Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Beim abhören der Verbindungen VPNpool entdeckt. Wurde mein PC gehackt? (https://www.trojaner-board.de/136667-beim-abhoeren-verbindungen-vpnpool-entdeckt-wurde-pc-gehackt.html)

Laxanon 15.06.2013 20:39
Beim abhören der Verbindungen VPNpool entdeckt. Wurde mein PC gehackt?
 
Liste der Anhänge anzeigen (Anzahl: 1)
Heute war mein internet auf einmal wieder sehr langsam (nichts ungewöhnliches aufm land aber nur viel schlimmer) und ich konnte keine internetseite laden. ich habe dann über die CMD (netstat -a) nachgeguckt welche Dinge verbindung zum netzwerk hergestellt hatten (schlechte hacker fallen da schnell ma auf ;) auf jedenfall stand dort VPNPOOL01 - 0448 HERGESTELLT. ich hatte vor einer woche schonmal sowas VPNPOOL01 -0285 (nach verfolgt: kommt aus der uni münster (was wollen die von mir?!) und WLA000414WPA irgendwo aus china (und was ich den chinesen getan hab wies ich auch nich :o oder es warn proxy) damals war mein netz auch so dermaßen langsam. zudem ist es nicht das erste mal das mein pc gehackt wurde. was kann ich dagegen tun? ich hatte letztes mal meinen pc neu aufgesetzt und so weiter (auch keine sicherheitskopien übertragen) und jeden tag meinen pc mit kaspersky gescannt (voller scan) ich frag mich jetzt nur was das wieder sein könnte. bei kaspersky hatte ich auch nie einen fund. ich habe zudem nicht sonderlcih lust wieder so nen tollen brief von der telekom zu bekommen in dem steht das mein pc gehackt wurde und darüber jemand schaden bei anderen verursacht...

proxys benutze ich auf dem rechner nicht und nunja... mit neu aufsetzen wird ncihts. ich hatte eine recoveryfestplatte auf der windoof war. nach dem letzten mal neu aufsetzen ist se weg und somit auch meine virtuelle 'windows-cd' :headbang:

hab im anhang ma nen screenshot von der WLA000414WPA

schrauber 15.06.2013 20:45
hi,

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Scan.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Laxanon 15.06.2013 20:52
Einmal FRST.txt


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-06-2013
Ran by Förster (administrator) on 15-06-2013 21:48:09
Running from C:\Users\Förster\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\ProgramData\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
(Creative Technology Ltd) C:\Windows\sysWow64\CtHdaSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
() C:\ProgramData\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Logitech(c)) C:\Program Files (x86)\Logitech\G35\G35.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3D PCIe\Sound Blaster Recon3D PCIe Control Panel\SBRnPCIe.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Förster\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKCU\...\Run: [Google Update] "C:\Users\Förster\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2013-03-26] (Google Inc.)
HKCU\...\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent [1641896 2013-06-07] (Valve Corporation)
HKCU\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Wisdom-soft AutoScreenRecorder 3.1 Pro] 0 [x]
MountPoints2: {bc050c47-92cb-11e2-ab08-806e6f6e6963} - D:\install.exe
HKLM-x32\...\Run: [Logitech G35] C:\Program Files (x86)\Logitech\G35\G35.exe [1811800 2010-10-05] (Logitech(c))
HKLM-x32\...\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2013-03-26] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [UpdReg] C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Sound Blaster Recon3D PCIe Control Panel] "C:\Program Files (x86)\Creative\Sound Blaster Recon3D PCIe\Sound Blaster Recon3D PCIe Control Panel\SBRnPCIe.exe" /r [880128 2011-11-14] (Creative Technology Ltd)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide [204136 2012-09-13] (Logitech Inc.)

==================== Internet (Whitelisted) ====================

SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome:
=======
CHR HomePage: hxxp://www2.delta-search.com/?affID=121562&babsrc=HP_ss&mntrId=CCC994DBC97895B4
CHR RestoreOnStartup: "hxxp://www2.delta-search.com/?affID=121562&babsrc=HP_ss&mntrId=CCC994DBC97895B4"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\F\u00F6rster\AppData\Local\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\F\u00F6rster\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\F\u00F6rster\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll No File
CHR Plugin: (Google Update) - C:\Users\F\u00F6rster\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (Search by Image for Google\u2122) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\agdigejhabbnmfbbebmchkkjhcdjmeli\1.4_0
CHR Extension: (Google Docs) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Search by Image (by Google)) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm\1.4.3_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (AdBlock) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.64_0
CHR Extension: (Safe Money) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0
CHR Extension: (Content Blocker) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Lord of the Rings) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbjlpffkkkndaegmljeiheebaedgdiab\2.8_0
CHR Extension: (My Chrome Theme) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\oehpjpccmlcalbenfhnacjeocbjdonic\2.0_0
CHR Extension: (Gmail) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Anti-Banner) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0

==================== Services (Whitelisted) =================

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-03-26] (Kaspersky Lab ZAO)
R2 BrowserProtect; C:\ProgramData\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [3085264 2013-06-03] ()
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [103424 2013-02-14] (Creative Technology Ltd)
R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 cthda; C:\Windows\System32\drivers\cthda.sys [1044760 2013-02-14] (Creative Technology Ltd)
R3 cthdb; C:\Windows\System32\DRIVERS\cthdb.sys [28440 2013-02-14] (Creative Technology Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-04-23] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-10-25] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-10-25] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55056 2013-04-23] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-23] (Kaspersky Lab ZAO)
R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [62168 2010-09-29] (Logitech)
R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [377176 2010-09-29] (Logitech)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-15 21:47 - 2013-06-15 21:47 - 00000000 ____D C:\FRST
2013-06-15 21:46 - 2013-06-15 21:47 - 01920546 ____A (Farbar) C:\Users\Förster\Downloads\FRST64.exe
2013-06-13 21:20 - 2013-05-17 03:25 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 21:20 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 21:20 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 21:20 - 2013-05-17 02:58 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 21:20 - 2013-05-14 15:14 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 21:20 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 21:20 - 2013-05-14 11:23 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-13 21:20 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2012
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2012
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\6f2eaa2ffdc2b089af3922f5ecd241c0
2013-06-12 18:04 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 18:04 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 18:04 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 18:04 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 18:04 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 18:04 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 18:04 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 18:04 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 18:04 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 18:04 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 18:03 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 18:03 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 18:03 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 18:00 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 18:00 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 18:00 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 18:00 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 18:00 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 18:00 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 17:55 - 2013-06-11 17:55 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2010
2013-06-11 17:55 - 2013-06-11 17:55 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2010
2013-06-11 14:59 - 2013-06-11 15:03 - 00000000 ____D C:\Users\Förster\Documents\Visual Studio 2012
2013-06-11 14:58 - 2013-06-11 14:58 - 00000000 ____D C:\Program Files (x86)\NuGet
2013-06-11 14:48 - 2013-06-11 14:48 - 00000000 ____D C:\Windows\symbols
2013-06-11 14:45 - 2013-06-11 14:45 - 00000000 ____D C:\Program Files (x86)\Windows Kits
2013-06-11 14:44 - 2013-06-11 14:46 - 00000000 ____D C:\Users\Förster\AppData\Roaming\TrueCrypt
2013-06-11 14:43 - 2013-06-11 14:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Help Viewer
2013-06-11 14:39 - 2013-06-11 14:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 11.0
2013-06-11 14:37 - 2013-06-11 14:37 - 00231376 ____A (TrueCrypt Foundation) C:\Windows\System32\Drivers\truecrypt.sys
2013-06-11 14:37 - 2013-06-11 14:37 - 00000527 ____A C:\Users\Public\Desktop\TrueCrypt.lnk
2013-06-11 14:34 - 2013-06-11 14:35 - 03466248 ____A (TrueCrypt Foundation) C:\Users\Förster\Downloads\TrueCrypt Setup 7.1a.exe
2013-06-11 14:25 - 2013-06-12 21:31 - 00000000 ____D C:\ProgramData\Package Cache
2013-06-11 14:23 - 2013-06-11 14:23 - 00937632 ____A (Microsoft Corporation) C:\Users\Förster\Downloads\wdexpress_full.exe
2013-06-11 14:22 - 2013-06-11 14:22 - 00001391 ____A C:\Users\Förster\Desktop\Microsoft Visual Basic 2010 Express.lnk
2013-06-10 21:44 - 2013-06-10 21:44 - 00000000 ____D C:\Windows\System32\RsFx
2013-06-10 21:44 - 2009-07-21 02:42 - 00111640 ____A (Microsoft Corporation) C:\Windows\System32\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2013-06-10 21:44 - 2009-07-21 02:42 - 00079896 ____A (Microsoft Corporation) C:\Windows\SysWOW64\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2013-06-10 21:44 - 2009-07-21 02:42 - 00078872 ____A (Microsoft Corporation) C:\Windows\System32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2013-06-10 21:44 - 2009-07-21 02:42 - 00050200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2013-06-10 21:43 - 2013-06-11 14:42 - 00000000 ____D C:\Windows\SysWOW64\1033
2013-06-10 21:43 - 2013-06-11 14:42 - 00000000 ____D C:\Windows\SysWOW64\1031
2013-06-10 21:43 - 2013-06-11 14:42 - 00000000 ____D C:\Windows\System32\1033
2013-06-10 21:43 - 2013-06-11 14:42 - 00000000 ____D C:\Windows\System32\1031
2013-06-10 21:43 - 2013-06-10 21:43 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 9.0
2013-06-10 21:43 - 2013-06-10 21:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 9.0
2013-06-10 21:41 - 2013-06-11 14:42 - 00000000 ____D C:\Program Files\Microsoft SQL Server
2013-06-10 21:39 - 2013-06-11 14:41 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2013-06-10 21:39 - 2013-06-11 14:41 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server
2013-06-10 21:39 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files\Microsoft Synchronization Services
2013-06-10 21:39 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Synchronization Services
2013-06-10 21:38 - 2013-06-10 21:48 - 00000000 ____D C:\Users\Förster\Documents\Visual Studio 2010
2013-06-10 21:37 - 2013-06-10 21:46 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 10.0
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files\Microsoft Help Viewer
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs
2013-06-10 21:33 - 2013-06-10 21:33 - 03296584 ____A (Microsoft Corporation) C:\Users\Förster\Downloads\vbasic_web (1).exe
2013-06-10 21:11 - 2013-06-11 14:12 - 00000053 ____A C:\Users\Förster\Desktop\aufgaben.txt
2013-06-10 20:35 - 2013-06-10 21:01 - 00000119 ____A C:\Users\Förster\Desktop\Neues Textdokument (2).txt
2013-06-09 19:01 - 2013-06-09 19:01 - 00393080 ____A (Softonic                                        ) C:\Users\Förster\Downloads\SoftonicDownloader_fuer_aspicore-gsm-tracker.exe
2013-06-09 15:33 - 2013-06-10 19:15 - 00001833 ____A C:\Users\Förster\Desktop\hack.txt
2013-06-09 13:41 - 2013-06-09 19:49 - 00000000 ____D C:\Users\Förster\Documents\dragoon
2013-06-09 13:27 - 2013-06-09 13:27 - 00001063 ____A C:\Users\Public\Desktop\Dragon's Prophet.lnk
2013-06-09 13:20 - 2013-06-09 19:49 - 00000000 ____D C:\Program Files (x86)\Dragon's Prophet
2013-06-09 11:28 - 2013-06-09 11:30 - 00000000 ____D C:\Users\Förster\AppData\Roaming\Stencyl
2013-06-08 20:50 - 2013-06-09 13:18 - 00000000 ____D C:\Users\Förster\Desktop\Dragon's Prophet
2013-06-08 20:49 - 2013-06-08 20:49 - 01873863 ____A (Infernum Productions AG                                    ) C:\Users\Förster\Downloads\DragonsProphetDownloader.exe
2013-06-08 20:41 - 2013-06-08 20:41 - 00000000 ____D C:\Program Files (x86)\Stencyl
2013-06-08 18:34 - 2013-06-08 18:41 - 61653476 ____A (Stencyl, LLC) C:\Users\Förster\Downloads\Stencyl-2.1.0.exe
2013-06-07 06:44 - 2013-06-07 06:44 - 00262144 ____A C:\Windows\System32\config\elam
2013-06-06 19:58 - 2013-06-06 19:58 - 00000563 ____A C:\Users\Förster\Downloads\hexenlied.mid
2013-06-06 19:54 - 2013-06-06 19:54 - 00000720 ____A C:\Users\Förster\Downloads\mannelig.mid
2013-06-06 19:53 - 2013-06-06 19:53 - 00000771 ____A C:\Users\Förster\Downloads\totentanz.mid
2013-06-06 19:45 - 2013-06-06 19:45 - 00018378 ____A C:\Users\Förster\AppData\Local\recently-used.xbel
2013-06-03 16:58 - 2013-06-03 16:58 - 00434435 ____A C:\Users\Förster\Downloads\SCHWEFELSÄURE.pptx
2013-05-31 20:40 - 2013-05-31 20:40 - 00000000 ____A C:\Users\Förster\Downloads\ni_updater.log
2013-05-31 19:26 - 2013-05-31 20:00 - 547617776 ____A C:\Users\Förster\Downloads\BITW_Ivanhoe_ver._beta_1.0.rar
2013-05-31 19:24 - 2013-05-31 19:50 - 382646090 ____A C:\Users\Förster\Downloads\NordInvasion_0.5.0.rar
2013-05-31 15:46 - 2013-05-31 16:21 - 846310613 ____A C:\Users\Förster\Downloads\Full_Invasion2.rar
2013-05-30 18:07 - 2013-05-30 18:07 - 00000221 ____A C:\Users\Förster\Desktop\Mount & Blade Warband.url
2013-05-29 21:51 - 2013-05-29 22:02 - 26769614 ____A C:\Users\Förster\Downloads\STRINGS.rar
2013-05-29 21:51 - 2013-05-29 22:00 - 20375740 ____A C:\Users\Förster\Downloads\Woodwinds.rar
2013-05-29 21:51 - 2013-05-29 21:52 - 01585697 ____A C:\Users\Förster\Downloads\mandolin.rar
2013-05-29 21:50 - 2013-05-29 21:53 - 07917339 ____A C:\Users\Förster\Downloads\BRASS.rar
2013-05-27 18:04 - 2013-05-27 18:04 - 00000238 ____A C:\Users\Förster\Documents\traurige liebe sheet.tg
2013-05-27 17:47 - 2013-05-27 17:47 - 00000000 ____D C:\Users\Förster\.tuxguitar-1.2
2013-05-27 17:46 - 2013-05-27 17:46 - 00000949 ____A C:\Users\Public\Desktop\TuxGuitar.lnk
2013-05-27 17:46 - 2013-05-27 17:46 - 00000000 ____D C:\Program Files (x86)\TuxGuitar
2013-05-27 17:42 - 2013-05-27 17:43 - 07715210 ____A (Herac) C:\Users\Förster\Downloads\tuxguitar-1.2-windows-x86-installer.exe
2013-05-27 17:20 - 2013-05-27 18:05 - 00002874 ____A C:\Users\Förster\Documents\UserPreferences.ini
2013-05-24 21:27 - 2013-05-24 21:27 - 00069577 ____A C:\Users\Förster\Documents\seraphimavatar.xcf
2013-05-24 21:10 - 2013-05-29 19:31 - 00568395 ____A C:\Users\Förster\Documents\seraphim.xcf
2013-05-23 17:45 - 2013-05-23 17:50 - 00002164 ____A C:\Users\Public\Desktop\Oblivion.lnk
2013-05-22 20:37 - 2013-05-22 20:37 - 00000000 ____D C:\Users\Förster\AppData\Local\DVDVideoSoft_Ltd
2013-05-22 20:33 - 2013-05-22 20:33 - 00001367 ____A C:\Users\Förster\Desktop\Free Screen Video Recorder.lnk
2013-05-22 20:29 - 2013-05-23 16:33 - 00000000 ____D C:\Program Files (x86)\Wisdom-soft AutoScreenRecorder 3 Pro
2013-05-20 17:23 - 2013-06-15 21:41 - 00000272 ____A C:\Users\Förster\Desktop\whistles.txt
2013-05-19 11:50 - 2013-05-19 11:50 - 00001398 ____A C:\Users\Förster\Desktop\Free YouTube to MP3 Converter.lnk

