|
Umleitung auf leere "spns.seriousads.ne" Seite, Verlangsamung des Internet Liebe Spezialisten, ich bin leider kein Spezialist..und habe mir deshalb einen Virus eingefangen. Ich werde ständig auf diese spns.seriousads.ne Seite umgeleitet..in allen browsern..ich bin gerne in firefox und habe schon mehrmals auf "Ausgangszustand" zurücksetzten gedrückt..ich habe auch schon malwarebytes heruntergeladen..aber da ich mich so wenig auskenne..hat das nix gebracht..ausser dass windows 7 noch länger braucht zum hochfahren. Ich habe einen thread zu dem Thema in diesem Forum durchgelesen und bin begeistert, und auch etwas eingeschüchtert von der Genauigkeit mit der dieses Thema bearbeitet wird, und was man alles beachten muss. Wenn sich jemand findet, der mich mit etwas Geduld da durchleitet, und bei dem ich vielleicht auch mal eine "blöde" Frage stellen darf, bevor ich etwas falsches mache..ja da wäre mir wirklich sehr geholfen. Ich freue mich auf Antworten und wünsche einen angenehmen Abend, Bernadette |
hi, Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
Hi, WOW das ging aber schnell..bitte hab ein wenig Geduld mit mir ich bin nicht so fix mit dem Computer..aber ich verspreche Dir mich zu konzentrieren ;-) hier die frst-txt: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2014--- --- --- --- --- --- --- --- --- --- --- --- und hier die Addition.txtFRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2014is noch was zu retten? :-) und vielleicht habe ich schon bei der ersten Aufgabe etwas übersehen!! was hast du gemeint am Ende mit (#-Symbol im Eingabefenster der Webseite anklicken) ?? ich habe übrigens nach der folgenden anleitung mein windows kennwort umgangen..weil ich im moment nur zugriff auf diesen älteren computer habe und das kennwort vergessen habe.. das war für mich wie wenn du einen affen die mona lisa malen lässt..oder einen chinesischen text übersetzen: https://www.youtube.com/watch?v=V_M_Ss5jUlg |
Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
|
hallo schrauber, vielen dank für deine rasche antwort! ja das sind für mich große aufgaben..ich hoffe ich mache alles richtig..bis später hallo, ich habe den revo uninstaller direkt von org runtergeladen weil mich spns.seriousads.ne natürlich nicht weiterverbunden hat..ich habe jetzt auch combofix von der der seite runtergeladen die mir das programm vorgeschlagen hat, weil es meinte eine firewall würde das programm hindern..habe ich irgendwas falsch gemacht bisher? zb : "Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner" ? ich habe im internet gesucht wie man das am besten macht..bin mir aber nicht sicher ob ich es richtig gemacht habe.. weiters versuche ich herauszufinden, was ein code tag ist..kannst du mir das vielleicht genauer beschreiben..bitte.. ..kannst du mir bitte den ganzen link von combofix schicken...:-( hallo, leideat YAC auch andere spyware gearbeitet und mittendrin gescannt..ich habs also nicht richtig gemacht ..hilft dir die logdatei trotzdem weiter = B]Combofix Logfile: Code: ComboFix 14-11-12.01 - Bernadett 14.11.2014 4:05.1.4 - x64HA! die Umleitung ist weg!! ist das Problem jetzt schon vollstänig gelöst? muss ich noch etwas beachten? kannst du mir vielleicht noch erklären wie ich den computer am besten schütze in zukunft? bitte in genauen schritten, weil das mit dem deaktivieren hab ich leider nicht geschafft... vielen vielen lieben dank vor deine mühe bisher!!!! so hier nochmal das logfile...ich habe es jetzt geschafft die antivirenprogramme auszuschalten..die umleitung hat nämlich schon wieder eingesetzt: Combofix Logfile: Code: ComboFix 14-11-12.01 - Bernadett 14.11.2014 6:15.2.4 - x64 |
Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte. |
oooch..spns-seriousads-ne leitet mich beim download klick auf die seite um..hast du eine idee wie ich das umgehen kann...ich hab bisher..wenn ich mit dem curser auf einen link von dir gehe, ganz einfach oben in der adressleiste eingegeben was unten links als link aufscheint..beim download funktioniert das nicht..:-( |
Du kannst filepony.de direkt besuchen und dort in das Suchfeld alle Tools eingeben. |
hallo lieber helfer, hier die mbam datei: Malwarebytes Anti-Malware Malwarebytes | Free Anti-Malware & Internet Security Software Scan Date: 17.11.2014 Scan Time: 06:30:16 Logfile: mbam.txt Administrator: Yes Version: 2.00.3.1025 Malware Database: v2014.11.17.01 Rootkit Database: v2014.11.12.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Bernadett Scan Type: Threat Scan Result: Completed Objects Scanned: 385547 Time Elapsed: 44 min, 23 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) hmm als ich dann adwcleaner hochgeladen habe..und den computer neu starten wollte ...hat windows nicht mehr geladen.... ich hab dann eine systemzurücksetzung gemacht.. jetzt hab ich wenigstes windows wieder.. ich weiss es is alles schon so durcheinander...ich weiss nicht welches programm heruntergeladen ist, welches im hintergrund läuft ect.. hast du schon die geduld mit mir verloren? soll ich den computer ganz einfach aus dem fenster werfen :-( und gleich mal hinterherspringen ;-) mit liebem gruss, bernadette lieber schrauber, ich habe wirklich überhaupt keine ahnung warum ich jetzt nicht mehr auf dieses seite umgeleitet werde..es bleibt ein mysterium, da ich gestern nichts mehr spezielles unternommen habe, um das problem zu lösen. ich hoffe, der spuk hat jetzt sein ende. ich bedanke mich dennoch für deine geduld und mühe! mit liebem gruss, bernadette |
Jetzt blick ich nicht mehr durch. Was ist denn aktueller Stand? Poste bitte mal ein frisches FRST log. |
