128 _____ () C:\Windows\wininit.ini
2014-08-26 09:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\schemas
2014-08-25 22:11 - 2014-08-25 22:12 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-08-25 22:11 - 2014-08-25 22:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-25 22:11 - 2014-08-25 22:11 - 00000000 ____D () C:\Program Files\Java
2014-08-25 22:11 - 2013-10-29 11:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-25 22:10 - 2014-08-25 22:08 - 96138664 _____ (Oracle Corporation) C:\Users\Michael\Downloads\jre-8u20-windows-x64.exe
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Oracle
2014-08-25 12:17 - 2014-08-25 12:17 - 00291528 _____ () C:\Windows\Minidump\082514-18626-01.dmp
2014-08-24 21:57 - 2014-08-20 20:21 - 02103296 _____ (Farbar) C:\Users\Michael\Desktop\FRST64.exe
2014-08-24 13:50 - 2014-08-24 13:50 - 00001619 _____ () C:\Users\Michael\Desktop\log.txt - Verknüpfung.lnk
2014-08-23 04:07 - 2014-08-28 11:28 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 11:28 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 11:28 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-23 01:44 - 2014-08-23 01:44 - 00000000 ____D () C:\Windows\ERUNT
2014-08-23 01:37 - 2014-08-23 01:32 - 00000000 ____D () C:\AdwCleaner
2014-08-23 01:37 - 2014-06-10 23:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-23 00:39 - 2014-08-23 00:39 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-23 00:39 - 2014-08-23 00:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-23 00:39 - 2014-08-23 00:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-23 00:39 - 2014-08-23 00:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-22 14:24 - 2011-02-07 18:32 - 00000000 ____D () C:\Users\Michael
2014-08-22 14:16 - 2011-10-02 16:00 - 00443904 ___SH () C:\Users\Michael\Thumbs.db
2014-08-22 10:42 - 2014-08-22 10:42 - 00000000 ____D () C:\Users\Michael\AppData\Local\{84B2BD56-FBBB-41EE-AC4E-C7E2FB21D627}
2014-08-22 10:42 - 2010-09-17 19:20 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-08-22 10:38 - 2014-08-22 10:38 - 00000000 ____D () C:\Users\Michael\AppData\Local\{10ABC367-1C41-4F2A-AFB7-D35A242592E0}
2014-08-22 10:38 - 2011-02-09 18:59 - 00000000 ____D () C:\Users\Michael\Tracing
2014-08-22 10:37 - 2013-05-19 23:11 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-08-21 13:08 - 2014-08-21 12:44 - 00000000 ____D () C:\Qoobox
2014-08-21 13:08 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-08-21 13:06 - 2014-08-21 12:44 - 00000000 ____D () C:\Windows\erdnt
2014-08-21 12:57 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-21 11:32 - 2014-08-21 11:32 - 00000000 ____D () C:\Users\Michael\AppData\Local\{F5AD1383-6808-4242-90EB-8565D83E6426}
2014-08-21 01:30 - 2014-08-21 01:30 - 00000000 ____D () C:\Users\Michael\AppData\Local\{9E9223FE-F6FB-4A0E-AD38-B3FB7F54EB42}
2014-08-21 01:22 - 2014-08-21 01:22 - 00291864 _____ () C:\Windows\Minidump\082114-25537-01.dmp
2014-08-20 21:17 - 2014-08-20 21:17 - 00000000 _____ () C:\Users\Michael\defogger_reenable
2014-08-20 20:50 - 2014-08-20 20:50 - 00000000 ____D () C:\Users\Michael\AppData\Local\{3D2DD5FB-6969-4999-B157-B2A43AC4ECE1}
2014-08-20 17:52 - 2012-05-20 03:35 - 00000035 _____ () C:\Users\Michael\Desktop\proxtube.txt
2014-08-20 12:09 - 2013-09-13 02:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StreamTransport
2014-08-20 11:36 - 2014-08-20 11:36 - 00046873 _____ () C:\Windows\SysWOW64\unil.exe
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 ____D () C:\Michael
2014-08-20 11:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-20 00:49 - 2012-01-11 17:53 - 00000000 ____D () C:\Users\Michael\AppData\Local\Unity
2014-08-20 00:48 - 2010-09-17 19:14 - 00040818 _____ () C:\Windows\DPINST.LOG
2014-08-20 00:03 - 2011-02-08 22:59 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\ICQ
2014-08-19 21:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-19 15:51 - 2014-08-19 15:51 - 00000000 ____D () C:\Users\Michael\AppData\Local\{38B2E845-4D07-4961-B970-98EC8CD0CEAD}
2014-08-19 15:50 - 2014-08-19 12:40 - 00001417 _____ () C:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-19 15:45 - 2013-11-12 11:03 - 00020973 _____ () C:\Windows\IE11_main.log