==================== One Month Modified Files and Folders =======

2013-06-15 21:47 - 2013-06-15 21:47 - 00000000 ____D C:\FRST
2013-06-15 21:47 - 2013-06-15 21:46 - 01920546 ____A (Farbar) C:\Users\Förster\Downloads\FRST64.exe
2013-06-15 21:45 - 2013-03-26 12:49 - 00000000 ____D C:\Users\Förster\AppData\Roaming\Skype
2013-06-15 21:41 - 2013-05-20 17:23 - 00000272 ____A C:\Users\Förster\Desktop\whistles.txt
2013-06-15 21:03 - 2009-07-14 06:45 - 00029392 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-15 21:03 - 2009-07-14 06:45 - 00029392 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-15 20:57 - 2013-03-26 12:02 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-15 20:56 - 2013-03-26 12:39 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-15 20:55 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-15 20:55 - 2009-07-14 06:51 - 00042985 ____A C:\Windows\setupact.log
2013-06-15 20:51 - 2013-03-26 12:34 - 00001128 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3161771069-198629159-1195633666-1000UA.job
2013-06-15 19:45 - 2013-03-22 11:02 - 01635801 ____A C:\Windows\WindowsUpdate.log
2013-06-15 16:51 - 2013-03-26 12:34 - 00001076 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3161771069-198629159-1195633666-1000Core.job
2013-06-14 16:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-13 21:21 - 2013-03-30 14:52 - 01809490 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-06-13 21:21 - 2013-03-22 12:13 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 21:21 - 2011-04-12 09:43 - 00776056 ____A C:\Windows\System32\perfh007.dat
2013-06-13 21:21 - 2011-04-12 09:43 - 00179582 ____A C:\Windows\System32\perfc007.dat
2013-06-13 21:21 - 2009-07-14 07:13 - 01809490 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2012
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2012
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\6f2eaa2ffdc2b089af3922f5ecd241c0
2013-06-12 21:31 - 2013-06-11 14:25 - 00000000 ____D C:\ProgramData\Package Cache
2013-06-12 18:00 - 2013-04-05 11:15 - 00000000 ____D C:\Users\Förster\AppData\Roaming\.minecraft
2013-06-12 16:38 - 2010-11-21 05:47 - 00158790 ____A C:\Windows\PFRO.log
2013-06-11 17:55 - 2013-06-11 17:55 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2010
2013-06-11 17:55 - 2013-06-11 17:55 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2010
2013-06-11 15:03 - 2013-06-11 14:59 - 00000000 ____D C:\Users\Förster\Documents\Visual Studio 2012
2013-06-11 14:58 - 2013-06-11 14:58 - 00000000 ____D C:\Program Files (x86)\NuGet
2013-06-11 14:56 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-06-11 14:48 - 2013-06-11 14:48 - 00000000 ____D C:\Windows\symbols
2013-06-11 14:46 - 2013-06-11 14:44 - 00000000 ____D C:\Users\Förster\AppData\Roaming\TrueCrypt
2013-06-11 14:45 - 2013-06-11 14:45 - 00000000 ____D C:\Program Files (x86)\Windows Kits
2013-06-11 14:44 - 2013-06-11 14:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 11.0
2013-06-11 14:43 - 2013-06-11 14:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Help Viewer
2013-06-11 14:43 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2013-06-11 14:42 - 2013-06-10 21:43 - 00000000 ____D C:\Windows\SysWOW64\1033
2013-06-11 14:42 - 2013-06-10 21:43 - 00000000 ____D C:\Windows\SysWOW64\1031
2013-06-11 14:42 - 2013-06-10 21:43 - 00000000 ____D C:\Windows\System32\1033
2013-06-11 14:42 - 2013-06-10 21:43 - 00000000 ____D C:\Windows\System32\1031
2013-06-11 14:42 - 2013-06-10 21:41 - 00000000 ____D C:\Program Files\Microsoft SQL Server
2013-06-11 14:41 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2013-06-11 14:41 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server
2013-06-11 14:41 - 2013-04-14 14:29 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2013-06-11 14:37 - 2013-06-11 14:37 - 00231376 ____A (TrueCrypt Foundation) C:\Windows\System32\Drivers\truecrypt.sys
2013-06-11 14:37 - 2013-06-11 14:37 - 00000527 ____A C:\Users\Public\Desktop\TrueCrypt.lnk
2013-06-11 14:35 - 2013-06-11 14:34 - 03466248 ____A (TrueCrypt Foundation) C:\Users\Förster\Downloads\TrueCrypt Setup 7.1a.exe
2013-06-11 14:23 - 2013-06-11 14:23 - 00937632 ____A (Microsoft Corporation) C:\Users\Förster\Downloads\wdexpress_full.exe
2013-06-11 14:22 - 2013-06-11 14:22 - 00001391 ____A C:\Users\Förster\Desktop\Microsoft Visual Basic 2010 Express.lnk
2013-06-11 14:12 - 2013-06-10 21:11 - 00000053 ____A C:\Users\Förster\Desktop\aufgaben.txt
2013-06-10 21:48 - 2013-06-10 21:38 - 00000000 ____D C:\Users\Förster\Documents\Visual Studio 2010
2013-06-10 21:46 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 10.0
2013-06-10 21:44 - 2013-06-10 21:44 - 00000000 ____D C:\Windows\System32\RsFx
2013-06-10 21:43 - 2013-06-10 21:43 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 9.0
2013-06-10 21:43 - 2013-06-10 21:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 9.0
2013-06-10 21:39 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files\Microsoft Synchronization Services
2013-06-10 21:39 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Synchronization Services
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files\Microsoft Help Viewer
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs
2013-06-10 21:33 - 2013-06-10 21:33 - 03296584 ____A (Microsoft Corporation) C:\Users\Förster\Downloads\vbasic_web (1).exe
2013-06-10 21:01 - 2013-06-10 20:35 - 00000119 ____A C:\Users\Förster\Desktop\Neues Textdokument (2).txt
2013-06-10 20:41 - 2013-03-27 10:34 - 00000000 ____D C:\Users\Förster\Desktop\Andere Dinge
2013-06-10 19:15 - 2013-06-09 15:33 - 00001833 ____A C:\Users\Förster\Desktop\hack.txt
2013-06-09 19:49 - 2013-06-09 13:41 - 00000000 ____D C:\Users\Förster\Documents\dragoon
2013-06-09 19:49 - 2013-06-09 13:20 - 00000000 ____D C:\Program Files (x86)\Dragon's Prophet
2013-06-09 19:01 - 2013-06-09 19:01 - 00393080 ____A (Softonic                                        ) C:\Users\Förster\Downloads\SoftonicDownloader_fuer_aspicore-gsm-tracker.exe
2013-06-09 13:31 - 2013-03-27 17:18 - 00221788 ____A C:\Windows\DirectX.log
2013-06-09 13:27 - 2013-06-09 13:27 - 00001063 ____A C:\Users\Public\Desktop\Dragon's Prophet.lnk
2013-06-09 13:18 - 2013-06-08 20:50 - 00000000 ____D C:\Users\Förster\Desktop\Dragon's Prophet
2013-06-09 11:30 - 2013-06-09 11:28 - 00000000 ____D C:\Users\Förster\AppData\Roaming\Stencyl
2013-06-09 11:30 - 2013-03-22 11:02 - 00000000 ____D C:\users\Förster
2013-06-08 20:49 - 2013-06-08 20:49 - 01873863 ____A (Infernum Productions AG                                    ) C:\Users\Förster\Downloads\DragonsProphetDownloader.exe
2013-06-08 20:41 - 2013-06-08 20:41 - 00000000 ____D C:\Program Files (x86)\Stencyl
2013-06-08 18:41 - 2013-06-08 18:34 - 61653476 ____A (Stencyl, LLC) C:\Users\Förster\Downloads\Stencyl-2.1.0.exe
2013-06-07 06:44 - 2013-06-07 06:44 - 00262144 ____A C:\Windows\System32\config\elam
2013-06-06 20:59 - 2013-04-11 17:32 - 00000000 ____D C:\Users\Förster\Documents\noten
2013-06-06 19:58 - 2013-06-06 19:58 - 00000563 ____A C:\Users\Förster\Downloads\hexenlied.mid
2013-06-06 19:54 - 2013-06-06 19:54 - 00000720 ____A C:\Users\Förster\Downloads\mannelig.mid
2013-06-06 19:53 - 2013-06-06 19:53 - 00000771 ____A C:\Users\Förster\Downloads\totentanz.mid
2013-06-06 19:52 - 2013-03-26 12:35 - 00002376 ____A C:\Users\Förster\Desktop\Google Chrome.lnk
2013-06-06 19:45 - 2013-06-06 19:45 - 00018378 ____A C:\Users\Förster\AppData\Local\recently-used.xbel
2013-06-06 19:45 - 2013-03-30 13:02 - 00000000 ____D C:\Users\Förster\.gimp-2.8
2013-06-04 13:26 - 2013-04-24 20:31 - 00000000 ____D C:\ProgramData\BrowserProtect
2013-06-03 16:58 - 2013-06-03 16:58 - 00434435 ____A C:\Users\Förster\Downloads\SCHWEFELSÄURE.pptx
2013-06-02 18:43 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-06-01 21:18 - 2013-04-14 14:48 - 00000000 ____D C:\Users\Förster\Documents\Mount&Blade Warband Savegames
2013-05-31 20:40 - 2013-05-31 20:40 - 00000000 ____A C:\Users\Förster\Downloads\ni_updater.log
2013-05-31 20:00 - 2013-05-31 19:26 - 547617776 ____A C:\Users\Förster\Downloads\BITW_Ivanhoe_ver._beta_1.0.rar
2013-05-31 19:50 - 2013-05-31 19:24 - 382646090 ____A C:\Users\Förster\Downloads\NordInvasion_0.5.0.rar
2013-05-31 16:21 - 2013-05-31 15:46 - 846310613 ____A C:\Users\Förster\Downloads\Full_Invasion2.rar
2013-05-30 20:10 - 2013-04-14 14:47 - 00000000 ____D C:\Users\Förster\AppData\Roaming\Mount&Blade Warband
2013-05-30 18:07 - 2013-05-30 18:07 - 00000221 ____A C:\Users\Förster\Desktop\Mount & Blade Warband.url
2013-05-30 13:38 - 2009-07-14 06:45 - 00355992 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-29 22:02 - 2013-05-29 21:51 - 26769614 ____A C:\Users\Förster\Downloads\STRINGS.rar
2013-05-29 22:00 - 2013-05-29 21:51 - 20375740 ____A C:\Users\Förster\Downloads\Woodwinds.rar
2013-05-29 21:53 - 2013-05-29 21:50 - 07917339 ____A C:\Users\Förster\Downloads\BRASS.rar
2013-05-29 21:52 - 2013-05-29 21:51 - 01585697 ____A C:\Users\Förster\Downloads\mandolin.rar
2013-05-29 20:03 - 2013-03-22 15:08 - 00087472 ____A C:\Users\Förster\AppData\Local\GDIPFONTCACHEV1.DAT
2013-05-29 19:31 - 2013-05-24 21:10 - 00568395 ____A C:\Users\Förster\Documents\seraphim.xcf
2013-05-27 18:05 - 2013-05-27 17:20 - 00002874 ____A C:\Users\Förster\Documents\UserPreferences.ini
2013-05-27 18:04 - 2013-05-27 18:04 - 00000238 ____A C:\Users\Förster\Documents\traurige liebe sheet.tg
2013-05-27 17:58 - 2013-03-30 14:53 - 00000000 ____D C:\Users\Förster\AppData\Local\Turbine
2013-05-27 17:47 - 2013-05-27 17:47 - 00000000 ____D C:\Users\Förster\.tuxguitar-1.2
2013-05-27 17:46 - 2013-05-27 17:46 - 00000949 ____A C:\Users\Public\Desktop\TuxGuitar.lnk
2013-05-27 17:46 - 2013-05-27 17:46 - 00000000 ____D C:\Program Files (x86)\TuxGuitar
2013-05-27 17:43 - 2013-05-27 17:42 - 07715210 ____A (Herac) C:\Users\Förster\Downloads\tuxguitar-1.2-windows-x86-installer.exe
2013-05-27 17:24 - 2013-04-05 21:13 - 00000000 ____D C:\Users\Förster\Downloads\Andere Programme
2013-05-25 14:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-05-25 14:53 - 2013-05-10 16:22 - 00000000 ____D C:\Program Files (x86)\Bethesda Softworks
2013-05-25 14:45 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-05-24 21:27 - 2013-05-24 21:27 - 00069577 ____A C:\Users\Förster\Documents\seraphimavatar.xcf
2013-05-23 17:50 - 2013-05-23 17:45 - 00002164 ____A C:\Users\Public\Desktop\Oblivion.lnk
2013-05-23 17:45 - 2013-03-22 11:06 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-05-23 17:42 - 2013-05-10 16:55 - 00000000 ____D C:\Users\Förster\AppData\Local\Oblivion
2013-05-23 16:59 - 2013-04-05 19:08 - 00000000 ____D C:\Users\Förster\Downloads\benutzte mods
2013-05-23 16:33 - 2013-05-22 20:29 - 00000000 ____D C:\Program Files (x86)\Wisdom-soft AutoScreenRecorder 3 Pro
2013-05-22 20:37 - 2013-05-22 20:37 - 00000000 ____D C:\Users\Förster\AppData\Local\DVDVideoSoft_Ltd
2013-05-22 20:33 - 2013-05-22 20:33 - 00001367 ____A C:\Users\Förster\Desktop\Free Screen Video Recorder.lnk
2013-05-22 20:33 - 2013-05-12 21:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-05-22 20:33 - 2013-03-26 17:18 - 00000000 ____D C:\Users\Förster\AppData\Roaming\DVDVideoSoft
2013-05-22 18:44 - 2013-05-10 11:31 - 00000000 ____D C:\Users\Förster\Documents\thumbWOTR
2013-05-19 17:45 - 2013-03-26 12:49 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-05-19 17:45 - 2013-03-26 12:49 - 00000000 ____D C:\ProgramData\Skype
2013-05-19 11:50 - 2013-05-19 11:50 - 00001398 ____A C:\Users\Förster\Desktop\Free YouTube to MP3 Converter.lnk
2013-05-19 11:43 - 2013-05-15 17:53 - 00002302 ____A C:\Users\Förster\Desktop\Free Video to MP3 Converter.lnk
2013-05-17 03:25 - 2013-06-13 21:20 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-17 02:59 - 2013-06-13 21:20 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-17 02:59 - 2013-06-13 21:20 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-17 02:58 - 2013-06-13 21:20 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-14 16:11