can result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2014 Ran by Bernadett (administrator) on BERNADETT-PC on 18-11-2014 13:54:40 Running from C:\Users\Bernadett\Downloads Loaded Profile: Bernadett (Available profiles: UpdatusUser & Bernadett) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (ASUS) C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe (ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe (ASUS) C:\Program Files\P4G\BatteryLife.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe ( ) C:\Windows\System32\lxebcoms.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe () C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe (Intel(R) Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS) C:\Windows\AsScrPro.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Duplexed Lox) C:\Users\Bernadett\AppData\Local\Temp\A68E.tmp (Duplexed Lox) C:\Users\Bernadett\AppData\Local\Temp\6636.tmp (Mozilla Corporation) C:\Program Files (x86)\mozilla firefox\firefox.exe (Duplexed Lox) C:\Users\Bernadett\AppData\Local\Temp\1331.tmp (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe (Duplexed Lox) C:\Users\Bernadett\AppData\Local\Temp\7D66.tmp (Farbar) C:\Users\Bernadett\Downloads\FRST64(1).exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2010-11-02] (Intel(R) Corporation) HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" HKLM\...\Run: [lxebmon.exe] => C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe [770728 2011-01-24] () HKLM\...\Run: [combofix] => C:\ComboFix\CF17998.3XE /c C:\ComboFix\Combobatch.bat HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus) HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS) HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS) HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] () HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-23] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-239039659-1557409311-833459281-1001\...\Run: [aaeuldmg.exe] => C:\Users\Bernadett\AppData\Roaming\Identities\aaeuldmg.exe [200766 2009-07-14] () HKU\S-1-5-21-239039659-1557409311-833459281-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-02-21] (NVIDIA Corporation) ShellIconOverlayIdentifiers: [AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll (eCareme Technologies, Inc.) ShellIconOverlayIdentifiers: [AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll (eCareme Technologies, Inc.) ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bernadett\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bernadett\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bernadett\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bernadett\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File BootExecute: autocheck autochk * ROBoot64 \??\C:\Windows\system32\ASOROSet.bin ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-239039659-1557409311-833459281-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-239039659-1557409311-833459281-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM-x32 -> Backup.Old.DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM-x32 -> {189B62E5-BA65-8A60-AB49-738A969A9071} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10004&barid={63D964F9-DFAA-11E1-A381-F46D0446EAB5} SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT SearchScopes: HKU\S-1-5-21-239039659-1557409311-833459281-1001 -> Backup.Old.DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} SearchScopes: HKU\S-1-5-21-239039659-1557409311-833459281-1001 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-239039659-1557409311-833459281-1001 -> {189B62E5-BA65-8A60-AB49-738A969A9071} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10004&barid={63D964F9-DFAA-11E1-A381-F46D0446EAB5} SearchScopes: HKU\S-1-5-21-239039659-1557409311-833459281-1001 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: No Name -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> No File BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Lexmark -> {D2C5E510-BE6D-42CC-9F61-E4F939078474} -> C:\Program Files\Lexmark Printable Web\bho.dll () Toolbar: HKU\S-1-5-21-239039659-1557409311-833459281-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKU\S-1-5-21-239039659-1557409311-833459281-1001 -> No Name - {51A86BB3-6602-4C85-92A5-130EE4864F13} - No File Toolbar: HKU\S-1-5-21-239039659-1557409311-833459281-1001 -> No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{509019B7-CE0A-44C7-8290-ED285CF2DDB6}: [NameServer] 213.94.78.17 213.94.78.16 Tcpip\..\Interfaces\{EBDB00C2-C705-4670-8935-8BF6C478DA9D}: [NameServer] 213.94.78.17 213.94.78.16 FireFox: ======== FF ProfilePath: C:\Users\Bernadett\AppData\Roaming\Mozilla\Firefox\Profiles\cxee9smy.default-1416210355170 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Extension: Adblock Plus - C:\Users\Bernadett\AppData\Roaming\Mozilla\Firefox\Profiles\cxee9smy.default-1416210355170\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-17] FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com [2014-02-23] FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-02-23] FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [] CHR HKLM-x32\...\Chrome\Extension: [maeiepphbmmcgpcnalhdnobgijjphace] - C:\Users\Bernadett\AppData\Local\BcoolApp\Chrome\BcoolApp.crx [] CHR HKLM-x32\...\Chrome\Extension: [ommhmgednjnodcljhlljkaiidghdmikk] - C:\Users\Bernadett\AppData\Local\CRE\ommhmgednjnodcljhlljkaiidghdmikk.crx [] CHR HKLM-x32\...\Chrome\Extension: [pmlghpafmmnmmkjdhacccolfgnkiboco] - C:\Program Files (x86)\1ClickDownload\oneclickdownloader11.crx [] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S4 Aircard Connection. RunOuc; C:\Users\Bernadett\Desktop\Aircard Connection\UpdateDog\ouc.exe [657504 2012-11-12] () R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [995064 2014-10-23] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG) S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2011-10-16] (Macrovision Europe Ltd.) [File not signed] S4 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () S2 lxebCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [45736 2010-04-14] (Lexmark International, Inc.) R2 lxeb_device; C:\Windows\system32\lxebcoms.exe [1052328 2010-04-14] ( ) R2 lxeb_device; C:\Windows\SysWOW64\lxebcoms.exe [598696 2010-04-14] ( ) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-11-02] () S3 wifimansvc; C:\Users\Bernadett\Desktop\Aircard