| starxick | 11.12.2013 18:47 |
Hallo
Als erstes ich habe nun eine komplette Durchsuchung durchgeführt und ich bekam noch 3 Funde
1. Java Blacole.smo
2.Troj Ransom.smc2
3.Java Mailsend.ic
Aber hat erlich gesagt nix geholfen Sicherheitscenter ist immer noch runtergefahren. Ok dann zu denn Ergebnissen
Fixlist: Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-12-2013 01
Ran by Patrick at 2013-12-11 17:44:56 Run:1
Running from C:\Users\Patrick\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
IFEO\avcenter.exe: [Debugger] nsjw.exe
IFEO\avguard.exe: [Debugger] nsjw.exe
IFEO\avp.exe: [Debugger] nsjw.exe
IFEO\bdagent.exe: [Debugger] nsjw.exe
IFEO\ccuac.exe: [Debugger] nsjw.exe
IFEO\ComboFix.exe: [Debugger] nsjw.exe
IFEO\egui.exe: [Debugger] nsjw.exe
IFEO\hijackthis.exe: [Debugger] nsjw.exe
IFEO\keyscrambler.exe: [Debugger] nsjw.exe
IFEO\mbam.exe: [Debugger] nsjw.exe
IFEO\MpCmdRun.exe: [Debugger] nsjw.exe
IFEO\MSASCui.exe: [Debugger] nsjw.exe
IFEO\MsMpEng.exe: [Debugger] nsjw.exe
IFEO\msseces.exe: [Debugger] nsjw.exe
IFEO\NisSrv.exe: [Debugger] nsjw.exe
IFEO\spybotsd.exe: [Debugger] nsjw.exe
IFEO\wireshark.exe: [Debugger] nsjw.exe
IFEO\zlclient.exe: [Debugger] nsjw.exe
*****************
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\avcenter.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\avguard.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\avp.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bdagent.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ccuac.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ComboFix.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\egui.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\hijackthis.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\keyscrambler.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\mbam.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MpCmdRun.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MSASCui.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MsMpEng.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\msseces.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\NisSrv.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\spybotsd.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\wireshark.exe => Key not found.
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\zlclient.exe => Key not found.
==== End of Fixlog ====
Combofix: Code:
ComboFix 13-12-10.01 - Patrick 11.12.2013 17:57:37.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8190.6350 [GMT 1:00]
ausgeführt von:: c:\users\Patrick\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
ADS - Windows: deleted 24 bytes in 1 streams.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Patrick\AppData\Local\assembly\tmp
c:\users\Patrick\AppData\Roaming\Hotspot Shield Elite 2.65.exe
c:\windows\SysWow64\frapsvid.dll
c:\windows\SysWow64\tmp51ED.tmp
c:\windows\SysWow64\tmp51EE.tmp
c:\windows\SysWow64\tmpC557.tmp
c:\windows\SysWow64\tmpC69F.tmp
c:\windows\SysWow64\tmpDB93.tmp
c:\windows\SysWow64\tmpDBB4.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-11-11 bis 2013-12-11 ))))))))))))))))))))))))))))))
.
.
2013-12-11 17:06 . 2013-12-11 17:06 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-12-10 21:38 . 2013-12-11 16:44 -------- d-----w- C:\FRST
2013-12-10 21:09 . 2013-12-10 21:09 233520 ----a-w- c:\windows\RegBootClean64.exe
2013-12-10 20:39 . 2013-12-10 20:39 -------- d-----w- c:\users\Patrick\AppData\Roaming\Avira
2013-12-10 20:38 . 2013-12-10 20:38 -------- d-----w- c:\programdata\AskPartnerNetwork
2013-12-10 20:38 . 2013-12-10 20:38 -------- d-----w- c:\program files (x86)\AskPartnerNetwork
2013-12-10 20:38 . 2013-12-10 20:38 -------- d-----w- c:\programdata\APN
2013-12-10 20:37 . 2013-12-10 20:36 83160 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-12-10 20:37 . 2013-12-10 20:36 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-12-10 20:37 . 2013-12-10 20:36 132600 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-10 20:37 . 2013-12-10 20:36 107416 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-10 20:37 . 2013-12-10 20:37 -------- d-----w- c:\programdata\Avira
2013-12-10 20:37 . 2013-12-10 20:37 -------- d-----w- c:\program files (x86)\Avira
2013-12-10 19:46 . 2013-12-10 19:55 -------- d-sh--w- c:\windows\SysWow64\{$1179-4133-5326-3114$}
2013-12-09 19:52 . 2013-11-08 03:12 10285968 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E1C36442-600A-4B46-8704-48EB2BF93984}\mpengine.dll