2014-08-19 15:39 - 2014-08-19 15:39 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-08-19 15:39 - 2014-08-19 15:39 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-08-19 15:39 - 2014-08-19 15:39 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-08-19 15:39 - 2014-08-19 15:39 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-08-19 15:39 - 2014-08-19 15:39 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-08-19 15:39 - 2014-08-19 15:39 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-08-19 15:39 - 2014-08-19 15:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-08-19 15:39 - 2014-08-19 15:39 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-08-19 15:39 - 2014-08-19 15:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-08-19 15:37 - 2014-08-19 15:37 - 02077392 _____ (Microsoft Corporation) C:\Users\Michael\Downloads\IE11-Windows6.1.exe
2014-08-19 15:15 - 2014-08-19 15:15 - 00000000 ____D () C:\Users\Michael\AppData\Local\{C44E66C8-D51D-495E-BA97-4304D70E0182}
2014-08-19 15:11 - 2014-08-19 15:10 - 04574968 _____ (Avira Operations GmbH & Co. KG) C:\Users\Michael\Downloads\avira_de_av___ws.exe
2014-08-19 11:56 - 2014-08-17 21:30 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\QuickScan
2014-08-19 02:37 - 2014-02-27 18:56 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-08-19 00:02 - 2011-09-20 18:26 - 00000140 _____ () C:\Windows\9888.MOD
2014-08-18 22:44 - 2014-08-18 22:44 - 00000000 ____D () C:\Users\Michael\AppData\Local\{731D6040-732C-4DE9-98FC-709267031DBD}
2014-08-18 22:42 - 2010-07-13 13:57 - 00000000 ____D () C:\Program Files (x86)\EgisTec MyWinLocker
2014-08-18 16:01 - 2010-07-13 13:32 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-08-18 15:39 - 2012-06-18 15:44 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-18 15:39 - 2012-06-18 15:44 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy
2014-08-18 15:10 - 2014-08-04 10:30 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-18 15:09 - 2014-08-04 10:30 - 00001141 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-18 15:09 - 2013-08-05 18:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-18 15:09 - 2013-08-05 18:04 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-18 15:06 - 2014-08-18 15:06 - 00000000 ____D () C:\Users\Michael\AppData\Local\{99AC47CD-5F49-4750-A2FF-426C684CBE8E}
2014-08-18 14:34 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-08-18 14:28 - 2012-11-13 17:41 - 00000000 ____D () C:\Program Files (x86)\HP
2014-08-18 14:01 - 2014-08-18 14:01 - 00000000 ____D () C:\Users\Michael\AppData\Local\{F0D04E7A-FEB5-4741-AEDF-E437370C8C62}
2014-08-18 14:01 - 2011-02-07 18:32 - 00062472 _____ () C:\Users\Michael\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-18 13:59 - 2012-11-13 17:36 - 00004324 _____ () C:\ProgramData\hpzinstall.log
2014-08-18 13:59 - 2012-11-13 17:36 - 00000000 ____D () C:\ProgramData\HP
2014-08-18 13:02 - 2014-08-18 13:02 - 00000000 ____D () C:\Users\Michael\AppData\Local\{153F9F39-0933-4147-AE57-91E7DA2D8CAA}
2014-08-18 11:04 - 2014-08-18 11:04 - 00000000 ____D () C:\Users\Michael\AppData\Local\{5D930934-5124-466B-AE81-79A4AF65A101}
2014-08-18 00:27 - 2012-09-27 00:03 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\FileZilla
2014-08-18 00:00 - 2011-09-15 11:40 - 00000353 _____ () C:\Users\Michael\Desktop\Neues Textdokument.txt
2014-08-17 22:20 - 2014-08-17 22:20 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-17 22:20 - 2014-08-17 22:19 - 02347384 _____ (ESET) C:\Users\Michael\Downloads\esetsmartinstaller_deu.exe
2014-08-17 18:07 - 2012-06-18 17:34 - 00000826 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-17 18:07 - 2012-06-18 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-08-17 18:07 - 2012-06-18 17:34 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-17 18:06 - 2014-08-17 18:05 - 04813544 _____ (Piriform Ltd) C:\Users\Michael\Downloads\ccsetup416.exe
2014-08-17 17:57 - 2014-08-17 17:57 - 00000000 ____D () C:\Users\Michael\AppData\Local\{1BC41C44-349C-4656-B3E0-26163AA28D42}