==================== End Of Log ============================
--- --- ---



und Addition.txt:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-06-2013
Ran by Förster at 2013-06-15 21:49:01 Run:
Running from C:\Users\Förster\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Adobe Reader XI (11.0.03) - Deutsch (Version: 11.0.03)
Apple Application Support (Version: 2.3.3)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
Archeblade
Asmedia ASM104x USB 3.0 Host Controller Driver (Version: 1.12.9.0)
Blender (Version: 2.66a)
Bonjour (Version: 3.0.0.10)
BrowserProtect
CameraHelperMsi (Version: 13.51.815.0)
Creation Kit
D3DX10 (Version: 15.4.2368.0902)
Die*Sims*Mittelalter (Version: 2.0.113)
Dolby Digital Live Pack (Version: 3.03)
Dota 2
Dragon's Prophet (Version: 1.0.1087.10)
Entity Framework Designer für Visual Studio 2012 - DEU (Version: 11.1.20810.00)
Erforderliche Komponenten für SSDT  (Version: 11.0.2100.60)
erLT (Version: 1.20.138.34)
Fotogalerie (Version: 16.4.3505.0912)
Fraps (remove only)
Free Screen Video Recorder version 2.5.29.430 (Version: 2.5.29.430)
Free Video to MP3 Converter version 5.0.24.430 (Version: 5.0.24.430)
Free YouTube Download version 3.2.2.430 (Version: 3.2.2.430)
Free YouTube to MP3 Converter version 3.12.2.430 (Version: 3.12.2.430)
GIMP 2.8.4 (Version: 2.8.4)
Google Chrome (Version: 27.0.1453.110)
Guild Wars 2
iTunes (Version: 11.0.2.26)
Java 7 Update 17 (Version: 7.0.170)
Java Auto Updater (Version: 2.1.9.0)
Junk Mail filter update (Version: 16.4.3505.0912)
Kaspersky Internet Security 2013 (Version: 13.0.1.4190)
Logitech G35 (Version: 1.1.178)
Logitech Webcam-Software (Version: 2.51)
LWS Facebook (Version: 13.50.854.0)
LWS Gallery (Version: 13.51.827.0)
LWS Help_main (Version: 13.51.828.0)
LWS Launcher (Version: 13.51.828.0)
LWS Motion Detection (Version: 13.51.815.0)
LWS Pictures And Video (Version: 13.51.815.0)
LWS Twitter (Version: 13.30.1346.0)
LWS Webcam Software (Version: 13.51.815.0)
LWS WLM Plugin (Version: 1.30.1201.0)
LWS YouTube Plugin (Version: 13.31.1038.0)
Medieval II: Total War
Medieval II: Total War Kingdoms
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 4 Multi-Targeting Pack (Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Help Viewer 1.0 (Version: 1.0.30319)
Microsoft Help Viewer 1.0 Language Pack - DEU (Version: 1.0.30319)
Microsoft Help Viewer 2.0 (Version: 2.0.50727)
Microsoft Help Viewer 2.0 Language Pack - DEU (Version: 2.0.50727)
Microsoft NuGet - Visual Studio Express 2012 for Windows Desktop (Version: 2.0.30717.9005)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft SQL Server 2008 (64-bit)
Microsoft SQL Server 2008 Browser (Version: 10.1.2531.0)
Microsoft SQL Server 2008 Common Files (Version: 10.0.1600.22)
Microsoft SQL Server 2008 Common Files (Version: 10.1.2531.0)
Microsoft SQL Server 2008 Database Engine Services (Version: 10.1.2531.0)
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.1.2531.0)
Microsoft SQL Server 2008 Native Client (Version: 10.1.2531.0)
Microsoft SQL Server 2008 R2 Management Objects (Version: 10.50.1447.4)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.1.2531.0)
Microsoft SQL Server 2012 Command Line Utilities  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Data-Tier App Framework  (Version: 11.0.2316.0)
Microsoft SQL Server 2012 Express LocalDB  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Management Objects (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Management Objects (x64) (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Native Client  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL Compiler Service  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 T-SQL Language Service  (Version: 11.0.2100.60)
Microsoft SQL Server Compact 3.5 SP2 DEU (Version: 3.5.8080.0)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (Version: 3.5.8080.0)
Microsoft SQL Server Compact 4.0 SP1 x64 DEU  (Version: 4.0.8876.1)
Microsoft SQL Server Data Tools - DEU (11.1.20828.01) (Version: 11.1.20828.01)
Microsoft SQL Server Data Tools Build Utilities - DEU (11.1.20828.01) (Version: 11.1.20828.01)
Microsoft SQL Server System CLR Types (Version: 10.50.1447.4)
Microsoft SQL Server VSS Writer (Version: 10.1.2531.0)
Microsoft Visual Basic 2010 Express - DEU (Version: 10.0.30319)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x64 Runtime - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2012 32bit Compilers - DEU Resources (Version: 11.0.50727)
Microsoft Visual C++ 2012 Core Libraries (Version: 11.0.50727)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x64 Debug Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Debug Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86-x64 Compilers (Version: 11.0.50727)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (Version: 10.0.30319)
Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU (Version: 10.0.30319)
Microsoft Visual Studio 2012 Express Prerequisites x64 - DEU (Version: 11.0.50727)
Microsoft Visual Studio 2012 Shell (Minimum) (Version: 11.0.50727)
Microsoft Visual Studio 2012 Shell (Minimum) Interop Assemblies (Version: 11.0.50727)
Microsoft Visual Studio 2012 Shell-(Mindest)-Ressourcen (Version: 11.0.50727)
Microsoft Visual Studio 2012 Tools für SQL Server Compact 4.0 SP1 DEU (Version: 4.0.8876.1)
Microsoft Visual Studio 2012-Vorbereitung (Version: 11.0.50727)
Microsoft Visual Studio Express 2012 for Windows Desktop (Version: 11.0.50727)
Microsoft Visual Studio Express 2012 für Windows Desktop - DEU (Version: 11.0.50727)
Microsoft Visual Studio Express 2012 für Windows Desktop - DEU (Version: 11.0.50727.42)
Microsoft Visual Studio Team Foundation Server 2012 Object Model (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Object Model Language Pack - DEU (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Team Explorer (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Team Explorer Language Pack - DEU (Version: 11.0.50727)
Microsoft Visual Studio Ultimate 2012 XAML UI Designer Core (Version: 11.0.50727)
Microsoft Visual Studio Ultimate 2012 XAML UI Designer deu Resources (Version: 11.0.50727)
Microsoft WSE 3.0 Runtime (Version: 3.0.5305.0)
Microsoft-System-CLR-Typen für SQL Server 2012 (Version: 11.0.2100.60)
Microsoft-System-CLR-Typen für SQL Server 2012 (x64) (Version: 11.0.2100.60)
Mount & Blade: Warband
Movie Maker (Version: 16.4.3505.0912)
MSVCRT (Version: 15.4.2862.0708)
MSVCRT Redists (Version: 1.0)
MSVCRT_amd64 (Version: 15.4.2862.0708)
MSVCRT110 (Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
Neverwinter
NVIDIA Grafiktreiber 285.93 (Version: 285.93)
NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.109.718)
NVIDIA PhysX (Version: 9.11.1111)
NVIDIA PhysX-Systemsoftware 9.11.1111 (Version: 9.11.1111)
NVIDIA Systemsteuerung 285.93 (Version: 285.93)
Oblivion (Version: 1.2.0416)
Photo Gallery (Version: 16.4.3505.0912)
PlanetSide 2
Realtek Ethernet Controller Driver (Version: 7.49.927.2011)
Realtek High Definition Audio Driver (Version: 6.0.1.6516)
Service Pack 1 für SQL Server 2008 (KB 968369) (64-bit) (Version: 10.1.2531.0)
SIW version 2011.10.29 (Version: 2011.10.29)
Skype Audio Player (remove only)
Skype™ 6.3 (Version: 6.3.107)
Sound Blaster Recon3D PCIe (Version: 1.00.09)
Sound Blaster Recon3D PCIe Extras (Version: 1.0)
Sql Server Customer Experience Improvement Program (Version: 10.1.2531.0)
Steam (Version: 1.0.0.0)
Stencyl (Version: 1.1.1)
TeamSpeak 3 Client (Version: 3.0.10)
The Elder Scrolls V: Skyrim
The Lord of the Rings Online™ v03.08.00.8029 (Version: 03.08.00.8029)
The Lord of the Rings: War in the North
Third Age - Total War 2.0 (Part1of2)
Third Age - Total War 2.0 (Part2of2)
Third Age - Total War 3.0 (Part 1of2)
Third Age - Total War 3.0 (Part 2of2)
TrueCrypt (Version: 7.1a)
TuxGuitar (Version: 1.2)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (Version: 10.1.2731.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4.5 (KB2805221) (Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Visual Studio 2012 (KB2781514) (Version: 11.0.51219)
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Vegas Pro 10.0 (Version: 10.0.469)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU (Version: 4.0.8080.0)
War of the Roses Beta
War of the Roses: Kingmaker
Windows Live Communications Platform (Version: 16.4.3505.0912)
Windows Live Essentials (Version: 16.4.3505.0912)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (Version: 16.4.3505.0912)
Windows Live Mail (Version: 16.4.3505.0912)
Windows Live MIME IFilter (Version: 16.4.3505.0912)
Windows Live Photo Common (Version: 16.4.3505.0912)
Windows Live PIMT Platform (Version: 16.4.3505.0912)
Windows Live SOXE (Version: 16.4.3505.0912)
Windows Live SOXE Definitions (Version: 16.4.3505.0912)
Windows Live UX Platform (Version: 16.4.3505.0912)
Windows Live UX Platform Language Pack (Version: 16.4.3505.0912)
Windows Live Writer (Version: 16.4.3505.0912)
Windows Live Writer Resources (Version: 16.4.3505.0912)
Windows Software Development Kit (Version: 8.59.25584)
Windows Software Development Kit DirectX x64 Remote (Version: 8.59.25584)
Windows Software Development Kit DirectX x86 Remote (Version: 8.59.25584)
Windows Software Development Kit for Windows Store Apps (Version: 8.59.25584)
Windows Software Development Kit for Windows Store Apps DirectX x64 Remote (Version: 8.59.25584)
Windows Software Development Kit for Windows Store Apps DirectX x86 Remote (Version: 8.59.25584)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)