2013-12-08 17:27 . 2013-11-08 03:12 10285968 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-12-07 23:29 . 2013-12-07 23:29 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2013-12-07 12:44 . 2013-10-19 17:21 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7EF6204C-CDD2-4453-BAC3-AFFA01FC1AB9}\gapaengine.dll
2013-11-30 19:55 . 2013-12-10 19:50 -------- d-----w- c:\users\Patrick\AppData\Local\ArmA 2 OA
2013-11-30 19:54 . 2013-11-30 19:54 -------- d-----w- c:\users\Patrick\AppData\Local\ArmA 2
2013-11-26 23:42 . 2013-11-26 23:42 37376 ----a-w- c:\windows\SysWow64\uplay_r1_loader.dll
2013-11-26 23:41 . 2013-11-26 23:41 -------- d-----w- c:\programdata\Logs
2013-11-26 23:41 . 2013-04-11 15:12 19392 ----a-w- c:\windows\system32\roboot64.exe
2013-11-24 21:23 . 2013-11-24 21:23 -------- d-----w- c:\windows\Migration
2013-11-16 12:13 . 2013-11-16 12:13 -------- d-----w- c:\users\Patrick\AppData\Roaming\Obsidian Entertainment
2013-11-16 12:12 . 2013-11-16 12:12 -------- d-----w- c:\programdata\Obsidian Entertainment
2013-11-16 01:20 . 2013-10-14 17:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-08 22:10 . 2011-05-18 15:29 214392 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-12-08 21:51 . 2011-05-18 15:29 214392 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-11-24 21:27 . 2011-05-18 15:29 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-11-24 20:43 . 2011-05-18 15:36 280792 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-11-19 10:21 . 2011-05-18 13:53 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-14 19:52 . 2012-04-08 08:56 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-14 19:52 . 2011-06-03 18:55 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-13 23:21 . 2011-05-18 14:09 82896128 ----a-w- c:\windows\system32\MRT.exe
2013-10-19 17:21 . 2011-05-20 14:04 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-10-08 05:50 . 2013-10-22 19:19 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-10-05 01:38 . 2013-10-05 01:38 970912 ----a-w- c:\windows\SysWow64\msvcr120.dll
2013-10-05 01:38 . 2013-10-05 01:38 83104 ----a-w- c:\windows\SysWow64\mfcm120u.dll
2013-10-05 01:38 . 2013-10-05 01:38 83104 ----a-w- c:\windows\SysWow64\mfcm120.dll
2013-10-05 01:38 . 2013-10-05 01:38 74920 ----a-w- c:\windows\SysWow64\mfc120fra.dll
2013-10-05 01:38 . 2013-10-05 01:38 74920 ----a-w- c:\windows\SysWow64\mfc120deu.dll
2013-10-05 01:38 . 2013-10-05 01:38 73896 ----a-w- c:\windows\SysWow64\mfc120esn.dll
2013-10-05 01:38 . 2013-10-05 01:38 72872 ----a-w- c:\windows\SysWow64\mfc120ita.dll
2013-10-05 01:38 . 2013-10-05 01:38 70824 ----a-w- c:\windows\SysWow64\mfc120rus.dll
2013-10-05 01:38 . 2013-10-05 01:38 65192 ----a-w- c:\windows\SysWow64\mfc120enu.dll
2013-10-05 01:38 . 2013-10-05 01:38 53928 ----a-w- c:\windows\SysWow64\mfc120jpn.dll
2013-10-05 01:38 . 2013-10-05 01:38 53416 ----a-w- c:\windows\SysWow64\mfc120kor.dll
2013-10-05 01:38 . 2013-10-05 01:38 46248 ----a-w- c:\windows\SysWow64\mfc120cht.dll
2013-10-05 01:38 . 2013-10-05 01:38 46248 ----a-w- c:\windows\SysWow64\mfc120chs.dll
2013-10-05 01:38 . 2013-10-05 01:38 455328 ----a-w- c:\windows\SysWow64\msvcp120.dll
2013-10-05 01:38 . 2013-10-05 01:38 4449952 ----a-w- c:\windows\SysWow64\mfc120u.dll
2013-10-05 01:38 . 2013-10-05 01:38 4424344 ----a-w- c:\windows\SysWow64\mfc120.dll
2013-10-05 01:38 . 2013-10-05 01:38 339616 ----a-w- c:\windows\SysWow64\vcamp120.dll
2013-10-05 01:38 . 2013-10-05 01:38 247984 ----a-w- c:\windows\SysWow64\vccorlib120.dll
2013-10-05 01:38 . 2013-10-05 01:38 119456 ----a-w- c:\windows\SysWow64\vcomp120.dll
2013-09-27 08:53 . 2013-09-27 08:53 248240 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2013-09-27 08:53 . 2010-10-24 19:25 134944 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2013-09-21 03:33 . 2013-09-21 03:33 51200 ----a-w- c:\windows\system32\kdbsdk64.dll
2013-09-21 03:28 . 2013-09-21 03:28 38912 ----a-w- c:\windows\SysWow64\kdbsdk32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2013-10-23 18:43 12240 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2013-10-23 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-11-14 20584608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-09-21 766208]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-10 683576]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-10-23 1673680]
.