Connection\eap\wifimansvc.exe [605696 2012-11-23] () [File not signed] S2 WinDefend; %ProgramFiles(x86)%\Windows Defender\mpsvc.dll [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 AsyncMac; C:\Windows\SysWOW64\DRIVERS\asyncmac.sys [23040 2009-07-14] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-23] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-23] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG) R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2009-12-15] (Bytemobile, Inc.) [File not signed] R1 cdrom; C:\Windows\SysWOW64\DRIVERS\cdrom.sys [147456 2010-11-20] (Microsoft Corporation) S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [242688 2012-12-22] (Huawei Technologies Co., Ltd.) R3 intelppm; C:\Windows\SysWOW64\DRIVERS\intelppm.sys [62464 2009-07-14] (Microsoft Corporation) R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( ) R0 NDIS; C:\Windows\SysWOW64\drivers\ndis.sys [950128 2012-08-22] (Microsoft Corporation) R3 Ndisuio; C:\Windows\SysWOW64\DRIVERS\ndisuio.sys [56832 2010-11-20] (Microsoft Corporation) R3 NDProxy; C:\Windows\SysWow64\Drivers\NDProxy.sys [57856 2010-11-20] (Microsoft Corporation) R1 NetBIOS; C:\Windows\SysWOW64\DRIVERS\netbios.sys [44544 2009-07-14] (Microsoft Corporation) R1 NetBT; C:\Windows\SysWOW64\DRIVERS\netbt.sys [261632 2010-11-20] (Microsoft Corporation) R1 Null; C:\Windows\SysWow64\Drivers\Null.sys [6144 2009-07-14] (Microsoft Corporation) R0 Tcpip; C:\Windows\SysWOW64\drivers\tcpip.sys [1903552 2014-04-05] (Microsoft Corporation) S3 TCPIP6; C:\Windows\SysWOW64\DRIVERS\tcpip.sys [1903552 2014-04-05] (Microsoft Corporation) R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2009-12-15] (Bytemobile, Inc.) [File not signed] R1 tdx; C:\Windows\SysWOW64\DRIVERS\tdx.sys [119296 2010-11-20] (Microsoft Corporation) R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13832 2010-04-17] () S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 massfilter; system32\drivers\massfilter.sys [X] S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) NETSVCx32: AppInfo -> C:\Windows\SysWOW64\appinfo.dll ==> No File. NETSVCx32: browser -> C:\Windows\SysWOW64\browser.dll ==> No File. NETSVCx32: EapHost -> C:\Windows\SysWOW64\eapsvc.dll ==> No File. NETSVCx32: hkmsvc -> C:\Windows\SysWOW64\kmsvc.dll ==> No File. NETSVCx32: IKEEXT -> C:\Windows\SysWOW64\ikeext.dll ==> No File. NETSVCx32: MMCSS -> C:\Windows\SysWOW64\mmcss.dll ==> No File. NETSVCx32: ProfSvc -> C:\Windows\SysWOW64\profsvc.dll ==> No File. NETSVCx32: seclogon -> %windir%\SysWOW64\seclogon.dll ==> No File. NETSVCx32: wercplsupport -> C:\Windows\SysWOW64\wercplsupport.dll ==> No File. NETSVCx32: BDESVC -> C:\Windows\SysWOW64\bdesvc.dll ==> No File. ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-18 13:54 - 2014-11-18 13:54 - 02117120 _____ (Farbar) C:\Users\Bernadett\Downloads\FRST64(1).exe 2014-11-17 07:18 - 2014-11-17 07:39 - 00000000 ____D () C:\AdwCleaner 2014-11-17 07:15 - 2014-11-17 07:15 - 00001059 _____ () C:\Users\Bernadett\Desktop\mbam.txt 2014-11-15 05:11 - 2009-05-30 14:36 - 00000188 ____N () C:\Users\Bernadett\Desktop\all-free-download.com.url 2014-11-15 05:11 - 2008-12-24 20:54 - 02941569 ____N () C:\Users\Bernadett\Desktop\silhouettes1.ai 2014-11-15 05:01 - 2014-11-15 05:01 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft 2014-11-15 05:01 - 2014-11-15 05:01 - 00000000 ____D () C:\Users\Bernadett\AppData\Roaming\Abelssoft 2014-11-15 05:00 - 2014-11-15 05:01 - 00000000 ____D () C:\Users\Bernadett\AppData\Local\Abelssoft 2014-11-15 05:00 - 2014-11-15 05:00 - 00001472 _____ () C:\Users\Bernadett\Desktop\Goodgame Empire.lnk 2014-11-15 05:00 - 2014-11-15 05:00 - 00000000 ____D () C:\Users\Bernadett\AppData\Roaming\DesktopIconGoodgame 2014-11-15 05:00 - 2014-11-15 05:00 - 00000000 ____D () C:\ProgramData\XDMessagingv4 2014-11-15 04:59 - 2014-11-15 04:59 - 01125200 _____ () C:\Users\Bernadett\Downloads\7 Zip 32 Bit - CHIP-Installer.exe 2014-11-14 07:50 - 2014-11-14 07:50 - 00000000 ____D () C:\Users\Bernadett\AppData\Roaming\Avira 2014-11-14 07:43 - 2014-10-23 14:02 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-11-14 07:43 - 2014-10-23 14:02 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-11-14 07:43 - 2014-10-23 14:01 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-11-14 06:54 - 2014-11-14 06:54 - 04583464 _____ (Avira Operations GmbH & Co. KG) C:\Users\Bernadett\Downloads\avira_de_av_5639275324__ws.exe 2014-11-14 06:54 - 2014-11-14 06:54 - 04583464 _____ (Avira Operations GmbH & Co. KG) C:\Users\Bernadett\Downloads\avira_de_av_42851081_otz1hicyi1imhx0w1y3w_wd.exe 2014-11-14 06:45 - 2014-11-14 06:45 - 04583464 _____ (Avira Operations GmbH & Co. KG) C:\Users\Bernadett\Downloads\avira_de_av_42851081_ebsw39yed68bk5ji6nvq_wd.exe 2014-11-14 06:41 - 2014-11-14 06:41 - 04583464 _____ (Avira Operations GmbH & Co. KG) C:\Users\Bernadett\Downloads\avira_de_av_42851081_w2tnnutgimydxt8n6lhp_wd.exe 2014-11-14 06:32 - 2014-11-14 06:32 - 00028826 _____ () C:\ComboFix.txt 2014-11-14 05:34 - 2014-11-14 05:34 - 00000000 __SHD () C:\Users\Bernadett\AppData\Local\EmieBrowserModeList 2014-11-14 04:35 - 2010-11-20 10:21 - 00119296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\tdx.sys 2014-11-14 04:34 - 2009-07-14 01:10 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\ws2ifsl.sys 2014-11-14 04:34 - 2009-07-14 00:19 - 00105472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\i8042prt.sys 2014-11-14 04:33 - 2010-11-20 11:52 - 00057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\ndproxy.sys 2014-11-14 04:32 - 2009-07-14 01:00 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\Serial.sys 2014-11-14 04:31 - 2010-11-20 10:19 - 00147456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\cdrom.sys 2014-11-14 04:31 - 2009-07-14 01:10 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\asyncmac.sys 2014-11-14 04:30 - 2010-11-20 10:23 - 00261632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\netbt.sys 2014-11-14 04:29 - 2014-04-05 03:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\tcpip.sys 2014-11-14 04:28 - 2013-11-27 02:42 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\usbehci.sys 2014-11-14 04:28 - 2009-07-14 00:19 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\intelppm.sys 2014-11-14 04:27 - 2009-07-14 01:09 - 00044544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\netbios.sys 2014-11-14 04:26 - 2012-08-22 19:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\ndis.sys 2014-11-14 04:26 - 2010-11-20 11:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\ndisuio.sys 2014-11-14 04:25 - 2014-05-30 07:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\afd.sys 2014-11-14 04:24 - 2009-07-14 00:19 - 00006144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\null.sys 2014-11-14 04:01 - 2014-11-14 06:32 - 00000000 ____D () C:\Qoobox 2014-11-14 04:01 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-11-14 04:01 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-11-14 04:01 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-11-14 04:01 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-11-14 04:01 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-11-14 04:01 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-11-14 04:01 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-11-14 04:01 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-11-14 04:00 - 2014-11-14 06:11 - 05597734 ____R (Swearware) C:\Users\Bernadett\Downloads\ComboFix.exe 2014-11-14 04:00 - 2014-11-14 04:44 - 00000000 ____D () C:\Windows\erdnt 2014-11-13 19:15 - 2014-11-13 19:15 - 00368256 _____ (RegNow.com) C:\Users\Bernadett\Downloads\Download_MaxSDDMnew(3).exe 2014-11-13 18:55 - 2011-11-04 21:44 - 00001389 __RSH () C:\Windows\system32\Drivers\etc\hosts.backup 2014-11-13 18:53 - 2014-11-13 18:55 - 00000000 ____D () C:\ProgramData\Max Secure 2014-11-13 18:49 - 2014-11-13 18:49 - 00368256 _____ (RegNow.com) C:\Users\Bernadett\Downloads\Download_MaxSDDMnew(2).exe 2014-11-13 18:48 - 2014-11-13 18:48 - 00368256 _____ (RegNow.com) C:\Users\Bernadett\Downloads\Download_MaxSDDMnew(1).exe 2014-11-13 18:35 - 2014-11-13 18:46 - 248139584 _____ (Max Secure Software ) C:\Users\Bernadett\Downloads\maxspywaredetectorx64.exe 2014-11-13 18:27 - 2014-11-13 18:27 - 00368256 _____ (RegNow.com) C:\Users\Bernadett\Downloads\Download_MaxSDDMnew.exe 2014-11-13 18:04 - 2014-11-13 18:04 - 00000000 ____D () C:\Users\Bernadett\AppData\Local\VS Revo Group 2014-11-13 18:04 - 2014-11-13 18:04 - 00000000 ____D () C:\ProgramData\VS Revo Group 2014-11-13 18:03 - 2014-11-13 18:03 - 10691640 _____ (VS Revo Group ) C:\Users\Bernadett\Downloads\RevoUninProSetup.exe 2014-11-13 13:13 - 2014-11-13 13:13 - 00003584 _____ () C:\Users\Bernadett\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-11-13 12:45 - 2014-11-13 12:45 - 15026069 _____ () C:\Users\Bernadett\Desktop\cityvision.mp4 2014-11-13 00:42 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-11-13 00:42 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-11-13 00:42 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-11-13 00:41 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-11-13 00:41 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll 2014-11-13 00:41 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-11-13 00:41 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2014-11-13 00:41 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2014-11-13 00:41 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-11-13 00:41 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-11-13 00:41 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2014-11-13 00:41 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2014-11-13 00:40 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-11-13 00:40 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-11-13 00:40 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-11-13 00:40 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-11-13 00:40 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-11-13 00:40 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-11-13 00:40 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-11-13 00:40 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-11-13 00:40 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-11-13 00:40 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-11-13 00:40 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-11-13 00:40 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-11-13 00:40 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-11-13 00:40 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-11-13 00:40 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-11-13 00:40 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-11-13 00:40 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-11-13 00:40 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-11-13 00:40 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-11-13 00:40 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-11-13 00:40 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-11-13 00:40 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-11-13 00:40 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-11-13 00:40 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-11-13 00:40 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-11-13 00:40 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-11-13 00:40 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-11-13 00:40 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-11-13 00:40 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-11-13 00:40 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-11-13 00:40 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-11-13 00:40 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-11-13 00:40 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-11-13 00:40 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-11-13 00:40 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-11-13 