==================== Restore Points  =========================

13-06-2013 19:16:56 Windows Update
15-06-2013 18:58:56 Removed LogMeIn Hamachi

==================== Faulty Device Manager Devices =============

Name: Realtek PCIe GBE Family Controller
Description: Realtek PCIe GBE Family Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8167
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/15/2013 08:57:36 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/15/2013 04:10:40 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/14/2013 03:45:39 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 . Error code = 0x80070002

Error: (06/14/2013 03:45:39 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 . Error code = 0x80070002

Error: (06/14/2013 03:13:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/13/2013 06:51:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/13/2013 04:51:16 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/12/2013 07:39:09 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: mb_warband.exe, Version: 1.0.0.0, Zeitstempel: 0x5047cb3c
Name des fehlerhaften Moduls: nvd3dum.dll, Version: 8.17.12.8593, Zeitstempel: 0x4edc63fc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0041ecb0
ID des fehlerhaften Prozesses: 0x169c
Startzeit der fehlerhaften Anwendung: 0xmb_warband.exe0
Pfad der fehlerhaften Anwendung: mb_warband.exe1
Pfad des fehlerhaften Moduls: mb_warband.exe2
Berichtskennung: mb_warband.exe3

Error: (06/12/2013 06:22:15 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 . Error code = 0x80070002

Error: (06/12/2013 06:22:15 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 . Error code = 0x80070002


System errors:
=============
Error: (06/15/2013 08:55:51 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ?15.?06.?2013 um 20:55:02 unerwartet heruntergefahren.

Error: (06/13/2013 06:50:38 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SQL Server (SQLEXPRESS)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (06/13/2013 06:50:38 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst SQL Server (SQLEXPRESS) erreicht.

Error: (06/13/2013 06:49:47 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ?13.?06.?2013 um 17:45:22 unerwartet heruntergefahren.

Error: (06/12/2013 09:33:41 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (06/07/2013 06:35:53 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (06/07/2013 06:35:53 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (06/06/2013 07:39:32 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (06/06/2013 07:39:32 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (05/30/2013 06:55:26 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-06-09 17:15:41.547
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-09 17:15:41.545
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-09 17:15:41.543
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-09 17:15:41.529
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-09 17:15:41.527
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-09 17:15:41.525
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-08 11:53:44.595
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-08 11:53:44.593
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-08 11:53:44.591
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-08 11:53:44.576
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 16350.92 MB
Available physical RAM: 13293.11 MB
Total Pagefile: 32700.02 MB
Available Pagefile: 29129.91 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:448.96 GB) NTFS (Disk=0 Partition=2)
Drive d: (Logitech G35) (CDROM) (Total:0.16 GB) (Free:0 GB) CDFS
Drive f: (My Book) (Fixed) (Total:465.76 GB) (Free:424.85 GB) NTFS (Disk=3 Partition=1)
Drive g: (DÄMMERSTERN) (Removable) (Total:7.45 GB) (Free:7.25 GB) FAT32 (Disk=1 Partition=1)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 1FE9121A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

========================================================
Disk: 3 (Size: 466 GB) (Disk ID: 44FDFE06)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber 15.06.2013 20:54
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Laxanon 15.06.2013 21:10
bitte:

Code:
ComboFix 13-06-15.01 - Förster 15.06.2013  22:01:22.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.16351.13711 [GMT 2:00]
ausgeführt von:: c:\users\F÷rster\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\d2d1debug1.dll
c:\windows\SysWow64\frapsvid.dll
c:\windows\SysWow64\tmp2980.tmp
c:\windows\SysWow64\tmp2981.tmp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-05-15 bis 2013-06-15  ))))))))))))))))))))))))))))))
.
.
2013-06-15 20:06 . 2013-06-15 20:06        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-06-15 19:47 . 2013-06-15 19:47        --------        d-----w-        C:\FRST
2013-06-14 13:16 . 2013-05-13 06:37        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4A475F5E-6180-48AA-98DC-38B0DDE87CD5}\mpengine.dll
2013-06-12 19:32 . 2013-06-12 19:32        --------        d-----w-        C:\6f2eaa2ffdc2b089af3922f5ecd241c0
2013-06-12 16:04 . 2013-05-13 05:51        184320        ----a-w-        c:\windows\system32\cryptsvc.dll
2013-06-12 16:04 . 2013-05-13 05:51        1464320        ----a-w-        c:\windows\system32\crypt32.dll
2013-06-12 16:04 . 2013-05-13 05:51        139776        ----a-w-        c:\windows\system32\cryptnet.dll
2013-06-12 16:04 . 2013-05-13 05:50        52224        ----a-w-        c:\windows\system32\certenc.dll
2013-06-12 16:04 . 2013-05-13 04:45        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll
2013-06-12 16:04 . 2013-05-13 04:45        1160192        ----a-w-        c:\windows\SysWow64\crypt32.dll
2013-06-12 16:04 . 2013-05-13 04:45        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll
2013-06-12 16:04 . 2013-05-13 03:43        1192448        ----a-w-        c:\windows\system32\certutil.exe
2013-06-12 16:04 . 2013-05-13 03:08        903168        ----a-w-        c:\windows\SysWow64\certutil.exe
2013-06-12 16:04 . 2013-05-13 03:08        43008        ----a-w-        c:\windows\SysWow64\certenc.dll
2013-06-12 16:03 . 2013-04-25 23:30        1505280        ----a-w-        c:\windows\SysWow64\d3d11.dll
2013-06-12 16:03 . 2013-03-31 22:52        1887232        ----a-w-        c:\windows\system32\d3d11.dll
2013-06-12 16:03 . 2013-05-08 06:39        1910632        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2013-06-12 16:00 . 2013-04-26 05:51        751104        ----a-w-        c:\windows\system32\win32spl.dll
2013-06-12 16:00 . 2013-04-26 04:55        492544        ----a-w-        c:\windows\SysWow64\win32spl.dll
2013-06-12 16:00 . 2013-05-10 05:49        30720        ----a-w-        c:\windows\system32\cryptdlg.dll
2013-06-12 16:00 . 2013-05-10 03:20        24576        ----a-w-        c:\windows\SysWow64\cryptdlg.dll
2013-06-12 16:00 . 2013-04-17 07:02        1230336        ----a-w-        c:\windows\SysWow64\WindowsCodecs.dll
2013-06-12 16:00 . 2013-04-17 06:24        1424384        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2013-06-11 12:59 . 2013-06-12 19:32        1089632        ----a-w-        c:\programdata\Microsoft\WDExpress\11.0\1031\ResourceCache.dll
2013-06-11 12:58 . 2013-06-11 12:58        --------        d-----w-        c:\program files (x86)\NuGet
2013-06-11 12:50 . 2013-06-11 12:50        --------        d-----w-        c:\program files (x86)\Common Files\Merge Modules
2013-06-11 12:48 . 2013-06-11 12:48        --------        d-----w-        c:\windows\symbols
2013-06-11 12:45 . 2013-06-11 12:45        --------        d-----w-        c:\program files (x86)\Common Files\Microsoft
2013-06-11 12:45 . 2013-06-11 12:45        --------        d-----w-        c:\program files (x86)\Windows Kits
2013-06-11 12:44 . 2013-06-11 12:46        --------        d-----w-        c:\users\Förster\AppData\Roaming\TrueCrypt
2013-06-11 12:43 . 2013-06-11 12:43        --------        d-----w-        c:\program files (x86)\Microsoft Help Viewer
2013-06-11 12:39 . 2013-06-11 12:44        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 11.0
2013-06-11 12:37 . 2013-06-11 12:37        231376        ----a-w-        c:\windows\system32\drivers\truecrypt.sys
2013-06-11 12:25 . 2013-06-12 19:31        --------        d-----w-        c:\programdata\Package Cache
2013-06-11 12:25 . 2013-06-11 12:25        --------        d-----w-        c:\programdata\regid.1991-06.com.microsoft
2013-06-10 19:44 . 2009-07-21 00:42        78872        ----a-w-        c:\windows\system32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2013-06-10 19:44 . 2009-07-21 00:42        50200        ----a-w-        c:\windows\SysWow64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2013-06-10 19:44 . 2009-07-21 00:42        79896        ----a-w-        c:\windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2013-06-10 19:44 . 2009-07-21 00:42        111640        ----a-w-        c:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2013-06-10 19:44 . 2013-06-10 19:44        --------        d-----w-        c:\windows\system32\RsFx
2013-06-10 19:43 . 2013-06-10 19:43        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 9.0
2013-06-10 19:43 . 2013-06-10 19:43        --------        d-----w-        c:\program files\Microsoft Visual Studio 9.0
2013-06-10 19:43 . 2013-06-11 12:42        --------        d-----w-        c:\windows\SysWow64\1033
2013-06-10 19:43 . 2013-06-11 12:42        --------        d-----w-        c:\windows\SysWow64\1031
2013-06-10 19:43 . 2013-06-11 12:42        --------        d-----w-        c:\windows\system32\1033
2013-06-10 19:43 . 2013-06-11 12:42        --------        d-----w-        c:\windows\system32\1031
2013-06-10 19:43 . 2013-06-10 19:43        --------        d-----w-        c:\program files\Microsoft.NET
2013-06-10 19:41 . 2013-06-11 12:42        --------        d-----w-        c:\program files\Microsoft SQL Server
2013-06-10 19:39 . 2013-06-11 12:41        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server
2013-06-10 19:39 . 2013-06-11 12:41        --------        d-----w-        c:\program files\Microsoft SQL Server Compact Edition
2013-06-10 19:39 . 2013-06-10 19:39        --------        d-----w-        c:\program files\Microsoft Synchronization Services
2013-06-10 19:39 . 2013-06-10 19:39        --------        d-----w-        c:\program files (x86)\Microsoft Synchronization Services
2013-06-10 19:38 . 2013-06-11 15:55        207008        ----a-w-        c:\programdata\Microsoft\VBExpress\10.0\1031\ResourceCache.dll
2013-06-10 19:37 . 2013-06-10 19:46        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 10.0
2013-06-10 19:37 . 2013-06-10 19:37        --------        d-----w-        c:\program files\Microsoft Visual Studio 10.0
2013-06-10 19:37 . 2013-06-10 19:37        --------        d-----w-        c:\program files\Microsoft Help Viewer
2013-06-10 19:37 . 2013-06-10 19:37        --------        d-----w-        c:\program files (x86)\Microsoft SDKs
2013-06-09 11:20 . 2013-06-09 17:49        --------        d-----w-        c:\program files (x86)\Dragon's Prophet
2013-06-09 09:28 . 2013-06-09 09:30        --------        d-----w-        c:\users\Förster\AppData\Roaming\Stencyl
2013-06-08 18:41 . 2013-06-08 18:41        --------        d-----w-        c:\program files (x86)\Stencyl
2013-05-27 15:47 . 2013-05-27 15:47        --------        d-----w-        c:\users\Förster\.tuxguitar-1.2
2013-05-27 15:46 . 2013-05-27 15:46        --------        d-----w-        c:\program files (x86)\TuxGuitar
2013-05-22 18:37 . 2013-05-22 18:37        --------        d-----w-        c:\users\Förster\AppData\Local\DVDVideoSoft_Ltd
2013-05-22 18:29 . 2013-05-23 14:33        --------        d-----w-        c:\program files (x86)\Wisdom-soft AutoScreenRecorder 3 Pro
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-13 19:21 . 2013-03-22 10:13        75825640        ----a-w-        c:\windows\system32\MRT.exe
2013-05-11 17:44 . 2012-07-17 12:37        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-04 13:33 . 2013-04-24 18:29        1178624        ----a-w-        c:\users\Förster\AppData\Roaming\siw_sdk.dll
2013-05-04 13:33 . 2013-04-24 18:29        1178624        ----a-w-        c:\users\Förster\AppData\Roaming\siw_sdk.dll
2013-05-02 00:06 . 2010-11-21 03:27        278800        ------w-        c:\windows\system32\MpSigStub.exe
2013-04-23 14:24 . 2013-03-26 10:02        90208        ----a-w-        c:\windows\system32\drivers\klflt.sys
2013-04-23 14:24 . 2013-03-26 10:02        620128        ----a-w-        c:\windows\system32\drivers\klif.sys
2013-04-23 14:24 . 2012-08-13 15:49        178448        ----a-w-        c:\windows\system32\drivers\kneps.sys
2013-04-23 14:24 . 2012-06-08 10:38        55056        ----a-w-        c:\windows\system32\drivers\kltdi.sys
2013-04-14 11:20 . 2013-04-14 11:20        53248        ----a-r-        c:\users\Förster\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2013-04-14 11:20 . 2013-04-14 11:20        53248        ----a-r-        c:\users\Förster\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2013-04-13 05:49 . 2013-05-15 13:06        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 13:06        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 13:06        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 13:06        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 13:06        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 13:06        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 13:02        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2013-04-10 06:01 . 2013-05-15 13:06        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-15 13:06        983400        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:30 . 2013-05-15 13:06        3153920        ----a-w-        c:\windows\system32\win32k.sys
2013-04-05 09:15 . 2013-04-05 09:15        861088        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2013-04-05 09:15 . 2013-04-05 09:15        782240        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2013-04-05 09:15 . 2013-04-05 09:15        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-26 11:03 . 2013-03-26 11:03        466520        ----a-w-        c:\windows\system32\wrap_oal.dll
2013-03-26 11:03 . 2013-03-26 11:03        445016        ----a-w-        c:\windows\SysWow64\wrap_oal.dll
2013-03-26 11:03 . 2013-03-26 11:03        123480        ----a-w-        c:\windows\system32\OpenAL32.dll
2013-03-26 11:03 . 2013-03-26 11:03        109144        ----a-w-        c:\windows\SysWow64\OpenAL32.dll
2013-03-22 09:55 . 2013-03-22 09:55        97280        ----a-w-        c:\windows\system32\mshtmled.dll
2013-03-22 09:55 . 2013-03-22 09:55        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2013-03-22 09:55 . 2013-03-22 09:55        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll
2013-03-22 09:55 . 2013-03-22 09:55        81408        ----a-w-        c:\windows\system32\icardie.dll
2013-03-22 09:55 . 2013-03-22 09:55        77312        ----a-w-        c:\windows\system32\tdc.ocx
2013-03-22 09:55 . 2013-03-22 09:55        762368        ----a-w-        c:\windows\system32\ieapfltr.dll
2013-03-22 09:55 . 2013-03-22 09:55        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2013-03-22 09:55 . 2013-03-22 09:55        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll
2013-03-22 09:55 . 2013-03-22 09:55        62976        ----a-w-        c:\windows\system32\pngfilt.dll
2013-03-22 09:55 . 2013-03-22 09:55        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx
2013-03-22 09:55 . 2013-03-22 09:55        599552        ----a-w-        c:\windows\system32\vbscript.dll
2013-03-22 09:55 . 2013-03-22 09:55        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll
2013-03-22 09:55 . 2013-03-22 09:55        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll
2013-03-22 09:55 . 2013-03-22 09:55        51200        ----a-w-        c:\windows\system32\imgutil.dll
2013-03-22 09:55 . 2013-03-22 09:55        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2013-03-22 09:55 . 2013-03-22 09:55        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2013-03-22 09:55 . 2013-03-22 09:55        452096        ----a-w-        c:\windows\system32\dxtmsft.dll
2013-03-22 09:55 . 2013-03-22 09:55        441856        ----a-w-        c:\windows\system32\html.iec
2013-03-22 09:55 . 2013-03-22 09:55        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll
2013-03-22 09:55 . 2013-03-22 09:55        361984        ----a-w-        c:\windows\SysWow64\html.iec
2013-03-22 09:55 . 2013-03-22 09:55        281600        ----a-w-        c:\windows\system32\dxtrans.dll
2013-03-22 09:55 . 2013-03-22 09:55        27648        ----a-w-        c:\windows\system32\licmgr10.dll
2013-03-22 09:55 . 2013-03-22 09:55        270848        ----a-w-        c:\windows\system32\iedkcs32.dll
2013-03-22 09:55 . 2013-03-22 09:55        247296        ----a-w-        c:\windows\system32\webcheck.dll
2013-03-22 09:55 . 2013-03-22 09:55        235008        ----a-w-        c:\windows\system32\url.dll
2013-03-22 09:55 . 2013-03-22 09:55        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2013-03-22 09:55 . 2013-03-22 09:55        226304        ----a-w-        c:\windows\system32\elshyph.dll
2013-03-22 09:55 . 2013-03-22 09:55        216064        ----a-w-        c:\windows\system32\msls31.dll
2013-03-22 09:55 . 2013-03-22 09:55        197120        ----a-w-        c:\windows\system32\msrating.dll
2013-03-22 09:55 . 2013-03-22 09:55        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll
2013-03-22 09:55 . 2013-03-22 09:55        173568        ----a-w-        c:\windows\system32\ieUnatt.exe
2013-03-22 09:55 . 2013-03-22 09:55        167424        ----a-w-        c:\windows\system32\iexpress.exe
2013-03-22 09:55 . 2013-03-22 09:55        158720        ----a-w-        c:\windows\SysWow64\msls31.dll
2013-03-22 09:55 . 2013-03-22 09:55        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl
2013-03-22 09:55 . 2013-03-22 09:55        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2013-03-22 09:55 . 2013-03-22 09:55        149504        ----a-w-        c:\windows\system32\occache.dll
2013-03-22 09:55 . 2013-03-22 09:55        144896        ----a-w-        c:\windows\system32\wextract.exe
2013-03-22 09:55 . 2013-03-22 09:55        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2013-03-22 09:55 . 2013-03-22 09:55        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat
2013-03-22 09:55 . 2013-03-22 09:55        138752        ----a-w-        c:\windows\SysWow64\wextract.exe
2013-03-22 09:55 . 2013-03-22 09:55        13824        ----a-w-        c:\windows\system32\mshta.exe
2013-03-22 09:55 . 2013-03-22 09:55        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2013-03-22 09:55 . 2013-03-22 09:55        136192        ----a-w-        c:\windows\system32\iepeers.dll
2013-03-22 09:55 . 2013-03-22 09:55        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll
2013-03-22 09:55 . 2013-03-22 09:55        12800        ----a-w-        c:\windows\SysWow64\mshta.exe
2013-03-22 09:55 . 2013-03-22 09:55        12800        ----a-w-        c:\windows\system32\msfeedssync.exe
2013-03-22 09:55 . 2013-03-22 09:55        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2013-03-22 09:55 . 2013-03-22 09:55        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-22 09:55 . 2013-03-22 09:55        102912        ----a-w-        c:\windows\system32\inseng.dll
2013-03-19 06:04 . 2013-04-11 16:02        5550424        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-03-19 05:53 . 2013-05-15 13:06        48640        ----a-w-        c:\windows\system32\wwanprotdim.dll
2013-03-19 05:53 . 2013-05-15 13:06        230400        ----a-w-        c:\windows\system32\wwansvc.dll
2013-03-19 05:46 . 2013-04-11 16:02        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-11 16:02        3968856        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-11 16:02        3913560        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-11 16:02        6656        ----a-w-        c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-11 16:02        112640        ----a-w-        c:\windows\system32\smss.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wisdom-soft AutoScreenRecorder 3.1 Pro"="0" [X]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2013-06-06 1641896]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Logitech G35"="c:\program files (x86)\Logitech\G35\G35.exe" [2010-10-05 1811800]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2013-03-26 356376]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"Sound Blaster Recon3D PCIe Control Panel"="c:\program files (x86)\Creative\Sound Blaster Recon3D PCIe\Sound Blaster Recon3D PCIe Control Panel\SBRnPCIe.exe" [2011-11-14 880128]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2012-09-12 204136]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys;c:\windows\SYSNATIVE\DRIVERS\RsFx0103.sys [x]
R4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE;c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 BrowserProtect;BrowserProtect;c:\programdata\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe;c:\programdata\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [x]
S2 CtHdaSvc;Sound Blaster Service;c:\windows\sysWow64\CtHdaSvc.exe;c:\windows\sysWow64\CtHdaSvc.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 cthda;Sound Blaster HDAudio;c:\windows\system32\drivers\cthda.sys;c:\windows\SYSNATIVE\drivers\cthda.sys [x]
S3 cthdb;SB Recon3D PCIe Audio Bus Filter;c:\windows\system32\DRIVERS\cthdb.sys;c:\windows\SYSNATIVE\DRIVERS\cthdb.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 LADF_DHP2;G35 DHP2 Filter Driver;c:\windows\system32\DRIVERS\ladfDHP2amd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfDHP2amd64.sys [x]
S3 LADF_SBVM;G35 SBVM Filter Driver;c:\windows\system32\DRIVERS\ladfSBVMamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfSBVMamd64.sys [x]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
.
--------- X64 Entries -----------
.
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Hinzufügen zu Anti-Banner - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3161771069-198629159-1195633666-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3161771069-198629159-1195633666-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-15  22:07:48
ComboFix-quarantined-files.txt  2013-06-15 20:07
.
Vor Suchlauf: 13 Verzeichnis(se), 527.874.617.344 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 529.429.889.024 Bytes frei
.
- - End Of File - - D1E8F5147B9D16283981D3E95336FA8A
A36C5E4F47E84449FF07ED3517B43A31
auf jeden fall schonmal danke für die hilfe :)

schrauber 15.06.2013 21:11
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST Log. Noch Probleme? :)

Laxanon 15.06.2013 22:39
AdwCleaner:

Code:
# AdwCleaner v2.303 - Datei am 15/06/2013 um 22:19:16 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Förster - FÖRSTER-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Förster\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : BrowserProtect

***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
Datei Gelöscht : C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BrowserProtect
Ordner Gelöscht : C:\Users\Förster\AppData\Roaming\BabSolution
Ordner Gelöscht : C:\Users\Förster\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Förster\AppData\Roaming\OpenCandy

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\BabylonToolbar
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\8558dd0b16fea43
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\8558dd0b16fea43
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Google Chrome v27.0.1453.110

Datei : C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gelöscht [l.2674] : homepage = "hxxp://www2.delta-search.com/?affID=121562&babsrc=HP_ss&mntrId=CCC994DBC97895B4",
Gelöscht [l.5118] : urls_to_restore_on_startup = [ "hxxp://www2.delta-search.com/?affID=121562&babsrc=HP_ss&mntrI[...]