c:\users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
explorers.ini.url [2013-12-10 81]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\avguard.exe]
"Debugger"=nsjw.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
R2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
R2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dump_wmimmc;dump_wmimmc;f:\spiele\WolfTeam-DE\GameGuard\dump_wmimmc.sys;f:\spiele\WolfTeam-DE\GameGuard\dump_wmimmc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys;c:\windows\SYSNATIVE\pwdrvio.sys [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys;c:\windows\SYSNATIVE\pwdspio.sys [x]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys;c:\windows\SYSNATIVE\DRIVERS\s1018bus.sys [x]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys;c:\windows\SYSNATIVE\DRIVERS\s1018mdfl.sys [x]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys;c:\windows\SYSNATIVE\DRIVERS\s1018mdm.sys [x]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys;c:\windows\SYSNATIVE\DRIVERS\s1018mgmt.sys [x]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys;c:\windows\SYSNATIVE\DRIVERS\s1018nd5.sys [x]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys;c:\windows\SYSNATIVE\DRIVERS\s1018obex.sys [x]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys;c:\windows\SYSNATIVE\DRIVERS\s1018unic.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 X6va005;X6va005;c:\users\Patrick\AppData\Local\Temp\00516EE.tmp;c:\users\Patrick\AppData\Local\Temp\00516EE.tmp [x]
R3 X6va007;X6va007;c:\users\Patrick\AppData\Local\Temp\007EAD6.tmp;c:\users\Patrick\AppData\Local\Temp\007EAD6.tmp [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
R4 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe;c:\program files (x86)\Common Files\Desura\desura_service.exe [x]
R4 OMSI download service;Sony Ericsson OMSI download service;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [x]
R4 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [x]
R4 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 LADF_CaptureOnly;LADF Capture Filter Driver;c:\windows\system32\DRIVERS\ladfGSCamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSCamd64.sys [x]
S3 LADF_RenderOnly;LADF Render Filter Driver;c:\windows\system32\DRIVERS\ladfGSRamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSRamd64.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2013-12-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 19:52]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2013-10-23 18:43 13776 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll" [2013-10-23 13776]
.
[HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-06-23 1744152]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2011-09-29 110360]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe]
"Debugger"=nsjw.exe
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 67.77.92.196:35421
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\users\Patrick\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: RF - Formular ausfüllen - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RF - Formular speichern - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: RF - Menü anpassen - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: RF - RoboForm-Leiste ein/aus - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\3et2896h.default\
FF - prefs.js: browser.startup.homepage - www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-PlayNC Launcher - (no file)
Wow6432Node-HKLM-Run-System Configuration - c:\windows\SysWOW64\{$1179-4133-5326-3114$}\mlconfig.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
AddRemove-SOE-Bullet Run - f:\spiele\BulletRun\Uninstaller.exe
AddRemove-SOE-PlanetSide 2 Beta - f:\spiele\PlanetSide 2\Uninstaller.exe
AddRemove-{6B34251B-AB68-4b47-AA5E-09B50EFE41A0} - d:\battlefield heroes pte\uninstaller.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\Patrick\AppData\Local\Temp\00516EE.tmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va007]
"ImagePath"="\??\c:\users\Patrick\AppData\Local\Temp\007EAD6.tmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2035284945-2354610706-3085669017-1001\Software\SecuROM\License information*]
"datasecu"=hex:24,3a,21,8d,ca,6a,1f,3f,c4,93,75,77,f8,45,5e,7f,6d,e1,a9,4d,6c,
40,e0,fa,36,f5,30,9c,39,f1,3c,34,68,eb,4f,11,1d,0c,7b,8b,2f,d9,ac,e3,72,6d,\
"rkeysecu"=hex:23,9e,6b,38,62,9d,73,52,c3,b3,cb,b9,78,16,62,f8
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe]
@Denied: (A C D 2 3) (Everyone)
"Debugger"="nsjw.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-12-11 18:13:32
ComboFix-quarantined-files.txt 2013-12-11 17:13
.
Vor Suchlauf: 18 Verzeichnis(se), 109.388.382.208 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 109.174.939.648 Bytes frei
.
