Trojaner-Board - Fake Windows Security Update MS13-052

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Fake Windows Security Update MS13-052 (https://www.trojaner-board.de/149314-fake-windows-security-update-ms13-052-a.html)

Fake Windows Security Update MS13-052

Hi, habe identes Problem wie http://www.trojaner-board.de/145996-...ate-popup.html hier, habe die selben Schritte versucht, Malware, AdwCleaner und Junkware Removal haben leider nicht geholfen, da dachte ich ich frage mal hier nach :)

Mein FRST habe ich anbei, die andern Logs habe ich leider nicht mehr, nur JRT ist auch angehängt. Hoffe ich hab alles nötige gepostet,
vielen Dank schonmal für die Hilfe! :)

FRST:
FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2014

Ran by Mike (administrator) on MIKE-PC on 05-02-2014 20:25:01

Running from D:\Downloads

Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AVAST Software) D:\Programme\Avast Antivirus\AvastSvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hi-Rez Studios) D:\Programme\Tribes Ascend\HiPatchService.exe

() C:\Windows\SysWOW64\XSrvSetup.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Software 2000 Limited) C:\Windows\System32\spool\drivers\x64\3\HP1006MC.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(DT Soft Ltd) D:\Programme\DAEMON Tools Pro\DTShellHlp.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(Spotify Ltd) C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Flux Software LLC) C:\Users\Mike\AppData\Local\FluxSoftware\Flux\flux.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(MySQL, Inc.) C:\ProgramData\8EGKXbpz.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Razer USA Ltd) C:\Program Files (x86)\Razer\Imperator\RazerImperatorTray.exe

(Razer USA Ltd.) D:\Programme\Razer\Tarantula\razerhid.exe

(Apple Inc.) D:\Programme\iTunes\iTunesHelper.exe

() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

(Advanced Micro Devices Inc.) D:\Programme\ATI\ATI.ACE\Core-Static\MOM.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(AVAST Software) D:\Programme\Avast Antivirus\AvastUI.exe

(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

(ATI Technologies Inc.) D:\Programme\ATI\ATI.ACE\Core-Static\CCC.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

() D:\Programme\Razer\Tarantula\razertra.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(Mozilla Corporation) D:\Programme\Mozilla Firefox\firefox.exe

(Mozilla Corporation) D:\Programme\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2000-01-01] (Realtek Semiconductor)

HKLM-x32\...\Run: [ATICustomerCare] - C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-05-04] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [43608 2000-01-01] ()

HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Razer Imperator Driver] - C:\Program Files (x86)\Razer\Imperator\RazerImperatorTray.exe [2787224 2010-09-07] (Razer USA Ltd)

HKLM-x32\...\Run: [Tarantula] - D:\Programme\Razer\Tarantula\razerhid.exe [159744 2007-05-07] (Razer USA Ltd.)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-11-01] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\iTunes\iTunesHelper.exe [421736 2012-01-16] (Apple Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [StartCCC] - D:\Programme\ATI\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [AvastUI.exe] - D:\Programme\Avast Antivirus\AvastUI.exe [3764024 2014-01-08] (AVAST Software)

HKLM-x32\...\Run: [] - [X]

HKLM-x32\...\Run: [Razer Synapse] - C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [442712 2013-11-17] (Razer Inc.)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [ISUSPM Startup] - "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-12-08] (AMD)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [Pando Media Booster] - "null\Pando Networks\Media Booster\PMB.exe"

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [Spotify Web Helper] - C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-22] (Spotify Ltd)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [f.lux] - C:\Users\Mike\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [8EGKXbpz] - C:\ProgramData\8EGKXbpz.exe [428032 2014-02-05] (MySQL, Inc.)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\MountPoints2: {9dcfcac0-408e-11e1-a9f2-806e6f6e6963} - F:\setup.exe

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\MountPoints2: {9dcfcac1-408e-11e1-a9f2-806e6f6e6963} - G:\setup.exe