*************************

AdwCleaner[R1].txt - [2427 octets] - [15/06/2013 22:18:06]
AdwCleaner[R2].txt - [2487 octets] - [15/06/2013 22:18:50]
AdwCleaner[S1].txt - [2417 octets] - [15/06/2013 22:19:16]

########## EOF - C:\AdwCleaner[S1].txt - [2477 octets] ##########
Junkware:
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by F”rster on 15.06.2013 at 22:24:14,33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.06.2013 at 22:26:31,31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ESET Online Scanner:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=8d9f9049fd800541861f1dbe82814c67
# engine=14083
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-15 09:27:37
# local_time=2013-06-15 11:27:37 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1286 16777213 100 98 4017 26097979 0 0
# compatibility_mode=5893 16776573 100 94 4812 122961507 0 0
# scanned=286996
# found=1
# cleaned=0
# scan_time=3458
sh=FEAE3A5BAFFA5BC8386CF346269EB86C0B700AA6 ft=1 fh=e232154b75d1af60 vn="a variant of Win32/Packed.VMProtect.AAD trojan" ac=I fn="C:\Users\Förster\Downloads\Vegas Pro 10\Sony Vegas 10 Keygen.exe"

Secutity Check:

Code:
UNSUPPORTED OPERATING SYSTEM! ABORTED!
FRST:


FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-06-2013
Ran by Förster (administrator) on 15-06-2013 23:34:30
Running from C:\Users\Förster\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Creative Technology Ltd) C:\Windows\sysWow64\CtHdaSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Logitech(c)) C:\Program Files (x86)\Logitech\G35\G35.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3D PCIe\Sound Blaster Recon3D PCIe Control Panel\SBRnPCIe.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

==================== Registry (Whitelisted) ==================

HKCU\...\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent [1641896 2013-06-07] (Valve Corporation)
HKCU\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Wisdom-soft AutoScreenRecorder 3.1 Pro] 0 [x]
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [Logitech G35] C:\Program Files (x86)\Logitech\G35\G35.exe [1811800 2010-10-05] (Logitech(c))
HKLM-x32\...\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2013-03-26] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [UpdReg] C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Sound Blaster Recon3D PCIe Control Panel] "C:\Program Files (x86)\Creative\Sound Blaster Recon3D PCIe\Sound Blaster Recon3D PCIe Control Panel\SBRnPCIe.exe" /r [880128 2011-11-14] (Creative Technology Ltd)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide [204136 2012-09-13] (Logitech Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome:
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Safe Money) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0
CHR Extension: (Content Blocker) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Anti-Banner) - C:\Users\Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0

==================== Services (Whitelisted) =================

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-03-26] (Kaspersky Lab ZAO)
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [103424 2013-02-14] (Creative Technology Ltd)
R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 cthda; C:\Windows\System32\drivers\cthda.sys [1044760 2013-02-14] (Creative Technology Ltd)
R3 cthdb; C:\Windows\System32\DRIVERS\cthdb.sys [28440 2013-02-14] (Creative Technology Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-04-23] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-10-25] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-10-25] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55056 2013-04-23] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-23] (Kaspersky Lab ZAO)
R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [62168 2010-09-29] (Logitech)
R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [377176 2010-09-29] (Logitech)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-15 23:33 - 2013-06-15 23:33 - 00000041 ____A C:\Users\Förster\Desktop\checkup.txt
2013-06-15 22:31 - 2013-06-15 22:31 - 00890839 ____A C:\Users\Förster\Desktop\SecurityCheck.exe
2013-06-15 22:26 - 2013-06-15 22:26 - 00000627 ____A C:\Users\Förster\Desktop\JRT.txt
2013-06-15 22:24 - 2013-06-15 22:24 - 00000000 ____D C:\Windows\ERUNT
2013-06-15 22:24 - 2013-06-15 22:24 - 00000000 ____D C:\JRT
2013-06-15 22:22 - 2013-06-15 22:22 - 00000531 ____A C:\Users\Förster\Desktop\AdwCleaner[S1].lnk
2013-06-15 22:19 - 2013-06-15 22:19 - 00002544 ____A C:\AdwCleaner[S1].txt
2013-06-15 22:19 - 2013-06-15 22:19 - 00002487 ____A C:\Users\Förster\Desktop\AdwCleaner[R2].txt
2013-06-15 22:18 - 2013-06-15 22:18 - 00002487 ____A C:\AdwCleaner[R2].txt
2013-06-15 22:18 - 2013-06-15 22:18 - 00002427 ____A C:\AdwCleaner[R1].txt
2013-06-15 22:15 - 2013-06-15 22:15 - 02347384 ____A (ESET) C:\Users\Förster\Desktop\esetsmartinstaller_enu.exe
2013-06-15 22:15 - 2013-06-15 22:15 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Förster\Desktop\JRT.exe
2013-06-15 22:14 - 2013-06-15 22:17 - 00002308 ____A C:\Users\Förster\Desktop\Neues Textdokument.txt
2013-06-15 22:14 - 2013-06-15 22:14 - 00648201 ____A C:\Users\Förster\Desktop\adwcleaner.exe
2013-06-15 22:07 - 2013-06-15 22:07 - 00022408 ____A C:\ComboFix.txt
2013-06-15 22:00 - 2013-06-15 22:07 - 00000000 ____D C:\ComboFix
2013-06-15 22:00 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-15 22:00 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-15 22:00 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-15 22:00 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-15 22:00 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-15 22:00 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-15 22:00 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-15 22:00 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-15 21:59 - 2013-06-15 22:07 - 00000000 ____D C:\Qoobox
2013-06-15 21:59 - 2013-06-15 22:06 - 00000000 ____D C:\Windows\erdnt
2013-06-15 21:57 - 2013-06-15 21:58 - 05080151 ____R (Swearware) C:\Users\Förster\Desktop\ComboFix.exe
2013-06-15 21:49 - 2013-06-15 21:58 - 00022916 ____A C:\Users\Förster\Downloads\Addition.txt
2013-06-15 21:49 - 2013-06-15 21:49 - 00043935 ____A C:\Users\Förster\Downloads\FRST.txt
2013-06-15 21:47 - 2013-06-15 21:47 - 00000000 ____D C:\FRST
2013-06-15 21:46 - 2013-06-15 21:47 - 01920546 ____A (Farbar) C:\Users\Förster\Desktop\FRST64.exe
2013-06-13 21:20 - 2013-05-17 03:25 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 21:20 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 21:20 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 21:20 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 21:20 - 2013-05-17 02:58 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 21:20 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 21:20 - 2013-05-14 15:14 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 21:20 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 21:20 - 2013-05-14 11:23 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-13 21:20 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2012
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2012
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\6f2eaa2ffdc2b089af3922f5ecd241c0
2013-06-12 18:04 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 18:04 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 18:04 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 18:04 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 18:04 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 18:04 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 18:04 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 18:04 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 18:04 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 18:04 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 18:03 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 18:03 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 18:03 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 18:00 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 18:00 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 18:00 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 18:00 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 18:00 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 18:00 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 17:55 - 2013-06-11 17:55 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2010
2013-06-11 17:55 - 2013-06-11 17:55 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2010
2013-06-11 14:59 - 2013-06-11 15:03 - 00000000 ____D C:\Users\Förster\Documents\Visual Studio 2012
2013-06-11 14:58 - 2013-06-11 14:58 - 00000000 ____D C:\Program Files (x86)\NuGet
2013-06-11 14:48 - 2013-06-11 14:48 - 00000000 ____D C:\Windows\symbols
2013-06-11 14:45 - 2013-06-11 14:45 - 00000000 ____D C:\Program Files (x86)\Windows Kits
2013-06-11 14:44 - 2013-06-11 14:46 - 00000000 ____D C:\Users\Förster\AppData\Roaming\TrueCrypt
2013-06-11 14:43 - 2013-06-11 14:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Help Viewer
2013-06-11 14:39 - 2013-06-11 14:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 11.0
2013-06-11 14:37 - 2013-06-11 14:37 - 00231376 ____A (TrueCrypt Foundation) C:\Windows\System32\Drivers\truecrypt.sys
2013-06-11 14:37 - 2013-06-11 14:37 - 00000527 ____A C:\Users\Public\Desktop\TrueCrypt.lnk
2013-06-11 14:34 - 2013-06-11 14:35 - 03466248 ____A (TrueCrypt Foundation) C:\Users\Förster\Downloads\TrueCrypt Setup 7.1a.exe
2013-06-11 14:25 - 2013-06-12 21:31 - 00000000 ____D C:\ProgramData\Package Cache
2013-06-11 14:23 - 2013-06-11 14:23 - 00937632 ____A (Microsoft Corporation) C:\Users\Förster\Downloads\wdexpress_full.exe
2013-06-11 14:22 - 2013-06-11 14:22 - 00001391 ____A C:\Users\Förster\Desktop\Microsoft Visual Basic 2010 Express.lnk
2013-06-10 21:44 - 2013-06-10 21:44 - 00000000 ____D C:\Windows\System32\RsFx
2013-06-10 21:44 - 2009-07-21 02:42 - 00111640 ____A (Microsoft Corporation) C:\Windows\System32\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2013-06-10 21:44 - 2009-07-21 02:42 - 00079896 ____A (Microsoft Corporation) C:\Windows\SysWOW64\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2013-06-10 21:44 - 2009-07-21 02:42 - 00078872 ____A (Microsoft Corporation) C:\Windows\System32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2013-06-10 21:44 - 2009-07-21 02:42 - 00050200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2013-06-10 21:43 - 2013-06-11 14:42 - 00000000 ____D C:\Windows\SysWOW64\1033
2013-06-10 21:43 - 2013-06-11 14:42 - 00000000 ____D C:\Windows\SysWOW64\1031
2013-06-10 21:43 - 2013-06-11 14:42 - 00000000 ____D C:\Windows\System32\1033
2013-06-10 21:43 - 2013-06-11 14:42 - 00000000 ____D C:\Windows\System32\1031
2013-06-10 21:43 - 2013-06-10 21:43 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 9.0
2013-06-10 21:43 - 2013-06-10 21:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 9.0
2013-06-10 21:41 - 2013-06-11 14:42 - 00000000 ____D C:\Program Files\Microsoft SQL Server
2013-06-10 21:39 - 2013-06-11 14:41 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2013-06-10 21:39 - 2013-06-11 14:41 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server
2013-06-10 21:39 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files\Microsoft Synchronization Services
2013-06-10 21:39 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Synchronization Services
2013-06-10 21:38 - 2013-06-10 21:48 - 00000000 ____D C:\Users\Förster\Documents\Visual Studio 2010
2013-06-10 21:37 - 2013-06-10 21:46 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 10.0
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files\Microsoft Help Viewer
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs
2013-06-10 21:33 - 2013-06-10 21:33 - 03296584 ____A (Microsoft Corporation) C:\Users\Förster\Downloads\vbasic_web (1).exe
2013-06-10 21:11 - 2013-06-11 14:12 - 00000053 ____A C:\Users\Förster\Desktop\aufgaben.txt
2013-06-10 20:35 - 2013-06-10 21:01 - 00000119 ____A C:\Users\Förster\Desktop\Neues Textdokument (2).txt
2013-06-09 19:01 - 2013-06-09 19:01 - 00393080 ____A (Softonic                                        ) C:\Users\Förster\Downloads\SoftonicDownloader_fuer_aspicore-gsm-tracker.exe
2013-06-09 15:33 - 2013-06-10 19:15 - 00001833 ____A C:\Users\Förster\Desktop\hack.txt
2013-06-09 13:41 - 2013-06-09 19:49 - 00000000 ____D C:\Users\Förster\Documents\dragoon
2013-06-09 13:27 - 2013-06-09 13:27 - 00001063 ____A C:\Users\Public\Desktop\Dragon's Prophet.lnk
2013-06-09 13:20 - 2013-06-09 19:49 - 00000000 ____D C:\Program Files (x86)\Dragon's Prophet
2013-06-09 11:28 - 2013-06-09 11:30 - 00000000 ____D C:\Users\Förster\AppData\Roaming\Stencyl
2013-06-08 20:50 - 2013-06-09 13:18 - 00000000 ____D C:\Users\Förster\Desktop\Dragon's Prophet
2013-06-08 20:49 - 2013-06-08 20:49 - 01873863 ____A (Infernum Productions AG                                    ) C:\Users\Förster\Downloads\DragonsProphetDownloader.exe
2013-06-08 20:41 - 2013-06-08 20:41 - 00000000 ____D C:\Program Files (x86)\Stencyl
2013-06-08 18:34 - 2013-06-08 18:41 - 61653476 ____A (Stencyl, LLC) C:\Users\Förster\Downloads\Stencyl-2.1.0.exe
2013-06-07 06:44 - 2013-06-07 06:44 - 00262144 ____A C:\Windows\System32\config\elam
2013-06-06 19:58 - 2013-06-06 19:58 - 00000563 ____A C:\Users\Förster\Downloads\hexenlied.mid
2013-06-06 19:54 - 2013-06-06 19:54 - 00000720 ____A C:\Users\Förster\Downloads\mannelig.mid
2013-06-06 19:53 - 2013-06-06 19:53 - 00000771 ____A C:\Users\Förster\Downloads\totentanz.mid
2013-06-06 19:45 - 2013-06-06 19:45 - 00018378 ____A C:\Users\Förster\AppData\Local\recently-used.xbel
2013-06-03 16:58 - 2013-06-03 16:58 - 00434435 ____A C:\Users\Förster\Downloads\SCHWEFELSÄURE.pptx
2013-05-31 20:40 - 2013-05-31 20:40 - 00000000 ____A C:\Users\Förster\Downloads\ni_updater.log
2013-05-31 19:26 - 2013-05-31 20:00 - 547617776 ____A C:\Users\Förster\Downloads\BITW_Ivanhoe_ver._beta_1.0.rar
2013-05-31 19:24 - 2013-05-31 19:50 - 382646090 ____A C:\Users\Förster\Downloads\NordInvasion_0.5.0.rar
2013-05-31 15:46 - 2013-05-31 16:21 - 846310613 ____A C:\Users\Förster\Downloads\Full_Invasion2.rar
2013-05-30 18:07 - 2013-05-30 18:07 - 00000221 ____A C:\Users\Förster\Desktop\Mount & Blade Warband.url
2013-05-29 21:51 - 2013-05-29 22:02 - 26769614 ____A C:\Users\Förster\Downloads\STRINGS.rar
2013-05-29 21:51 - 2013-05-29 22:00 - 20375740 ____A C:\Users\Förster\Downloads\Woodwinds.rar
2013-05-29 21:51 - 2013-05-29 21:52 - 01585697 ____A C:\Users\Förster\Downloads\mandolin.rar
2013-05-29 21:50 - 2013-05-29 21:53 - 07917339 ____A C:\Users\Förster\Downloads\BRASS.rar
2013-05-27 18:04 - 2013-05-27 18:04 - 00000238 ____A C:\Users\Förster\Documents\traurige liebe sheet.tg
2013-05-27 17:47 - 2013-05-27 17:47 - 00000000 ____D C:\Users\Förster\.tuxguitar-1.2
2013-05-27 17:46 - 2013-05-27 17:46 - 00000949 ____A C:\Users\Public\Desktop\TuxGuitar.lnk
2013-05-27 17:46 - 2013-05-27 17:46 - 00000000 ____D C:\Program Files (x86)\TuxGuitar
2013-05-27 17:42 - 2013-05-27 17:43 - 07715210 ____A (Herac) C:\Users\Förster\Downloads\tuxguitar-1.2-windows-x86-installer.exe
2013-05-27 17:20 - 2013-05-27 18:05 - 00002874 ____A C:\Users\Förster\Documents\UserPreferences.ini
2013-05-24 21:27 - 2013-05-24 21:27 - 00069577 ____A C:\Users\Förster\Documents\seraphimavatar.xcf
2013-05-24 21:10 - 2013-05-29 19:31 - 00568395 ____A C:\Users\Förster\Documents\seraphim.xcf
2013-05-23 17:45 - 2013-05-23 17:50 - 00002164 ____A C:\Users\Public\Desktop\Oblivion.lnk
2013-05-22 20:37 - 2013-05-22 20:37 - 00000000 ____D C:\Users\Förster\AppData\Local\DVDVideoSoft_Ltd
2013-05-22 20:33 - 2013-05-22 20:33 - 00001367 ____A C:\Users\Förster\Desktop\Free Screen Video Recorder.lnk
2013-05-22 20:29 - 2013-05-23 16:33 - 00000000 ____D C:\Program Files (x86)\Wisdom-soft AutoScreenRecorder 3 Pro
2013-05-20 17:23 - 2013-06-15 21:41 - 00000272 ____A C:\Users\Förster\Desktop\whistles.txt
2013-05-19 11:50 - 2013-05-19 11:50 - 00001398 ____A C:\Users\Förster\Desktop\Free YouTube to MP3 Converter.lnk