- - End Of File - - CDAACB630BE3A5E540FAC002550DB478
A36C5E4F47E84449FF07ED3517B43A31
FRST:
FRST Logfile:
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-12-2013 01
Ran by Patrick (administrator) on PATRICK-PC on 11-12-2013 18:15:12
Running from C:\Users\Patrick\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\System32\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointG\SetPointII.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\plugins\LCDAppletsMono-8.12.072\Applets\x64\LCDClock.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\plugins\LCDAppletsMono-8.12.072\Applets\x64\LCDRSS.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\plugins\LCDAppletsMono-8.12.072\Applets\x64\LCDCountdown.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-06-24] (Logitech, Inc.)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [110360 2011-09-29] (Logitech Inc.)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
Winlogon\Notify\LBTWlgn: C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-12-10] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-10-23] (APN)
IFEO\avguard.exe: [Debugger] nsjw.exe
Startup: C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorers.ini.url ()
==================== Internet (Whitelisted) ====================
ProxyServer: 67.77.92.196:35421
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF11CBD29B3BDCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: RoboForm Toolbar Helper - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\EPSON Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: No Name - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: RoboForm Toolbar Helper - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\EPSON Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\3et2896h.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.116.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.138.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.3 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @gamersfirst.com/LiveLauncher - C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101799.dll (Amazon.com, Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Battlefield Heroes Updater - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\3et2896h.default\Extensions\battlefieldheroespatcher@ea.com
FF Extension: Battlefield Play4Free - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\3et2896h.default\Extensions\battlefieldplay4free@ea.com
FF Extension: GFACE Experience Plugin - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\3et2896h.default\Extensions\cryenginebrowserplugin@crytek.com
FF Extension: DownloadHelper - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\3et2896h.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Bitdefender QuickScan - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\3et2896h.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF Extension: toolbar_AVIRA-V7 - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\3et2896h.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF Extension: flashgot - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\3et2896h.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
FF Extension: DVDVideoSoft Menu - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\3et2896h.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF HKLM-x32\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF HKLM-x32\...\Firefox\Extensions: [{22119944-ED35-4ab1-910B-E619EA06A115}] - C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox
FF Extension: RoboForm Toolbar for Firefox - C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-07] (Adobe Systems)
R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-09-21] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-10] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-10] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-12-10] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2013-05-26] ()
S4 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe [121456 2010-10-26] ()
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [3889424 2011-08-01] (INCA Internet Co., Ltd.)
S4 OMSI download service; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [14848 2011-12-15] ()
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2013-12-08] ()
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2013-11-24] ()
S4 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [123664 2012-08-25] (SANDBOXIE L.T.D)
==================== Drivers (Whitelisted) ====================
S3 1394hub; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 1394hub; C:\Windows\SysWow64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [34816 2013-06-19] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [107416 2013-12-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-12-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [83160 2013-12-10] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2011-05-21] (DT Soft Ltd)
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWow64\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
S1 KS0108; C:\Program Files (x86)\LcdStudio\ks0108.sys [3712 2008-03-10] ()
S1 LC7981; C:\Program Files (x86)\LcdStudio\LC7981.sys [5120 2008-03-10] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
S1 n3900; C:\Program Files (x86)\LcdStudio\n3900.sys [3968 2008-03-10] ()
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
S3 NPPTNT2; C:\Windows\SysWow64\npptNT2.sys [4682 2005-01-01] (INCA Internet Co., Ltd.)
R3 PdiPorts; C:\Windows\System32\DRIVERS\PdiPorts.sys [20592 2010-04-16] (Portrait Displays, Inc.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2011-09-02] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2011-09-02] ()
S3 s1018bus; C:\Windows\System32\DRIVERS\s1018bus.sys [113704 2009-03-25] (MCCI Corporation)
S3 s1018mdfl; C:\Windows\System32\DRIVERS\s1018mdfl.sys [19496 2009-03-25] (MCCI Corporation)
S3 s1018mdm; C:\Windows\System32\DRIVERS\s1018mdm.sys [153128 2009-03-25] (MCCI Corporation)
S3 s1018mgmt; C:\Windows\System32\DRIVERS\s1018mgmt.sys [133160 2009-03-25] (MCCI Corporation)
S3 s1018nd5; C:\Windows\System32\DRIVERS\s1018nd5.sys [34856 2009-03-25] (MCCI Corporation)
S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [128552 2009-03-25] (MCCI Corporation)
S3 s1018unic; C:\Windows\System32\DRIVERS\s1018unic.sys [146472 2009-03-25] (MCCI Corporation)
S3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202632 2012-08-25] (SANDBOXIE L.T.D)
S1 SED133x; C:\Program Files (x86)\LcdStudio\SED133x.sys [7424 2008-03-10] ()
S1 T6963C; C:\Program Files (x86)\LcdStudio\T6963c.sys [6400 2008-03-10] ()
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-24] (Anchorfree Inc.)