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\MountPoints2: {c604cc0f-e5c1-11df-9344-1c6f65391dc1} - G:\autorun.exe

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\MountPoints2: {d1d1ed68-fe0a-11df-b871-1c6f65391dc1} - J:\LaunchU3.exe -a
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1EF3F36AB9BECD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at

BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\Avast Antivirus\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)

Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - D:\Programme\Avast Antivirus\aswWebRepIE.dll (AVAST Software)

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
 

FireFox:

========

FF ProfilePath: C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default

FF Homepage: hxxp://orf.at/

FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"

FF NetworkProxy: "type", 2

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - null\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @raidcall.en/RCplugin - C:\Users\Mike\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)

FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - D:\Programme\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - D:\Programme\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - D:\Programme\Adobe Reader X\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @doubletwist.com/NPPodcast - C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll No File

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - D:\Downloads\null\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: GFACE Experience Plugin - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\cryenginebrowserplugin@crytek.com [2013-11-07]

FF Extension: TinEye Reverse Image Search - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\tineye@ideeinc.com [2011-02-18]

FF Extension: Microsoft .NET Framework Assistant - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-10-31]

FF Extension: Google Toolbar for Firefox - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-06-01]

FF Extension: EPUBReader - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2013-12-02]

FF Extension: InFormEnter - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{5546F97E-11A5-46b0-9082-32AD74AAA920} [2013-10-21]

FF Extension: Nightly Tester Tools - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{8620c15f-30dc-4dba-a131-7c5d20cf4a29} [2013-10-31]

FF Extension: Block site - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2013-08-11]

FF Extension: Honey - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\jid1-93CWPmRbVPjRQA@jetpack.xpi [2013-10-09]

FF Extension: Media Hint - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\mediahint@jetpack.xpi [2013-08-01]

FF Extension: FlashGot - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2011-04-10]

FF Extension: Adblock Plus - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-03-27]

FF Extension: DownThemAll! - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2011-05-19]

FF Extension: Greasemonkey - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012-08-25]

FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}

FF Extension: Adobe Contribute Toolbar - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-12-07]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - D:\Programme\Avast Antivirus\WebRep\FF

FF Extension: avast! Online Security - D:\Programme\Avast Antivirus\WebRep\FF [2013-01-21]

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-18]

FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla Firefox\firefox.exe
 

==================== Services (Whitelisted) =================
 

R2 avast! Antivirus; D:\Programme\Avast Antivirus\AvastSvc.exe [50344 2014-01-08] (AVAST Software)

S3 DAUpdaterSvc; D:\Programme\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2013-12-11] (BioWare)

R2 HiPatchService; D:\Programme\Tribes Ascend\HiPatchService.exe [9216 2013-11-26] (Hi-Rez Studios)

R2 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72304 2000-01-01] ()

S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Microsoft Office\Office14\GROOVE.EXE [50899608 2012-09-20] (Microsoft Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4089336 2011-03-08] (INCA Internet Co., Ltd.)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-08-16] ()

S3 SandraAgentSrv; C:\Programme\SiSoftware\SiSoftware Sandra Lite 2010.SP3\RpcAgentSrv.exe [93848 2009-08-10] (SiSoftware)

S4 TlntSvr; C:\Windows\System32\tlntsvr.exe [81920 2009-07-14] (Microsoft Corporation)

S3 TunngleService; D:\Programme\Tunngle\TnglCtrl.exe [743320 2012-09-25] (Tunngle.net GmbH)
 

==================== Drivers (Whitelisted) ====================
 

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-01-08] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-03] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-03] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2014-01-08] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2014-01-08] (AVAST Software)

R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2014-01-08] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-08] ()

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-01-31] ()

S3 CYUSB; C:\Windows\System32\Drivers\CYUSB.sys [47104 2009-08-10] (Cypress Semiconductor)

S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [556120 2013-01-21] (Kaspersky Lab)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-01-31] ()

S3 Lycosa; C:\Windows\System32\drivers\Lycosa.sys [18816 2008-01-17] (Razer USA Ltd.)