==================== One Month Modified Files and Folders =======

2013-06-15 23:33 - 2013-06-15 23:33 - 00000041 ____A C:\Users\Förster\Desktop\checkup.txt
2013-06-15 23:21 - 2013-03-26 12:49 - 00000000 ____D C:\Users\Förster\AppData\Roaming\Skype
2013-06-15 22:36 - 2013-03-22 11:02 - 01762619 ____A C:\Windows\WindowsUpdate.log
2013-06-15 22:35 - 2013-03-26 12:02 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-15 22:31 - 2013-06-15 22:31 - 00890839 ____A C:\Users\Förster\Desktop\SecurityCheck.exe
2013-06-15 22:27 - 2009-07-14 06:45 - 00029392 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-15 22:27 - 2009-07-14 06:45 - 00029392 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-15 22:26 - 2013-06-15 22:26 - 00000627 ____A C:\Users\Förster\Desktop\JRT.txt
2013-06-15 22:25 - 2011-04-12 09:43 - 00776056 ____A C:\Windows\System32\perfh007.dat
2013-06-15 22:25 - 2011-04-12 09:43 - 00179582 ____A C:\Windows\System32\perfc007.dat
2013-06-15 22:25 - 2009-07-14 07:13 - 01836146 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-15 22:24 - 2013-06-15 22:24 - 00000000 ____D C:\Windows\ERUNT
2013-06-15 22:24 - 2013-06-15 22:24 - 00000000 ____D C:\JRT
2013-06-15 22:22 - 2013-06-15 22:22 - 00000531 ____A C:\Users\Förster\Desktop\AdwCleaner[S1].lnk
2013-06-15 22:21 - 2013-03-26 12:39 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-15 22:20 - 2010-11-21 05:47 - 00159342 ____A C:\Windows\PFRO.log
2013-06-15 22:20 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-15 22:20 - 2009-07-14 06:51 - 00043041 ____A C:\Windows\setupact.log
2013-06-15 22:19 - 2013-06-15 22:19 - 00002544 ____A C:\AdwCleaner[S1].txt
2013-06-15 22:19 - 2013-06-15 22:19 - 00002487 ____A C:\Users\Förster\Desktop\AdwCleaner[R2].txt
2013-06-15 22:18 - 2013-06-15 22:18 - 00002487 ____A C:\AdwCleaner[R2].txt
2013-06-15 22:18 - 2013-06-15 22:18 - 00002427 ____A C:\AdwCleaner[R1].txt
2013-06-15 22:17 - 2013-06-15 22:14 - 00002308 ____A C:\Users\Förster\Desktop\Neues Textdokument.txt
2013-06-15 22:15 - 2013-06-15 22:15 - 02347384 ____A (ESET) C:\Users\Förster\Desktop\esetsmartinstaller_enu.exe
2013-06-15 22:15 - 2013-06-15 22:15 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Förster\Desktop\JRT.exe
2013-06-15 22:14 - 2013-06-15 22:14 - 00648201 ____A C:\Users\Förster\Desktop\adwcleaner.exe
2013-06-15 22:07 - 2013-06-15 22:07 - 00022408 ____A C:\ComboFix.txt
2013-06-15 22:07 - 2013-06-15 22:00 - 00000000 ____D C:\ComboFix
2013-06-15 22:07 - 2013-06-15 21:59 - 00000000 ____D C:\Qoobox
2013-06-15 22:06 - 2013-06-15 21:59 - 00000000 ____D C:\Windows\erdnt
2013-06-15 22:06 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-06-15 21:58 - 2013-06-15 21:57 - 05080151 ____R (Swearware) C:\Users\Förster\Desktop\ComboFix.exe
2013-06-15 21:58 - 2013-06-15 21:49 - 00022916 ____A C:\Users\Förster\Downloads\Addition.txt
2013-06-15 21:49 - 2013-06-15 21:49 - 00043935 ____A C:\Users\Förster\Downloads\FRST.txt
2013-06-15 21:47 - 2013-06-15 21:47 - 00000000 ____D C:\FRST
2013-06-15 21:47 - 2013-06-15 21:46 - 01920546 ____A (Farbar) C:\Users\Förster\Desktop\FRST64.exe
2013-06-15 21:41 - 2013-05-20 17:23 - 00000272 ____A C:\Users\Förster\Desktop\whistles.txt
2013-06-14 16:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-13 21:21 - 2013-03-30 14:52 - 01809490 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-06-13 21:21 - 2013-03-22 12:13 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2012
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2012
2013-06-12 21:32 - 2013-06-12 21:32 - 00000000 ____D C:\6f2eaa2ffdc2b089af3922f5ecd241c0
2013-06-12 21:31 - 2013-06-11 14:25 - 00000000 ____D C:\ProgramData\Package Cache
2013-06-12 18:00 - 2013-04-05 11:15 - 00000000 ____D C:\Users\Förster\AppData\Roaming\.minecraft
2013-06-11 17:55 - 2013-06-11 17:55 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2010
2013-06-11 17:55 - 2013-06-11 17:55 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2010
2013-06-11 15:03 - 2013-06-11 14:59 - 00000000 ____D C:\Users\Förster\Documents\Visual Studio 2012
2013-06-11 14:58 - 2013-06-11 14:58 - 00000000 ____D C:\Program Files (x86)\NuGet
2013-06-11 14:56 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-06-11 14:48 - 2013-06-11 14:48 - 00000000 ____D C:\Windows\symbols
2013-06-11 14:46 - 2013-06-11 14:44 - 00000000 ____D C:\Users\Förster\AppData\Roaming\TrueCrypt
2013-06-11 14:45 - 2013-06-11 14:45 - 00000000 ____D C:\Program Files (x86)\Windows Kits
2013-06-11 14:44 - 2013-06-11 14:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 11.0
2013-06-11 14:43 - 2013-06-11 14:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Help Viewer
2013-06-11 14:43 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2013-06-11 14:42 - 2013-06-10 21:43 - 00000000 ____D C:\Windows\SysWOW64\1033
2013-06-11 14:42 - 2013-06-10 21:43 - 00000000 ____D C:\Windows\SysWOW64\1031
2013-06-11 14:42 - 2013-06-10 21:43 - 00000000 ____D C:\Windows\System32\1033
2013-06-11 14:42 - 2013-06-10 21:43 - 00000000 ____D C:\Windows\System32\1031
2013-06-11 14:42 - 2013-06-10 21:41 - 00000000 ____D C:\Program Files\Microsoft SQL Server
2013-06-11 14:41 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2013-06-11 14:41 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server
2013-06-11 14:41 - 2013-04-14 14:29 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2013-06-11 14:37 - 2013-06-11 14:37 - 00231376 ____A (TrueCrypt Foundation) C:\Windows\System32\Drivers\truecrypt.sys
2013-06-11 14:37 - 2013-06-11 14:37 - 00000527 ____A C:\Users\Public\Desktop\TrueCrypt.lnk
2013-06-11 14:35 - 2013-06-11 14:34 - 03466248 ____A (TrueCrypt Foundation) C:\Users\Förster\Downloads\TrueCrypt Setup 7.1a.exe
2013-06-11 14:23 - 2013-06-11 14:23 - 00937632 ____A (Microsoft Corporation) C:\Users\Förster\Downloads\wdexpress_full.exe
2013-06-11 14:22 - 2013-06-11 14:22 - 00001391 ____A C:\Users\Förster\Desktop\Microsoft Visual Basic 2010 Express.lnk
2013-06-11 14:12 - 2013-06-10 21:11 - 00000053 ____A C:\Users\Förster\Desktop\aufgaben.txt
2013-06-10 21:48 - 2013-06-10 21:38 - 00000000 ____D C:\Users\Förster\Documents\Visual Studio 2010
2013-06-10 21:46 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 10.0
2013-06-10 21:44 - 2013-06-10 21:44 - 00000000 ____D C:\Windows\System32\RsFx
2013-06-10 21:43 - 2013-06-10 21:43 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 9.0
2013-06-10 21:43 - 2013-06-10 21:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 9.0
2013-06-10 21:39 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files\Microsoft Synchronization Services
2013-06-10 21:39 - 2013-06-10 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Synchronization Services
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files\Microsoft Help Viewer
2013-06-10 21:37 - 2013-06-10 21:37 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs
2013-06-10 21:33 - 2013-06-10 21:33 - 03296584 ____A (Microsoft Corporation) C:\Users\Förster\Downloads\vbasic_web (1).exe
2013-06-10 21:01 - 2013-06-10 20:35 - 00000119 ____A C:\Users\Förster\Desktop\Neues Textdokument (2).txt
2013-06-10 20:41 - 2013-03-27 10:34 - 00000000 ____D C:\Users\Förster\Desktop\Andere Dinge
2013-06-10 19:15 - 2013-06-09 15:33 - 00001833 ____A C:\Users\Förster\Desktop\hack.txt
2013-06-09 19:49 - 2013-06-09 13:41 - 00000000 ____D C:\Users\Förster\Documents\dragoon
2013-06-09 19:49 - 2013-06-09 13:20 - 00000000 ____D C:\Program Files (x86)\Dragon's Prophet
2013-06-09 19:01 - 2013-06-09 19:01 - 00393080 ____A (Softonic                                        ) C:\Users\Förster\Downloads\SoftonicDownloader_fuer_aspicore-gsm-tracker.exe
2013-06-09 13:31 - 2013-03-27 17:18 - 00221788 ____A C:\Windows\DirectX.log
2013-06-09 13:27 - 2013-06-09 13:27 - 00001063 ____A C:\Users\Public\Desktop\Dragon's Prophet.lnk