U3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 dump_wmimmc; \??\F:\Spiele\WolfTeam-DE\GameGuard\dump_wmimmc.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 X6va005; \??\C:\Users\Patrick\AppData\Local\Temp\00516EE.tmp [x]
S3 X6va007; \??\C:\Users\Patrick\AppData\Local\Temp\007EAD6.tmp [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-11 18:13 - 2013-12-11 18:13 - 00028208 _____ C:\ComboFix.txt
2013-12-11 17:55 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-11 17:55 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-11 17:55 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-11 17:55 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-11 17:55 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-11 17:55 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-11 17:55 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-11 17:55 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-11 17:54 - 2013-12-11 18:14 - 00000000 ____D C:\Qoobox
2013-12-11 17:53 - 2013-12-11 18:11 - 00000000 ____D C:\Windows\erdnt
2013-12-11 17:53 - 2013-12-11 17:53 - 05153140 ____R (Swearware) C:\Users\Patrick\Desktop\ComboFix.exe
2013-12-11 17:44 - 2013-12-11 17:44 - 00000000 ____D C:\Users\Patrick\Downloads\FRST-OlderVersion
2013-12-11 17:43 - 2013-12-11 17:43 - 00000000 _____ C:\Users\Patrick\Desktop\Neues Textdokument.txt
2013-12-10 22:39 - 2013-12-10 22:39 - 00053128 _____ C:\Users\Patrick\Downloads\Addition.txt
2013-12-10 22:38 - 2013-12-11 18:15 - 00019527 _____ C:\Users\Patrick\Downloads\FRST.txt
2013-12-10 22:38 - 2013-12-11 17:44 - 01928212 _____ (Farbar) C:\Users\Patrick\Downloads\FRST64.exe
2013-12-10 22:38 - 2013-12-11 17:44 - 00000000 ____D C:\FRST
2013-12-10 22:22 - 2013-12-11 17:40 - 00135604 _____ C:\Windows\WindowsUpdate.log
2013-12-10 22:19 - 2013-12-11 17:36 - 00000112 _____ C:\Windows\setupact.log
2013-12-10 22:19 - 2013-12-10 22:19 - 00000000 _____ C:\Windows\setuperr.log
2013-12-10 22:09 - 2013-12-11 08:00 - 00366229 _____ C:\Users\Patrick\AppData\Local\census.cache
2013-12-10 22:09 - 2013-12-11 08:00 - 00143387 _____ C:\Users\Patrick\AppData\Local\ars.cache
2013-12-10 22:09 - 2013-12-10 22:09 - 00233520 _____ C:\Windows\RegBootClean64.exe
2013-12-10 21:48 - 2013-12-10 21:48 - 00000036 _____ C:\Users\Patrick\AppData\Local\housecall.guid.cache
2013-12-10 21:47 - 2013-12-10 21:48 - 02405664 _____ (Trend Micro Inc.) C:\Users\Patrick\Downloads\HousecallLauncher64.exe
2013-12-10 21:39 - 2013-12-10 21:39 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\Avira
2013-12-10 21:38 - 2013-12-10 22:24 - 00002076 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-12-10 21:38 - 2013-12-10 21:38 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-12-10 21:38 - 2013-12-10 21:38 - 00000000 ____D C:\ProgramData\APN
2013-12-10 21:38 - 2013-12-10 21:38 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-12-10 21:37 - 2013-12-10 21:37 - 00000000 ____D C:\ProgramData\Avira
2013-12-10 21:37 - 2013-12-10 21:37 - 00000000 ____D C:\Program Files (x86)\Avira
2013-12-10 21:37 - 2013-12-10 21:36 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-10 21:37 - 2013-12-10 21:36 - 00107416 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-10 21:37 - 2013-12-10 21:36 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-10 21:37 - 2013-12-10 21:36 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-12-10 21:33 - 2013-12-10 21:33 - 02294160 _____ C:\Users\Patrick\Downloads\avira_free_antivirus.exe
2013-12-10 20:46 - 2013-12-10 20:55 - 00000000 __SHD C:\Windows\SysWOW64\{$1179-4133-5326-3114$}
2013-12-09 20:45 - 2013-10-22 13:59 - 00000000 ____D C:\Users\Patrick\Downloads\Spongebob-Bob_Hits-Das_Allerbeste_Album-2013-NoGroup
2013-12-08 00:29 - 2013-12-08 00:29 - 00076888 _____ C:\Windows\system32\PnkBstrA.exe
2013-12-01 17:34 - 2013-11-30 11:18 - 00000000 ____D C:\Users\Patrick\Downloads\Sido-30-11-80-DE-2013
2013-11-30 20:55 - 2013-12-10 20:50 - 00000000 ____D C:\Users\Patrick\AppData\Local\ArmA 2 OA
2013-11-30 20:54 - 2013-11-30 20:55 - 00000000 ____D C:\Users\Patrick\Documents\ArmA 2
2013-11-30 20:54 - 2013-11-30 20:54 - 00000000 ____D C:\Users\Patrick\AppData\Local\ArmA 2
2013-11-30 19:54 - 2013-11-30 19:54 - 00000208 _____ C:\Users\Patrick\Desktop\Arma 2 Operation Arrowhead.url
2013-11-30 19:04 - 2013-11-30 19:04 - 00000208 _____ C:\Users\Patrick\Desktop\Arma 2.url
2013-11-27 00:42 - 2013-11-27 00:42 - 00037376 _____ C:\Windows\SysWOW64\uplay_r1_loader.dll
2013-11-27 00:41 - 2013-04-11 16:12 - 00019392 _____ (Dll-Files.com) C:\Windows\system32\roboot64.exe
2013-11-24 22:28 - 2013-11-25 21:49 - 00000000 ____D C:\Users\Patrick\Documents\Assassin's Creed IV Black Flag
2013-11-24 17:13 - 2013-11-24 17:13 - 00000209 _____ C:\Users\Patrick\Desktop\Assassins Creed IV Black Flag.url
2013-11-16 13:13 - 2013-11-16 13:13 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\Obsidian Entertainment
2013-11-16 13:12 - 2013-11-16 13:12 - 00000000 ____D C:\ProgramData\Obsidian Entertainment