S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2005-01-03] (INCA Internet Co., Ltd.)

S3 RzSynapse; C:\Windows\System32\DRIVERS\RzSynapse.sys [126464 2011-03-31] (Razer USA Ltd)

S3 s1018bus; C:\Windows\System32\DRIVERS\s1018bus.sys [113704 2009-03-25] (MCCI Corporation)

S3 s1018mdfl; C:\Windows\System32\DRIVERS\s1018mdfl.sys [19496 2009-03-25] (MCCI Corporation)

S3 s1018mdm; C:\Windows\System32\DRIVERS\s1018mdm.sys [153128 2009-03-25] (MCCI Corporation)

S3 s1018mgmt; C:\Windows\System32\DRIVERS\s1018mgmt.sys [133160 2009-03-25] (MCCI Corporation)

S3 s1018nd5; C:\Windows\System32\DRIVERS\s1018nd5.sys [34856 2009-03-25] (MCCI Corporation)

S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [128552 2009-03-25] (MCCI Corporation)

S3 s1018unic; C:\Windows\System32\DRIVERS\s1018unic.sys [146472 2009-03-25] (MCCI Corporation)

S3 SANDRA; C:\Programme\SiSoftware\SiSoftware Sandra Lite 2010.SP3\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [526392 2012-01-16] ()

S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-12-29] ()

R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

R3 TarFltr; C:\Windows\System32\drivers\UsbFltr.sys [49664 2007-04-11] (Razer USA Ltd.)

S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [19200 2005-10-21] (Motorola)

S3 uisp; C:\Windows\SysWOW64\Drivers\usbicp.sys [14592 2005-12-21] (Motorola)

U3 azothjy3; C:\Windows\System32\Drivers\azothjy3.sys [0 ] (Advanced Micro Devices)

S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]

S4 DAdderFltr; system32\drivers\dadder.sys [X]

S3 dump_wmimmc; \??\D:\Programme\Garena Messenger\Apps\BlackShot\BlackShot\System\GameGuard\dump_wmimmc.sys [X]

S3 GGSAFERDriver; \??\D:\Programme\Garena\safedrv.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 TEAM; system32\DRIVERS\RtTeam60.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

U5 UnlockerDriver5; D:\Programme\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()

S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

S3 VLAN; system32\DRIVERS\RtVLAN60.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-05 20:24 - 2014-02-05 20:25 - 00000000 ____D () C:\FRST

2014-02-05 20:14 - 2014-02-05 20:14 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-05 20:12 - 2014-02-05 20:12 - 00002982 _____ () C:\Users\Mike\Desktop\JRT.txt

2014-02-05 20:07 - 2014-02-05 20:07 - 00000000 ____D () C:\Windows\ERUNT

2014-02-05 20:00 - 2014-02-05 20:02 - 00000000 ____D () C:\AdwCleaner

2014-02-05 17:27 - 2014-02-05 20:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Malwarebytes

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-05 16:27 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-02-05 16:18 - 2014-02-05 16:18 - 00189952 _____ (Formosa Soft Inc. www.formosasoft.com) C:\Users\Mike\AppData\Local\foghrqftmg.exe

2014-02-05 16:17 - 2014-02-05 16:17 - 00428032 ____H (MySQL, Inc.) C:\ProgramData\8EGKXbpz.exe

2014-01-21 09:26 - 2014-01-21 09:26 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-01-15 19:53 - 2014-01-15 19:53 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\TheBannerSaga

2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-01-14 02:53 - 2014-01-14 02:53 - 00296448 _____ (Razer Inc) C:\Windows\SysWOW64\rzaudiodll.dll

2014-01-14 02:53 - 2014-01-14 02:53 - 00088576 _____ (Razer Inc) C:\Windows\SysWOW64\rzdevinfo.dll

2014-01-10 16:15 - 2014-01-10 16:15 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online

2014-01-08 11:53 - 2014-01-08 11:53 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
 