00:40 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-11-13 00:40 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-11-13 00:40 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-11-13 00:40 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-11-13 00:40 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-11-13 00:40 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-11-13 00:40 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-11-13 00:40 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-11-13 00:40 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-11-13 00:40 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-11-13 00:40 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-11-13 00:40 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-11-13 00:40 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-11-13 00:40 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-11-13 00:40 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-11-13 00:40 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-11-13 00:40 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-11-13 00:40 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-11-13 00:40 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-11-13 00:40 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-11-13 00:40 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-11-13 00:40 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL 2014-11-13 00:40 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL 2014-11-13 00:40 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL 2014-11-13 00:40 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL 2014-11-13 00:40 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL 2014-11-13 00:40 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL 2014-11-13 00:40 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL 2014-11-13 00:40 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL 2014-11-13 00:40 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL 2014-11-13 00:40 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL 2014-11-13 00:40 - 2014-07-08 23:38 - 00419992 _____ () C:\Windows\system32\locale.nls 2014-11-13 00:40 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls 2014-11-13 00:38 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-11-13 00:38 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-11-13 00:38 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-11-13 00:38 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-11-13 00:38 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL 2014-11-13 00:38 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL 2014-11-13 00:37 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2014-11-13 00:37 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2014-11-13 00:37 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2014-11-13 00:37 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2014-11-13 00:37 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2014-11-13 00:37 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll 2014-11-13 00:37 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll 2014-11-13 00:37 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll 2014-11-13 00:37 - 2014-09-19 10:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-11-13 00:37 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-11-13 00:37 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-11-13 00:37 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-11-13 00:37 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-11-13 00:37 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-11-13 00:37 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-11-13 00:37 - 2014-09-19 10:23 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-11-13 00:37 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-11-13 00:37 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-11-13 00:37 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2014-11-13 00:37 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-11-13 00:37 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-11-13 00:37 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-11-13 00:35 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-11-13 00:35 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll 2014-11-13 00:35 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-11-13 00:34 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2014-11-13 00:34 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2014-11-13 00:34 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-11-13 00:34 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-11-12 20:39 - 2014-11-12 20:41 - 00036309 _____ () C:\Users\Bernadett\Downloads\Addition.txt 2014-11-12 20:38 - 2014-11-18 13:54 - 00021120 _____ () C:\Users\Bernadett\Downloads\FRST.txt 2014-11-12 20:37 - 2014-11-18 13:54 - 00000000 ____D () C:\FRST 2014-11-12 20:37 - 2014-11-12 20:37 - 02116096 _____ (Farbar) C:\Users\Bernadett\Downloads\FRST64.exe 2014-11-12 20:35 - 2014-11-12 20:35 - 01107968 _____ (Farbar) C:\Users\Bernadett\Downloads\FRST.exe 2014-11-12 20:24 - 2014-11-12 20:25 - 04892480 _____ (WinZip International LLC ) C:\Users\Bernadett\Downloads\wzmp_8.exe 2014-11-12 19:31 - 2014-11-13 03:40 - 00002872 _____ () C:\Windows\system32\TmInstall.log 2014-11-12 19:31 - 2014-11-12 19:31 - 00004280 _____ () C:\Windows\SysWOW64\TmInstall.log 2014-11-12 15:52 - 2014-11-12 15:52 - 01055936 _____ (Adobe) C:\Users\Bernadett\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe 2014-11-12 13:25 - 2014-11-17 07:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-11-12 13:25 - 2014-11-12 13:25 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-11-11 11:07 - 2014-11-11 12:16 - 00000000 ____D () C:\Users\Bernadett\Desktop\Rechnungen Genf 2014-11-10 11:17 - 2014-11-10 11:17 - 00000000 __SHD () C:\Users\Bernadett\AppData\Local\EmieUserList 2014-11-10 11:17 - 2014-11-10 11:17 - 00000000 __SHD () C:\Users\Bernadett\AppData\Local\EmieSiteList 2014-11-10 06:28 - 2014-11-17 07:52 - 00000000 ____D () C:\Windows\system32\log 2014-11-10 06:27 - 2014-11-10 06:27 - 17417312 _____ (Elex do Brasil Participações Ltda) C:\Users\Bernadett\Downloads\yet_another_cleaner_sk_6231361.exe 2014-11-10 06:07 - 2014-11-13 03:35 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-11-10 03:45 - 2014-06-27 03:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-11-10 03:45 - 2014-06-27 02:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-11-10 03:04 - 2014-06-30 23:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-11-10 03:04 - 2014-06-30 23:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2014-11-10 03:04 - 2014-03-09 22:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-11-10 03:04 - 2014-03-09 22:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-11-10 03:04 - 2014-03-09 22:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2014-11-10 03:04 - 2014-03-09 22:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2014-11-10 03:03 - 2014-06-06 07:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-11-10 03:03 - 2014-06-06 07:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-11-09 18:02 - 2014-11-12 15:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AudibleManager 2014-11-09 18:02 - 2014-11-09 18:02 - 00255352 _____ (Audible, Inc.) C:\Windows\SysWOW64\awrdscdc.ax 2014-11-09 18:02 - 2014-11-09 18:02 - 00001927 _____ () C:\Users\UpdatusUser\Desktop\Audible Manager.lnk 2014-11-09 18:02 - 2014-11-09 18:02 - 00001927 _____ () C:\Users\Bernadett\Desktop\Audible Manager.lnk 2014-11-09 18:01 - 2014-11-17 23:10 - 00000000 ____D () C:\Users\Bernadett\Desktop\Neuer Ordner (2) 2014-11-09 18:01 - 2014-11-12 15:11 - 00000000 ____D () C:\Users\Bernadett\Documents\Audible 2014-11-09 18:01 - 2014-11-09 18:02 - 00000000 ____D () C:\Program Files (x86)\Audible 2014-11-09 18:01 - 2014-11-09 18:01 - 01730272 _____ (Audible Inc.) C:\Users\Bernadett\Downloads\ActiveSetupN.exe 2014-11-09 18:01 - 2014-11-09 18:01 - 00000000 ____D () C:\Users\Bernadett\Desktop\Audible 2014-11-09 17:58 - 2014-11-09 17:58 - 00000287 _____ () C:\Users\Bernadett\Downloads\admhelper 2014-11-08 16:23 - 2014-06-16 03:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-11-08 16:22 - 2014-06-03 11:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-11-08 16:22 - 2014-06-03 11:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-11-08 16:22 - 2014-06-03 11:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-11-08 16:22 - 2014-06-03 10:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-11-08 16:22 - 2014-06-03 10:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-11-08 15:52 - 2014-04-25 03:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2014-11-08 15:52 - 2014-04-25 03:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll 2014-11-08 15:41 - 2014-08-01 12:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-11-08 15:41 - 2014-08-01 12:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll 2014-11-08 15:30 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll 2014-11-08 15:30 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll 2014-11-08 15:30 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll 2014-11-08 15:30 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll 2014-11-08 15:30 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll 2014-11-08 15:30 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll 2014-11-08 15:28 - 2014-04-05 03:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-11-08 15:28 - 2014-04-05 03:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2014-11-08 15:13 - 2014-03-26 15:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2014-11-08 15:13 - 2014-03-26 15:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll 2014-11-08 15:13 - 2014-03-26 15:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2014-11-08 15:13 - 2014-03-26 15:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll 2014-11-08 15:09 - 2014-06-24 04:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-11-08 15:09 - 2014-06-24 03:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-11-08 15:00 - 2014-06-18 03:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe 2014-11-08 15:00 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe 2014-11-08 14:59 - 2014-06-06 11:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-11-08 14:59 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-11-08 14:58 - 2014-05-30 07:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2014-11-08 14:49 - 2014-03-04 10:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-11-08 14:49 - 2014-03-04 10:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-11-08 14:49 - 2014-03-04 10:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-11-08 14:49 - 2014-03-04 10:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-11-08 14:49 - 2014-03-04 10:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-11-08 14:49 - 2014-03-04 10:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-11-08 14:49 - 2014-03-04 10:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-11-08 14:49 - 2014-03-04 10:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-11-08 14:49 - 2014-03-04 10:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-11-08 14:49 - 2014-03-04 10:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-11-08 14:49 - 2014-03-04 10:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-11-08 14:49 - 2014-03-04 10:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-11-08 14:49 - 2014-03-04 10:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-11-08 14:49 - 2014-03-04 10:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-11-08 14:49 - 2014-03-04 10:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-11-08 14:49 - 2014-03-04 10:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-11-08 14:49 - 2014-03-04 10:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-11-08 14:49 - 2014-03-04 10:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-11-08 14:49 - 2014-03-04 10:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-11-08 14:42 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2014-11-08 14:42 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2014-11-08 14:24 - 2014-09-09 23:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-11-08 14:24 - 2014-09-09 22:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-11-08 14:22 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll 2014-11-08 14:22 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll 2014-11-08 14:21 - 2014-06-25 03:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-11-08 14:21 - 2014-06-25 02:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-11-08 14:20 - 2014-07-17 03:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-11-08 14:20 - 2014-07-17 03:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2014-11-08 14:20 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-11-08 14:20 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll 2014-11-08 14:20 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll 2014-11-08 14:20 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll 2014-11-08 14:20 - 2014-07-17 02:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-11-08 14:20 - 2014-07-17 02:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2014-11-08 14:20 - 2014-07-17 02:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2014-11-08 14:20 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys 2014-11-08 14:20 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2014-11-08 14:11 - 2014-04-12 03:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-11-08 14:11 - 2014-04-12 03:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-11-08 14:11 - 2014-04-12 03:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-11-08 14:11 - 2014-04-12 03:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-11-08 14:11 - 2014-04-12 03:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-11-08 14:07 - 2014-08-23 03:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-11-08 14:07 - 2014-08-23 02:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-11-08 14:06 - 2014-07-14 03:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-11-08 14:06 - 2014-07-14 02:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-11-08 13:46 - 2014-11-14 06:55 - 00001099 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-11-08 13:39 - 2014-11-08 13:46 - 00000000 ____D () C:\ProgramData\Package Cache 2014-11-08 12:35 - 2014-05-14 17:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-11-08 12:35 - 2014-05-14 17:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-11-08 12:35 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-11-08 12:35 - 2014-05-14 17:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-11-08 12:35 - 2014-05-14 17:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-11-08 12:35 - 2014-05-14 17:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-11-08 12:35 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-11-08 12:35 - 2014-05-14 17:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-11-08 12:35 - 2014-05-14 17:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-11-08 12:35 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-11-08 12:34 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-11-08 12:34 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-11-08 12:34 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-11-08 12:34 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-18 13:15 - 2013-03-07 21:10 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-11-18 13:10 - 2011-01-12 16:50 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-11-18 05:42 - 2011-05-20 07:33 - 01084138 _____ () C:\Windows\WindowsUpdate.log 2014-11-17 23:11 - 2012-12-05 18:55 - 00000000 ____D () C:\Users\Bernadett\Desktop\laibach 2014-11-17 16:10 - 2011-01-12 16:50 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-11-17 09:37 - 2009-07-14 05:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-11-17 09:37 - 2009-07-14 05:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-11-17 09:28 - 2013-06-23 20:53 - 00066896 _____ () C:\Windows\setupact.log 2014-11-17 09:28 - 2012-01-10 18:44 - 00134419 _____ () C:\ProgramData\lxebscan.log 2014-11-17 09:28 - 2011-05-20 08:08 - 00045056 _____ () C:\Windows\system32\acovcnt.exe 2014-11-17 09:28 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-11-17 08:45 - 2013-11-11 09:29 - 00000000 ____D () C:\Users\Bernadett\Desktop\Alte Firefox-Daten 2014-11-17 07:53 - 2011-10-16 10:29 - 00000000 ____D () C:\Users\Bernadett 2014-11-17 07:52 - 2011-05-20 08:04 - 00000000 ____D () C:\ProgramData\P4G 2014-11-17 07:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration 2014-11-17 07:49 - 2013-12-27 19:10 - 00470528 ___SH () C:\Users\Bernadett\Desktop\Thumbs.db 2014-11-17 07:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2014-11-15 16:05 - 2011-01-12 16:50 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-11-15 16:05 - 2011-01-12 16:50 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-11-15 15:31 - 2011-10-16 10:32 - 00111672 _____ () C:\Users\Bernadett\AppData\Local\GDIPFONTCACHEV1.DAT 2014-11-15 15:30 - 2009-07-14 05:45 - 00412704 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-11-15 05:35 - 2012-01-10 19:15 - 00000000 ____D () C:\ProgramData\Lx_cats 2014-11-15 04:32 - 2012-08-06 10:37 - 00000000 ____D () C:\Program Files (x86)\BcoolApp 2014-11-14 17:02 - 2009-08-04 10:51 - 01154854 _____ () C:\Windows\system32\perfh007.dat 2014-11-14 17:02 - 2009-08-04 10:51 - 00295622 _____ () C:\Windows\system32\perfc007.dat 2014-11-14 17:02 - 2009-07-14 06:13 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-11-14 12:02 - 2013-09-12 04:51 - 01230452 _____ () C:\Windows\PFRO.log 2014-11-14 07:44 - 2013-11-11 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-11-14 07:43 - 2013-11-11 14:54 - 00000000 ____D () C:\ProgramData\Avira 2014-11-14 07:43 - 2013-11-11 14:54 