2013-11-16 02:20 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-11-16 02:17 - 2013-11-16 02:17 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-16 02:17 - 2013-11-16 02:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-16 02:17 - 2013-11-16 02:17 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-16 02:17 - 2013-11-16 02:17 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-16 02:17 - 2013-11-16 02:17 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-16 02:17 - 2013-11-16 02:17 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-16 02:17 - 2013-11-16 02:17 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-16 02:17 - 2013-11-16 02:17 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-16 02:17 - 2013-11-16 02:17 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-16 02:17 - 2013-11-16 02:17 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-16 02:17 - 2013-11-16 02:17 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-16 01:33 - 2013-11-16 01:33 - 00000174 _____ C:\Users\Patrick\Desktop\rust..url
2013-11-15 20:09 - 2013-11-16 02:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-13 22:07 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 22:07 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 22:07 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 22:07 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 22:07 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 22:07 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 22:07 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 22:07 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 22:07 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 22:07 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 22:07 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 22:07 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-13 22:07 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-13 22:07 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 22:07 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 22:07 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 22:07 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 22:07 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 22:07 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 22:07 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 22:07 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 22:07 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 22:07 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 22:07 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 22:07 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 22:07 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 22:07 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 22:07 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 22:07 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 22:07 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-11 10:59 - 2013-11-11 11:00 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-11 10:59 - 2013-11-11 11:00 - 00000000 ____D C:\Program Files\iTunes
2013-11-11 10:59 - 2013-11-11 11:00 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-11 10:59 - 2013-11-11 10:59 - 00000000 ____D C:\Program Files\iPod
==================== One Month Modified Files and Folders =======
2013-12-11 18:15 - 2013-12-10 22:38 - 00019527 _____ C:\Users\Patrick\Downloads\FRST.txt
2013-12-11 18:14 - 2013-12-11 17:54 - 00000000 ____D C:\Qoobox
2013-12-11 18:14 - 2011-06-10 12:57 - 00000000 ____D C:\Users\Patrick\AppData\Local\Apps\2.0
2013-12-11 18:13 - 2013-12-11 18:13 - 00028208 _____ C:\ComboFix.txt
2013-12-11 18:13 - 2012-02-18 18:45 - 00000000 ____D C:\Users\Giuseppe
2013-12-11 18:13 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2013-12-11 18:11 - 2013-12-11 17:53 - 00000000 ____D C:\Windows\erdnt
2013-12-11 18:06 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-12-11 17:53 - 2013-12-11 17:53 - 05153140 ____R (Swearware) C:\Users\Patrick\Desktop\ComboFix.exe
2013-12-11 17:44 - 2013-12-11 17:44 - 00000000 ____D C:\Users\Patrick\Downloads\FRST-OlderVersion
2013-12-11 17:44 - 2013-12-10 22:38 - 01928212 _____ (Farbar) C:\Users\Patrick\Downloads\FRST64.exe
2013-12-11 17:44 - 2013-12-10 22:38 - 00000000 ____D C:\FRST
2013-12-11 17:43 - 2013-12-11 17:43 - 00000000 _____ C:\Users\Patrick\Desktop\Neues Textdokument.txt
2013-12-11 17:43 - 2009-07-14 05:45 - 00030064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-11 17:43 - 2009-07-14 05:45 - 00030064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-11 17:40 - 2013-12-10 22:22 - 00135604 _____ C:\Windows\WindowsUpdate.log
2013-12-11 17:40 - 2012-01-24 16:02 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\Skype
2013-12-11 17:36 - 2013-12-10 22:19 - 00000112 _____ C:\Windows\setupact.log
2013-12-11 08:00 - 2013-12-10 22:09 - 00366229 _____ C:\Users\Patrick\AppData\Local\census.cache
2013-12-11 08:00 - 2013-12-10 22:09 - 00143387 _____ C:\Users\Patrick\AppData\Local\ars.cache
2013-12-10 23:27 - 2012-04-09 22:23 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\Winamp