==================== One Month Modified Files and Folders =======
 

2014-02-05 20:25 - 2014-02-05 20:24 - 00000000 ____D () C:\FRST

2014-02-05 20:14 - 2014-02-05 20:14 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-05 20:12 - 2014-02-05 20:12 - 00002982 _____ () C:\Users\Mike\Desktop\JRT.txt

2014-02-05 20:11 - 2012-09-21 23:43 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-05 20:08 - 2009-07-14 18:58 - 24007804 _____ () C:\Windows\system32\perfh007.dat

2014-02-05 20:08 - 2009-07-14 18:58 - 07518072 _____ () C:\Windows\system32\perfc007.dat

2014-02-05 20:08 - 2009-07-14 06:13 - 00006506 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-05 20:08 - 2009-07-14 05:45 - 00014416 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-05 20:08 - 2009-07-14 05:45 - 00014416 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-05 20:07 - 2014-02-05 20:07 - 00000000 ____D () C:\Windows\ERUNT

2014-02-05 20:06 - 2010-10-27 17:04 - 01741886 _____ () C:\Windows\WindowsUpdate.log

2014-02-05 20:05 - 2014-02-05 17:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-02-05 20:05 - 2012-10-14 02:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-02-05 20:03 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-05 20:03 - 2009-07-14 05:51 - 00168155 _____ () C:\Windows\setupact.log

2014-02-05 20:02 - 2014-02-05 20:00 - 00000000 ____D () C:\AdwCleaner

2014-02-05 17:11 - 2012-09-21 23:43 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-05 17:11 - 2012-04-08 10:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-05 17:11 - 2011-05-19 15:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Malwarebytes

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-05 16:18 - 2014-02-05 16:18 - 00189952 _____ (Formosa Soft Inc. www.formosasoft.com) C:\Users\Mike\AppData\Local\foghrqftmg.exe

2014-02-05 16:17 - 2014-02-05 16:17 - 00428032 ____H (MySQL, Inc.) C:\ProgramData\8EGKXbpz.exe

2014-02-04 03:11 - 2013-03-05 02:34 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\vlc

2014-02-03 13:34 - 2013-01-21 19:08 - 00004164 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-01-31 01:27 - 2010-11-14 15:43 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Skype

2014-01-28 23:57 - 2010-10-28 17:51 - 00770958 _____ () C:\Windows\DPINST.LOG

2014-01-27 16:49 - 2010-10-28 13:44 - 00571322 _____ () C:\Windows\DirectX.log

2014-01-24 14:44 - 2011-03-14 17:03 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\uTorrent

2014-01-22 00:03 - 2013-04-02 23:43 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Spotify

2014-01-21 20:44 - 2013-04-02 23:44 - 00000000 ____D () C:\Users\Mike\AppData\Local\Spotify

2014-01-21 09:27 - 2013-10-17 21:52 - 00000000 ____D () C:\ProgramData\Oracle

2014-01-21 09:26 - 2014-01-21 09:26 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-01-21 09:26 - 2010-10-28 18:32 - 00000000 ____D () C:\Program Files (x86)\Java

2014-01-21 09:05 - 2010-11-03 13:53 - 00000000 ____D () C:\Users\Mike\AppData\Local\Adobe

2014-01-18 14:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-01-18 03:08 - 2013-10-25 20:49 - 00000000 ____D () C:\Users\Mike\AppData\Local\Battle.net

2014-01-16 11:10 - 2009-07-14 05:45 - 04992608 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-01-16 01:31 - 2013-08-15 10:50 - 00000000 ____D () C:\Windows\system32\MRT

2014-01-16 01:29 - 2010-02-09 23:33 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-01-15 19:53 - 2014-01-15 19:53 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\TheBannerSaga

2014-01-14 02:53 - 2014-01-14 02:53 - 00296448 _____ (Razer Inc) C:\Windows\SysWOW64\rzaudiodll.dll

2014-01-14 02:53 - 2014-01-14 02:53 - 00088576 _____ (Razer Inc) C:\Windows\SysWOW64\rzdevinfo.dll