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-11-14 06:26 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2014-11-14 06:00 - 2011-10-16 11:12 - 00000000 ____D () C:\Users\Bernadett\AppData\Local\Google 2014-11-14 06:00 - 2011-01-12 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-11-14 06:00 - 2011-01-12 16:49 - 00000000 ____D () C:\Program Files (x86)\Google 2014-11-14 05:54 - 2013-09-26 20:05 - 00000000 ____D () C:\Users\Bernadett\AppData\Roaming\Dropbox 2014-11-14 04:49 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2014-11-14 04:36 - 2009-07-14 03:34 - 93847552 _____ () C:\Windows\system32\config\software.bak 2014-11-14 04:36 - 2009-07-14 03:34 - 22020096 _____ () C:\Windows\system32\config\system.bak 2014-11-14 04:36 - 2009-07-14 03:34 - 00524288 _____ () C:\Windows\system32\config\default.bak 2014-11-14 04:36 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\security.bak 2014-11-14 04:36 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak 2014-11-13 19:15 - 2011-12-21 17:54 - 00000000 ____D () C:\Users\Bernadett\AppData\Roaming\GetRightToGo 2014-11-13 19:09 - 2011-05-20 08:08 - 00001672 _____ () C:\Windows\system32\ServiceFilter.ini 2014-11-13 19:08 - 2011-05-20 08:08 - 00002578 _____ () C:\Windows\system32\AutoRunFilter.ini 2014-11-13 04:23 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-11-13 03:36 - 2012-07-24 05:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-11-13 03:19 - 2011-10-16 10:44 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-11-13 03:08 - 2013-11-11 11:13 - 00000000 ____D () C:\Windows\system32\MRT 2014-11-13 03:03 - 2011-12-09 17:56 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-11-12 19:31 - 2011-01-12 17:05 - 00000000 ____D () C:\ProgramData\Trend Micro 2014-11-12 19:28 - 2011-12-26 10:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\syncables 2014-11-12 19:28 - 2011-01-12 17:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game Park 2014-11-12 19:24 - 2011-10-16 10:30 - 00000000 ____D () C:\ASUS.DAT 2014-11-12 19:24 - 2011-05-20 07:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility 2014-11-12 18:29 - 2014-02-23 13:21 - 00000000 ____D () C:\Program Files (x86)\mozilla firefox 2014-11-12 15:53 - 2011-10-16 15:03 - 00000000 ____D () C:\Users\Bernadett\AppData\Local\Adobe 2014-11-12 15:21 - 2013-01-18 17:14 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-11-12 15:17 - 2013-03-07 21:10 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-11-12 15:16 - 2013-03-07 21:10 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-12 15:16 - 2011-11-01 19:00 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-12 15:11 - 2014-03-20 18:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-11-12 15:11 - 2011-11-01 19:00 - 00000000 ____D () C:\Windows\system32\Macromed 2014-11-12 15:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-11-12 15:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat 2014-11-12 15:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2014-11-12 14:21 - 2012-08-15 07:23 - 00000000 ____D () C:\Users\Bernadett\AppData\Local\CRE 2014-11-11 11:26 - 2014-02-17 11:20 - 00200192 ___SH () C:\Users\Bernadett\Downloads\Thumbs.db 2014-11-10 07:08 - 2011-05-20 07:56 - 00000000 ___HD () C:\Program Files (x86)\Temp 2014-11-10 07:08 - 2011-05-20 07:56 - 00000000 ____D () C:\Program Files (x86)\Realtek 2014-11-10 06:13 - 2012-05-12 02:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-11-10 06:13 - 2012-05-12 02:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-11-10 06:08 - 2009-07-14 08:45 - 00000000 ____D () C:\Program Files\Windows Journal 2014-11-10 06:07 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism 2014-11-10 06:07 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism 2014-11-10 03:58 - 2012-05-12 02:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-11-09 18:02 - 2012-12-09 17:17 - 00000000 ____D () C:\Users\Bernadett\AppData\Local\Audible 2014-11-08 14:34 - 2014-04-22 11:30 - 00000000 ____D () C:\Users\Bernadett\Desktop\SVEN 2014-11-08 10:50 - 2012-12-10 17:19 - 00000000 ____D () C:\Users\Bernadett\Desktop\oma 2014-11-04 14:30 - 2011-11-18 18:13 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe Some content of TEMP: ==================== C:\Users\Bernadett\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-11-15 01:46 ==================== End Of Log ============================ lieber schrauber, vielen dank für deine beharrlichkeit, ich habe selbst keine ahnung warum jetzt alles wieder normal funktioniert... die log datei habe ich dir auch nicht in dem gleichen format wie beim ersten mal senden können, weil ich leider nicht mal weiß wie das geht.. es tut mir leid so ein hoffnungsloser analphabet zu sein! danke für deine mühe! |
==================== End Of Log ============================ asd so..jetzt is es wieder da ;-( |
Zitat:
|
lieber schrauber, ich bitte dich nicht wütend zu werden. Ich habe von anfang an gesagt, dass ich mich nicht gut auskenne mit den computern, und von anfang an erwähnt, dass man ein bisschen geduld mit mir haben muss..und mir dinge sehr genau, schritt für schritt erklären.. weiters habe ich mich sicher bei jeder nachricht für meine unwissenheit entschuldigt. ich werde einen tag auf diese eigenartige seite verbunden, gestern nicht, heute schon.. zb kann ich nicht mal auf die seite 2 unseres threads klicken , da ich dann auf diese seite verbunden werde...na und vorgestern war überhaupt kein einziges mal eine umleitung. wenn du die geduld verloren hast, hast du vielleicht einen tipp an wen ich mich noch wenden kann? bernadette |
Ich verliere die Geduld nit, du musst nur dran denken genauer zu beschreiben was Sache ist :) Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Ist im Firefox jetzt Ruhe? FRST öffnen, Haken setzen bei Addition und scannen, poste bitte beide Logfiles. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 21:21 Uhr. |
Copyright ©2000-2025, Trojaner-Board
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 