2013-12-10 23:15 - 2013-10-01 17:16 - 00000115 _____ C:\Users\Patrick\Downloads\Settings.ini
2013-12-10 22:39 - 2013-12-10 22:39 - 00053128 _____ C:\Users\Patrick\Downloads\Addition.txt
2013-12-10 22:26 - 2013-08-26 18:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-12-10 22:24 - 2013-12-10 21:38 - 00002076 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-12-10 22:19 - 2013-12-10 22:19 - 00000000 _____ C:\Windows\setuperr.log
2013-12-10 22:13 - 2011-12-10 12:39 - 00000000 ____D C:\Windows\Minidump
2013-12-10 22:13 - 2011-05-21 13:43 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\DAEMON Tools Lite
2013-12-10 22:13 - 2011-05-19 00:15 - 00000000 ____D C:\Windows\Panther
2013-12-10 22:09 - 2013-12-10 22:09 - 00233520 _____ C:\Windows\RegBootClean64.exe
2013-12-10 21:48 - 2013-12-10 21:48 - 00000036 _____ C:\Users\Patrick\AppData\Local\housecall.guid.cache
2013-12-10 21:48 - 2013-12-10 21:47 - 02405664 _____ (Trend Micro Inc.) C:\Users\Patrick\Downloads\HousecallLauncher64.exe
2013-12-10 21:39 - 2013-12-10 21:39 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\Avira
2013-12-10 21:38 - 2013-12-10 21:38 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-12-10 21:38 - 2013-12-10 21:38 - 00000000 ____D C:\ProgramData\APN
2013-12-10 21:38 - 2013-12-10 21:38 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-12-10 21:37 - 2013-12-10 21:37 - 00000000 ____D C:\ProgramData\Avira
2013-12-10 21:37 - 2013-12-10 21:37 - 00000000 ____D C:\Program Files (x86)\Avira
2013-12-10 21:36 - 2013-12-10 21:37 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-10 21:36 - 2013-12-10 21:37 - 00107416 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-10 21:36 - 2013-12-10 21:37 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-10 21:36 - 2013-12-10 21:37 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-12-10 21:33 - 2013-12-10 21:33 - 02294160 _____ C:\Users\Patrick\Downloads\avira_free_antivirus.exe
2013-12-10 21:02 - 2012-12-08 23:18 - 00000000 ____D C:\Users\Patrick\Desktop\Hack
2013-12-10 20:55 - 2013-12-10 20:46 - 00000000 __SHD C:\Windows\SysWOW64\{$1179-4133-5326-3114$}
2013-12-10 20:53 - 2011-05-18 14:25 - 00000000 ___RD C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-10 20:51 - 2012-04-08 09:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-10 20:50 - 2013-11-30 20:55 - 00000000 ____D C:\Users\Patrick\AppData\Local\ArmA 2 OA
2013-12-10 20:47 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-12-10 20:36 - 2011-06-10 15:19 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\TS3Client
2013-12-10 13:48 - 2013-09-14 12:53 - 00004570 _____ C:\Windows\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl
2013-12-10 13:48 - 2013-06-26 22:17 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl
2013-12-10 13:45 - 2012-01-24 16:02 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-10 13:45 - 2012-01-24 16:02 - 00000000 ____D C:\ProgramData\Skype
2013-12-10 13:43 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-09 21:07 - 2011-05-19 00:14 - 00710518 _____ C:\Windows\system32\perfh007.dat
2013-12-09 21:07 - 2011-05-19 00:14 - 00154848 _____ C:\Windows\system32\perfc007.dat
2013-12-09 21:07 - 2009-07-14 06:13 - 01651822 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-09 20:46 - 2011-05-18 14:27 - 00003946 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{77E57025-0BF1-40B5-B572-45D029796284}
2013-12-08 23:10 - 2011-05-18 16:29 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-12-08 22:51 - 2011-05-18 16:29 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-12-08 20:59 - 2011-09-27 14:54 - 00000000 ____D C:\Program Files (x86)\Origin
2013-12-08 20:38 - 2012-06-06 17:05 - 00000000 ____D C:\Program Files (x86)\JDownloader 2
2013-12-08 00:29 - 2013-12-08 00:29 - 00076888 _____ C:\Windows\system32\PnkBstrA.exe
2013-12-08 00:23 - 2011-09-27 16:38 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-12-07 18:19 - 2013-09-26 21:18 - 00000200 _____ C:\Users\Patrick\Downloads\Neues Textdokument.txt
2013-12-07 00:44 - 2013-11-10 12:53 - 00000252 _____ C:\Users\Patrick\AppData\Roaming\BreakingPoint_Login.ini
2013-12-07 00:44 - 2013-08-17 20:46 - 00001221 _____ C:\Users\Patrick\AppData\Roaming\BreakingPoint_Options.ini
2013-12-06 18:01 - 2013-08-15 21:14 - 00000147 _____ C:\Users\Patrick\AppData\Roaming\options.ini
2013-12-03 17:17 - 2013-11-10 12:46 - 00000000 ____D C:\Breaking Point
2013-11-30 20:55 - 2013-11-30 20:54 - 00000000 ____D C:\Users\Patrick\Documents\ArmA 2
2013-11-30 20:54 - 2013-11-30 20:54 - 00000000 ____D C:\Users\Patrick\AppData\Local\ArmA 2
2013-11-30 19:54 - 2013-11-30 19:54 - 00000208 _____ C:\Users\Patrick\Desktop\Arma 2 Operation Arrowhead.url
2013-11-30 19:04 - 2013-11-30 19:04 - 00000208 _____ C:\Users\Patrick\Desktop\Arma 2.url
2013-11-30 11:18 - 2013-12-01 17:34 - 00000000 ____D C:\Users\Patrick\Downloads\Sido-30-11-80-DE-2013
2013-11-28 17:12 - 2013-07-06 16:19 - 00000000 ____D C:\Users\Patrick\AppData\Local\Arma 3