2014-01-10 17:47 - 2013-11-16 23:26 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Awesomium

2014-01-10 16:15 - 2014-01-10 16:15 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online

2014-01-09 10:24 - 2010-11-01 18:46 - 00285612 _____ () C:\Windows\PFRO.log

2014-01-08 11:53 - 2014-01-08 11:53 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-01-08 11:53 - 2013-03-19 13:22 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-01-08 11:53 - 2013-01-21 19:08 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-01-08 11:53 - 2013-01-21 19:08 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-01-08 11:53 - 2013-01-21 19:08 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-01-08 11:53 - 2013-01-21 19:08 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-01-08 11:53 - 2013-01-21 19:08 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
 

Files to move or delete:

====================

C:\ProgramData\8EGKXbpz.exe
 
 

Some content of TEMP:

====================

C:\Users\Mike\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe

C:\Users\Mike\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-31 18:57
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-02-2014

Ran by Mike at 2014-02-05 20:25:18

Running from D:\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

µTorrent (x32 Version: 2.2.1 - )

3DMark Vantage (x32 Version: 1.1.0 - Futuremark Corporation)

AC3Filter 2.5b (x32 Version: 2.5b - Alexander Vigovsky)

Active@ ISO Burner (x32 Version: 2.1.0 - LSoft Technologies)

Adobe AIR (x32 Version: 3.6.0.6090 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.6.0.6090 - Adobe Systems Incorporated) Hidden

Adobe Community Help (x32 Version: 3.0.0 - Adobe Systems Incorporated) Hidden

Adobe Community Help (x32 Version: 3.0.0.400 - Adobe Systems Incorporated)

Adobe Creative Suite 5 Master Collection (x32 Version: 5.0 - Adobe Systems Incorporated)

Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)

Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)

Adobe Media Player (x32 Version: 1.8 - Adobe Systems Incorporated)

Adobe Media Player (x32 Version: 1.8 - Adobe Systems Incorporated) Hidden

Adobe Reader X (10.1.9) - Deutsch (x32 Version: 10.1.9 - Adobe Systems Incorporated)

Adobe Shockwave Player 11.6 (x32 Version: 11.6.0.626 - Adobe Systems, Inc.)

AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden

AMD APP SDK Runtime (Version: 10.0.938.1 - Advanced Micro Devices Inc.) Hidden

AMD Catalyst Install Manager (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden

AMD Media Foundation Decoders (Version: 1.0.70727.2220 - Advanced Micro Devices, Inc.) Hidden

Angry Birds (x32 Version: 1.5.1 - Rovio)

ANNO 2070 (x32 Version: 1.0.0.0 - Ubisoft)

Apple Application Support (x32 Version: 2.1.6 - Apple Inc.)

Apple Mobile Device Support (Version: 4.0.0.97 - Apple Inc.)

Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)

applicationupdater (HKCU Version:  - Sony Online Entertainment)

ATI Catalyst Registration (x32 Version: 3.00.0000 - ATI Technologies Inc.) Hidden

Audacity 1.3.13 (Unicode) (x32 Version:  - Audacity Team)

avast! Free Antivirus (x32 Version: 9.0.2011 - Avast Software)

Bastion (x32 Version:  - Supergiant Games)

Battle.net (x32 Version:  - Blizzard Entertainment)

Battlefield 3™ (x32 Version: 1.6.0.0 - Electronic Arts)

Battlelog Web Plugins (x32 Version: 2.1.7 - EA Digital Illusions CE AB)

Bonjour (Version: 3.0.0.10 - Apple Inc.)