2014-08-17 17:10 - 2014-08-17 17:10 - 00000000 ____D () C:\Users\Michael\AppData\Local\{0107BFDA-B12C-48F6-8E47-B4AB6B8CDE05}
2014-08-17 01:04 - 2014-08-17 01:04 - 00000000 ____D () C:\Users\Michael\AppData\Local\{34A4F854-7900-4862-8F65-6E12975E9D54}
2014-08-15 09:23 - 2014-08-15 09:23 - 00000000 ____D () C:\Users\Michael\AppData\Local\{1442DB7E-FFC6-4E4C-91D8-99B7C9E1E12B}
2014-08-14 20:54 - 2014-06-11 18:04 - 00000000 ____D () C:\Users\Michael\AppData\Local\Adobe
2014-08-14 10:39 - 2012-04-03 10:00 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-14 10:39 - 2011-06-02 00:20 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-14 10:37 - 2014-08-14 10:36 - 00000000 ____D () C:\Users\Michael\AppData\Local\{C42E855C-4B60-429C-B1B3-4D95D47F24DA}
2014-08-13 12:20 - 2014-08-13 12:19 - 00000000 ____D () C:\Users\Michael\AppData\Local\{D1DF6F7D-6F82-4F22-ABDE-0C7640A75E89}
2014-08-13 11:03 - 2013-07-14 13:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 10:55 - 2011-02-08 16:51 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 10:50 - 2014-04-23 10:53 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 10:41 - 2014-08-13 10:41 - 00000000 ____D () C:\Users\Michael\AppData\Local\{42D91D13-48AF-4C95-AC18-F5C8ED438B6B}
2014-08-12 20:25 - 2014-08-12 20:25 - 00001442 _____ () C:\Users\Public\Desktop\Free Audio Converter.lnk
2014-08-12 20:25 - 2014-08-12 20:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-08-12 20:25 - 2014-08-12 20:24 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-08-12 20:24 - 2014-08-12 20:23 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\DVDVideoSoft
2014-08-12 20:21 - 2014-08-12 20:21 - 28401992 _____ (DVDVideoSoft Ltd. ) C:\Users\Michael\Downloads\FreeAudioConverter-5.0.45.806.exe
2014-08-12 09:55 - 2014-08-12 09:54 - 00000000 ____D () C:\Users\Michael\AppData\Local\{16A1732A-8B23-43D9-B2F8-08B5350750A4}
2014-08-10 14:05 - 2014-08-10 14:04 - 00000000 ____D () C:\Users\Michael\AppData\Local\{F467A3D9-869E-4765-9078-E3264A274CF0}
2014-08-09 22:23 - 2014-08-09 22:23 - 00000000 ____D () C:\Users\Michael\AppData\Local\{F7399A5B-CD27-486F-A1D5-FD6C3D51BCEA}
2014-08-08 22:34 - 2011-02-08 22:20 - 00000000 ____D () C:\ProgramData\Skype
2014-08-08 22:33 - 2014-08-08 22:33 - 00000000 ____D () C:\Users\Michael\AppData\Local\{7D239DDE-821E-4374-AB96-548753FFCF88}
2014-08-07 10:42 - 2014-08-07 10:42 - 00000000 ____D () C:\Users\Michael\AppData\Local\{5CA6A5DA-5962-42D5-85A3-DD0C8C5E074A}
2014-08-07 04:06 - 2014-08-13 10:47 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 10:47 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-05 23:24 - 2014-08-05 23:24 - 00000000 ____D () C:\Users\Michael\AppData\Local\{4259FC1B-9E4C-4327-8682-FDFA031883E7}
2014-08-05 10:44 - 2014-08-05 10:44 - 00000000 ____D () C:\Users\Michael\AppData\Local\{02E8177A-A326-430D-9F87-8695E6E7A536}
2014-08-05 09:20 - 2013-05-19 23:20 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-04 10:30 - 2013-08-05 18:04 - 00000000 ____D () C:\ProgramData\Avira
2014-08-04 10:21 - 2014-08-04 10:21 - 00000000 ____D () C:\Users\Michael\AppData\Local\{0ED40260-078E-4866-808C-6365BF7B08E7}
2014-08-03 10:42 - 2014-08-03 10:42 - 00000000 ____D () C:\Users\Michael\AppData\Local\{7FDF989D-B9F7-4C21-AF30-B584D8B06731}
2014-08-02 10:44 - 2014-08-02 10:44 - 00000000 ____D () C:\Users\Michael\AppData\Local\{0AB8EE49-D6F2-4F5A-A331-5A29BAB69788}
2014-08-01 16:43 - 2014-08-01 16:43 - 00000000 ____D () C:\Users\Michael\AppData\Local\{E4EC2F12-65F1-4545-8BAC-BE4850219F5D}
2014-08-01 11:40 - 2014-08-01 11:40 - 00000000 ____D () C:\Users\Michael\AppData\Local\{56FDFAE9-4B17-4F4B-9C85-E6BE0DC83F9D}
2014-08-01 01:41 - 2014-08-19 21:44 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-19 21:44 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-31 10:13 - 2014-07-31 10:13 - 00000000 ____D () C:\Users\Michael\AppData\Local\{9ED1D688-C768-4252-837E-9EED3F2C7C81}
2014-07-30 10:06 - 2014-07-30 10:06 - 00000000 ____D () C:\Users\Michael\AppData\Local\{DF2A5F04-B151-45D0-B89C-5B72B809C057}
2014-07-30 10:05 - 2012-04-25 18:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