2013-11-28 16:41 - 2012-12-21 19:01 - 00000032 _____ C:\folder.ini
2013-11-27 00:42 - 2013-11-27 00:42 - 00037376 _____ C:\Windows\SysWOW64\uplay_r1_loader.dll
2013-11-25 23:31 - 2013-08-17 15:47 - 00000000 ____D C:\Users\Patrick\Desktop\Cheathappens GameCheatz
2013-11-25 21:49 - 2013-11-24 22:28 - 00000000 ____D C:\Users\Patrick\Documents\Assassin's Creed IV Black Flag
2013-11-25 19:18 - 2012-05-19 22:56 - 00000000 ____D C:\Users\Patrick\Desktop\Programme
2013-11-24 22:28 - 2012-11-29 11:53 - 00001211 _____ C:\Users\Patrick\Desktop\Uplay.lnk
2013-11-24 22:27 - 2011-05-18 16:29 - 00075136 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-11-24 22:25 - 2011-05-18 14:47 - 01625166 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-11-24 21:43 - 2011-05-18 16:36 - 00280792 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-11-24 17:13 - 2013-11-24 17:13 - 00000209 _____ C:\Users\Patrick\Desktop\Assassins Creed IV Black Flag.url
2013-11-19 11:21 - 2011-05-18 14:53 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-17 17:14 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-16 13:13 - 2013-11-16 13:13 - 00000000 ____D C:\Users\Patrick\AppData\Roaming\Obsidian Entertainment
2013-11-16 13:12 - 2013-11-16 13:12 - 00000000 ____D C:\ProgramData\Obsidian Entertainment
2013-11-16 11:58 - 2011-05-18 14:25 - 00001431 _____ C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-16 11:57 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-16 11:56 - 2012-04-27 17:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-16 02:17 - 2013-11-16 02:17 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-16 02:17 - 2013-11-16 02:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-16 02:17 - 2013-11-16 02:17 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-16 02:17 - 2013-11-16 02:17 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-16 02:17 - 2013-11-16 02:17 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-16 02:17 - 2013-11-16 02:17 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-16 02:17 - 2013-11-16 02:17 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-16 02:17 - 2013-11-16 02:17 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-16 02:17 - 2013-11-16 02:17 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-16 02:17 - 2013-11-16 02:17 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-16 02:17 - 2013-11-16 02:17 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-16 02:17 - 2013-11-16 02:17 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-16 02:17 - 2013-11-16 02:17 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-16 02:06 - 2013-11-15 20:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-16 01:33 - 2013-11-16 01:33 - 00000174 _____ C:\Users\Patrick\Desktop\rust..url
2013-11-14 20:52 - 2012-04-08 09:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-14 20:52 - 2012-04-08 09:56 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-14 20:52 - 2011-06-03 19:55 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-14 20:51 - 2011-06-23 11:37 - 00000000 ____D C:\Users\Patrick\AppData\Local\Adobe
2013-11-14 00:25 - 2011-08-09 21:08 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-14 00:25 - 2011-05-18 14:47 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-11-14 00:25 - 2011-05-18 14:46 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-14 00:24 - 2013-08-15 23:07 - 00000000 ____D C:\Windows\system32\MRT
2013-11-14 00:21 - 2011-05-18 15:09 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-11 11:00 - 2013-11-11 10:59 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-11 11:00 - 2013-11-11 10:59 - 00000000 ____D C:\Program Files\iTunes
2013-11-11 11:00 - 2013-11-11 10:59 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-11 10:59 - 2013-11-11 10:59 - 00000000 ____D C:\Program Files\iPod
Files to move or delete:
====================
C:\ProgramData\hash.dat
C:\ProgramData\hpe29C5.dll
Some content of TEMP:
====================
C:\Users\Patrick\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-01 16:55
==================== End Of Log ============================
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
! Zusatz !: Ich konnte davor wo ich mich noch nicht gemeldet hatte Avira zwar installieren aber nicht ausführen bekamm immer eine Fehlermeldung. Habe danach diesen House Call Launcher genutzt und darüber ein Scann durchgeführt als Info für euch eventuell Hilft euch das ja
Kleiner Zwischenstand:
Ich bedanke mich erstmal RICHTIG RICHTIG RIIICHTIG DOLL bei dir :)
Ich kann nun wieder ohne Probleme mein Sicherheitscenter anschalten und Microsoft Security Essentials ist auch wieder da :) :)
Zu meiner Frage noch dazu : Welchen Antivirenschutz kannst du mir Empfehlen ? Hatte bis jetzt ja keine Probleme mit Microsoft Security Essentials
Und machen wir hier noch Weiter mit Test´s ? Eventuell findet sich ja doch was |
FRST 32-Bit | FRST 64-Bit
Malwarebytes Anti-Malware 
TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
Aktualität von System und Software