Borderlands 2 (x32 Version:  - )

Borderlands 2 (x32 Version:  - Gearbox Software)

Brothers - A Tale of Two Sons (x32 Version:  - 505 Games)

BulletStorm (x32 Version: 1.0.0001.130 - EA) Hidden

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center (x32 Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden

CDisplay 1.8 (x32 Version:  - dvd8n)

Company of Heroes (x32 Version:  - Relic)

Cossacks - Back To War (x32 Version:  - )

Cossacks - The Art Of War (x32 Version:  - )

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

DAEMON Tools Pro (x32 Version: 4.41.0315.0262 - DT Soft Ltd)

Dark Souls: Prepare to Die Edition (x32 Version:  - FromSoftware)

Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (Version:  - Microsoft)

Divinity II - Ego Draconis (x32 Version:  - dtp)

DivX-Setup (x32 Version: 2.6.1.24 - DivX, LLC)

Dota 2 (x32 Version:  - )

Dragon Age: Origins - Ultimate Edition (x32 Version:  - BioWare)

Dropbox (HKCU Version: 2.0.22 - Dropbox, Inc.)

Easy Thumbnails (Remove only) (x32 Version: 3.0 - Fookes Software)

ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)

Europa Universalis III (x32 Version:  - )

Europa Universalis III (x32 Version:  - Paradox Development Studio)

Europa Universalis IV (x32 Version:  - Paradox Development Studio)

Europa Universalis IV (x32 Version:  - Paradox Interactive)

f.lux (HKCU Version:  - )

Fallout 3 (x32 Version: 1.00.0000 - Bethesda Softworks)

Game Dev Tycoon (x32 Version:  - Greenheart Games)

Game Dev Tycoon v1.3.2 (c) Greenheart Games version 1 (x32 Version: 1 - )

gamelauncher-ps2-live (HKCU Version:  - Sony Online Entertainment)

GUILD WARS (HKCU Version:  - )

Guild Wars 2 (x32 Version:  - NCsoft Corporation, Ltd.)

Hearthstone (x32 Version:  - Blizzard Entertainment)

Hero Academy (x32 Version:  - Robot Entertainment)

Hi-Rez Studios Authenticate and Update Service (x32 Version: 3.0.0.0 - Hi-Rez Studios)

Hotline Miami (x32 Version:  - Dennaton Games)

HP LaserJet P1000 series (x32 Version:  - )

HydraVision (x32 Version: 4.2.220.0 - Advanced Micro Devices, Inc.) Hidden

iTunes (Version: 10.5.3.3 - Apple Inc.)

Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

Java(TM) 6 Update 35 (x32 Version: 6.0.350 - Oracle)

JDownloader (x32 Version:  - AppWork UG (haftungsbeschränkt))

JDownloader 2.0 (x32 Version: 2.0 - AppWork GmbH)

JGoodies JDiskReport 1.3.2 (x32 Version: 1.3.2 (2009-12-18 11:57:44) - JGoodies Karsten Lentzsch)

JMicron JMB36X Driver (x32 Version: 1.17.65.11 - JMicron Technology Corp.)

Junction Link Magic 2.0 (Version:  - )

Kies Air Discovery Service (HKCU Version:  - Samsung)

King's Bounty: The Legend (x32 Version:  - 1C Company)

K-Lite Codec Pack 6.1.0 (64-bit) (Version: 6.1.0 - )

Knights of Pen and Paper +1 (x32 Version:  - Behold Studios)

League of Legends (x32 Version: 1.3 - Riot Games)

Left 4 Dead 2 (x32 Version:  - Valve)

Link Shell Extension (Version:  - )

Magic The Gathering - Duels of the Planeswalkers 2012 (x32 Version:  - )

Magicka (x32 Version:  - Arrowhead Game Studios)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

Mass Effect (x32 Version: 1.00 - Electronic Arts, Inc.)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Metro 2033 (x32 Version:  - 4A Games)

Microsoft .NET Framework 1.1 (x32 Version:  - )

Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5 Client Profile Developer Preview (Version: 4.5.40805 - Microsoft Corporation)

Microsoft .NET Framework 4.5 Client Profile Developer Preview (Version: 4.5.40805 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5 Extended Developer Preview (Version: 4.5.40805 - Microsoft Corporation)

Microsoft .NET Framework 4.5 Extended Developer Preview (Version: 4.5.40805 - Microsoft Corporation) Hidden