2013-06-09 13:18 - 2013-06-08 20:50 - 00000000 ____D C:\Users\Förster\Desktop\Dragon's Prophet
2013-06-09 11:30 - 2013-06-09 11:28 - 00000000 ____D C:\Users\Förster\AppData\Roaming\Stencyl
2013-06-09 11:30 - 2013-03-22 11:02 - 00000000 ____D C:\users\Förster
2013-06-08 20:49 - 2013-06-08 20:49 - 01873863 ____A (Infernum Productions AG                                    ) C:\Users\Förster\Downloads\DragonsProphetDownloader.exe
2013-06-08 20:41 - 2013-06-08 20:41 - 00000000 ____D C:\Program Files (x86)\Stencyl
2013-06-08 18:41 - 2013-06-08 18:34 - 61653476 ____A (Stencyl, LLC) C:\Users\Förster\Downloads\Stencyl-2.1.0.exe
2013-06-07 06:44 - 2013-06-07 06:44 - 00262144 ____A C:\Windows\System32\config\elam
2013-06-06 20:59 - 2013-04-11 17:32 - 00000000 ____D C:\Users\Förster\Documents\noten
2013-06-06 19:58 - 2013-06-06 19:58 - 00000563 ____A C:\Users\Förster\Downloads\hexenlied.mid
2013-06-06 19:54 - 2013-06-06 19:54 - 00000720 ____A C:\Users\Förster\Downloads\mannelig.mid
2013-06-06 19:53 - 2013-06-06 19:53 - 00000771 ____A C:\Users\Förster\Downloads\totentanz.mid
2013-06-06 19:52 - 2013-03-26 12:35 - 00002376 ____A C:\Users\Förster\Desktop\Google Chrome.lnk
2013-06-06 19:45 - 2013-06-06 19:45 - 00018378 ____A C:\Users\Förster\AppData\Local\recently-used.xbel
2013-06-06 19:45 - 2013-03-30 13:02 - 00000000 ____D C:\Users\Förster\.gimp-2.8
2013-06-03 16:58 - 2013-06-03 16:58 - 00434435 ____A C:\Users\Förster\Downloads\SCHWEFELSÄURE.pptx
2013-06-02 18:43 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-06-01 21:18 - 2013-04-14 14:48 - 00000000 ____D C:\Users\Förster\Documents\Mount&Blade Warband Savegames
2013-05-31 20:40 - 2013-05-31 20:40 - 00000000 ____A C:\Users\Förster\Downloads\ni_updater.log
2013-05-31 20:00 - 2013-05-31 19:26 - 547617776 ____A C:\Users\Förster\Downloads\BITW_Ivanhoe_ver._beta_1.0.rar
2013-05-31 19:50 - 2013-05-31 19:24 - 382646090 ____A C:\Users\Förster\Downloads\NordInvasion_0.5.0.rar
2013-05-31 16:21 - 2013-05-31 15:46 - 846310613 ____A C:\Users\Förster\Downloads\Full_Invasion2.rar
2013-05-30 20:10 - 2013-04-14 14:47 - 00000000 ____D C:\Users\Förster\AppData\Roaming\Mount&Blade Warband
2013-05-30 18:07 - 2013-05-30 18:07 - 00000221 ____A C:\Users\Förster\Desktop\Mount & Blade Warband.url
2013-05-30 13:38 - 2009-07-14 06:45 - 00355992 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-29 22:02 - 2013-05-29 21:51 - 26769614 ____A C:\Users\Förster\Downloads\STRINGS.rar
2013-05-29 22:00 - 2013-05-29 21:51 - 20375740 ____A C:\Users\Förster\Downloads\Woodwinds.rar
2013-05-29 21:53 - 2013-05-29 21:50 - 07917339 ____A C:\Users\Förster\Downloads\BRASS.rar
2013-05-29 21:52 - 2013-05-29 21:51 - 01585697 ____A C:\Users\Förster\Downloads\mandolin.rar
2013-05-29 20:03 - 2013-03-22 15:08 - 00087472 ____A C:\Users\Förster\AppData\Local\GDIPFONTCACHEV1.DAT
2013-05-29 19:31 - 2013-05-24 21:10 - 00568395 ____A C:\Users\Förster\Documents\seraphim.xcf
2013-05-27 18:05 - 2013-05-27 17:20 - 00002874 ____A C:\Users\Förster\Documents\UserPreferences.ini
2013-05-27 18:04 - 2013-05-27 18:04 - 00000238 ____A C:\Users\Förster\Documents\traurige liebe sheet.tg
2013-05-27 17:58 - 2013-03-30 14:53 - 00000000 ____D C:\Users\Förster\AppData\Local\Turbine
2013-05-27 17:47 - 2013-05-27 17:47 - 00000000 ____D C:\Users\Förster\.tuxguitar-1.2
2013-05-27 17:46 - 2013-05-27 17:46 - 00000949 ____A C:\Users\Public\Desktop\TuxGuitar.lnk
2013-05-27 17:46 - 2013-05-27 17:46 - 00000000 ____D C:\Program Files (x86)\TuxGuitar
2013-05-27 17:43 - 2013-05-27 17:42 - 07715210 ____A (Herac) C:\Users\Förster\Downloads\tuxguitar-1.2-windows-x86-installer.exe
2013-05-27 17:24 - 2013-04-05 21:13 - 00000000 ____D C:\Users\Förster\Downloads\Andere Programme
2013-05-25 14:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-05-25 14:53 - 2013-05-10 16:22 - 00000000 ____D C:\Program Files (x86)\Bethesda Softworks
2013-05-25 14:45 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-05-24 21:27 - 2013-05-24 21:27 - 00069577 ____A C:\Users\Förster\Documents\seraphimavatar.xcf
2013-05-23 17:50 - 2013-05-23 17:45 - 00002164 ____A C:\Users\Public\Desktop\Oblivion.lnk
2013-05-23 17:45 - 2013-03-22 11:06 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-05-23 17:42 - 2013-05-10 16:55 - 00000000 ____D C:\Users\Förster\AppData\Local\Oblivion
2013-05-23 16:59 - 2013-04-05 19:08 - 00000000 ____D C:\Users\Förster\Downloads\benutzte mods
2013-05-23 16:33 - 2013-05-22 20:29 - 00000000 ____D C:\Program Files (x86)\Wisdom-soft AutoScreenRecorder 3 Pro
2013-05-22 20:37 - 2013-05-22 20:37 - 00000000 ____D C:\Users\Förster\AppData\Local\DVDVideoSoft_Ltd
2013-05-22 20:33 - 2013-05-22 20:33 - 00001367 ____A C:\Users\Förster\Desktop\Free Screen Video Recorder.lnk
2013-05-22 20:33 - 2013-05-12 21:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-05-22 20:33 - 2013-03-26 17:18 - 00000000 ____D C:\Users\Förster\AppData\Roaming\DVDVideoSoft
2013-05-22 18:44 - 2013-05-10 11:31 - 00000000 ____D C:\Users\Förster\Documents\thumbWOTR
2013-05-19 17:45 - 2013-03-26 12:49 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-05-19 17:45 - 2013-03-26 12:49 - 00000000 ____D C:\ProgramData\Skype
2013-05-19 11:50 - 2013-05-19 11:50 - 00001398 ____A C:\Users\Förster\Desktop\Free YouTube to MP3 Converter.lnk
2013-05-19 11:43 - 2013-05-15 17:53 - 00002302 ____A C:\Users\Förster\Desktop\Free Video to MP3 Converter.lnk
2013-05-17 03:25 - 2013-06-13 21:20 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-17 03:25 - 2013-06-13 21:20 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-17 02:59 - 2013-06-13 21:20 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-17 02:59 - 2013-06-13 21:20 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-17 02:58 - 2013-06-13 21:20 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-17 02:58 - 2013-06-13 21:20 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-14 16:11

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---


http://www.imagebanana.com/code/3lwk6z8m/cmd2.PNG


das ahb ich grad beim erneuten abhören gefunden wieder ist der vpnpool da und wieder geht mein netz in die knie :o aber könnte es sich dabei um einen hacker handeln?

hxxp://www.imagebanana.com/code/3lwk6z8m/cmd2.PNG

schrauber 16.06.2013 05:56
Und Du wunderst Dich noch....

Zitat:
variant of Win32/Packed.VMProtect.AAD trojan" ac=I fn="C:\Users\Förster\Downloads\Vegas Pro 10\Sony Vegas 10 Keygen.exe
Dateien, wie Crack.exe, Keygen.exe oder Patch.exe sind zu 99,9% gefährliche Schädlinge, mit denen man nicht Spaßen sollte.
Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf
Anleitung zum Neu aufsetzten

Laxanon 16.06.2013 08:44
ok auf jeden fall vielen dank :o mein freund hatte meinen pc ne ganze zeit lang und er meinte es währe die vollversion! na der bekommt was zu hören.

schrauber 16.06.2013 08:50
lass ihn am leben :)

Laxanon 16.06.2013 08:52
eventuell :) aber kann ich den keygen nicht irgendwie löschen? wird ziemlich teuer windows wieder neu zu kaufen. hatte ja ne eingebaute recovery und die ist nach dem letzten neu aufsetzen futsch

schrauber 16.06.2013 08:53
klar kann man das, aber du weisst nicht was der alles angestellt hat. und rein rechtlich darf ich ab dem moment eines keygen-fundes keinen Support mehr leisten.

Laxanon 16.06.2013 08:54
kann ich den trojaner irgendwie manuell entfernen? wird sonst wieder richtig teuer weil ich windoes neu kaufen müsste da meine recovery nach dem letzten neu aufsetzen weg ist

schrauber 16.06.2013 08:57
Zitat:
Zitat von schrauber (Beitrag 1087294)
und rein rechtlich darf ich ab dem moment eines keygen-fundes keinen Support mehr leisten.
sorry.

Laxanon 16.06.2013 08:59
achso ok trotzdem danke


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:41 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27