Some content of TEMP:
====================
C:\Users\Michael\AppData\Local\Temp\avgnt.exe
C:\Users\Michael\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-27 15:22

==================== End Of Log ============================
--- --- ---

--- --- ---


Die nächsten Tage bin ich unterwegs und erst am Montag wieder online. Eine Antwort wird mir daher erst am Montag Abend möglich sein.

schrauber 29.08.2014 12:40
Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

Mittelweser 03.09.2014 22:07
Hallo!
Bitte entschuldige, dass die Antwort erst jetzt kommt.

Leider hat die DeInstallation von Firefox nicht das gewünschte Ergebnis gebracht. Firefox läuft in diesem Augenblick mit 6-8% Prozessorauslastung und etwa 120.000K Arbeitsspeicher, obwohl nur ein Tab mit diesem Fenster geöffnet ist.
Kann das passen? Kommt mir aber irgendwie komisch vor.

Mfg

schrauber 04.09.2014 14:44
Hast Du ihn auch zurückgesetzt wie im Link angegeben?

Mittelweser 05.09.2014 15:33
Ja, habe Firefox wie im Link angegeben zurückgesetzt.

schrauber 06.09.2014 12:12
macht er bei mir auch manchmal, die aktuelle Version is ziemlich....... :)

Mittelweser 07.09.2014 21:32
Ok! :)

Das Problem mit dem IE ist ja nach dem Durchlauf mit TDSSKiller glücklicherweise behoben.
War in dem letzten FRST-Log noch etwas auffälliges und sind weitere Schritte notwendig / ratsam?

schrauber 08.09.2014 18:57
Nope, alles gut.

Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Mittelweser 11.09.2014 20:19
Super! :)

Nochmals vielen Dank für deine Hilfe und die Tipps! :dankeschoen: :daumenhoc

In der realen Welt würde ich jetzt eine Runde "Kaltgetränke" ausgeben.
Hier müssen wir uns mit :party: begnügen. ;)

schrauber 12.09.2014 19:57
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:03 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131