Microsoft Age of Empires II (x32 Version:  - )

Microsoft Age of Empires II: The Conquerors Expansion (x32 Version:  - )

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Office 2010 Service Pack 1 (SP1) (Version:  - Microsoft)

Microsoft Office 2010 Service Pack 1 (SP1) (Version:  - Microsoft) Hidden

Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Office 32-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (x32 Version: 11.0.51106.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (x32 Version: 11.0.51106.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden

Microsoft XNA Framework Redistributable 3.1 (x32 Version: 3.1.10527.0 - Microsoft Corporation)

Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden

Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden

Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden

Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden

Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden

Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden

Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden

Miranda Fusion 3.1.15.1 (x32 Version: 3.1.15.1 - Miranda Fusion Team)

Mount & Blade (x32 Version:  - Tale Worlds)

Mount & Blade: With Fire and Sword (x32 Version:  - TaleWorlds)

Mozilla Firefox 10.0.1 (x86 de) (x32 Version: 10.0.1 - Mozilla)

Mozilla Firefox 26.0 (x86 de) (HKCU Version: 26.0 - Mozilla)

Mozilla Maintenance Service (x32 Version: 24.3.0 - Mozilla)

Mozilla Thunderbird 24.3.0 (x86 de) (x32 Version: 24.3.0 - Mozilla)

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)

Mumble 1.2.3 (x32 Version: 1.2.3 - Thorvald Natvig)

NVIDIA PhysX (x32 Version: 9.11.1111 - NVIDIA Corporation)

OpenAL (x32 Version:  - )

Origin (x32 Version: 9.2.1.4399 - Electronic Arts, Inc.)

Pando Media Booster (x32 Version: 2.6.0.9 - Pando Networks Inc.)

Path of Exile (x32 Version: 0.9.13.21996 - Grinding Gear Games)

PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden

Pinball FX2 (x32 Version:  - Zen Studios)

PlanetSide 2 (x32 Version:  - Sony Online Entertainment)

Plants vs. Zombies: Game of the Year (x32 Version:  - PopCap)

PunkBuster Services (x32 Version: 0.991 - Even Balance, Inc.)

PxMergeModule (x32 Version: 1.00.0000 - Your Company Name) Hidden

QuickTime (x32 Version: 7.70.80.34 - Apple Inc.)

RaidCall (x32 Version: 7.1.6-1.0.4610.40 - raidcall.com)

Razer Imperator (x32 Version: 1.02.01 - Razer USA Ltd.)

Razer Synapse 2.0 (x32 Version: 1.16.6 - Razer Inc.)

Razer Tarantula (x32 Version: 5.01 - Razer USA Ltd.)

Realtek Ethernet Controller Driver (x32 Version: 7.56.316.2012 - Realtek)

Realtek HDMI Audio Driver for ATI (x32 Version: 6.0.1.6409 - Realtek Semiconductor Corp.)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.7083 - Realtek Semiconductor Corp.)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.27.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.27.0 - Renesas Electronics Corporation) Hidden

Risen 2: Dark Waters (x32 Version:  - )

Rockstar Games Social Club (x32 Version: 1.00.0000 - Rockstar Games)

Rome - Total War - Gold Edition (x32 Version: 1.6 - The Creative Assembly)

Rome: Total War (x32 Version:  - The Creative Assembly)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden

Sid Meier's Civilization V (x32 Version:  - 2K Games, Inc.)

SiSoftware Sandra Lite 2010.SP3 (Version: 16.67.2010.10 - SiSoftware)

Skype Click to Call (x32 Version: 5.9.9216 - Skype Technologies S.A.)

Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)

SlimCleaner (x32 Version: 0.9.3970 - Slimware Utilities, Inc.)

SlimComputer (x32 Version: 1.0.3946 - Slimware Utilities, Inc.)

SlimDrivers (x32 Version: 2.2.32705 - SlimWare Utilities, Inc.)

Smite (x32 Version: 0.1.1868.4 - Hi-Rez Studios)

Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)

Steam (x32 Version: 1.0.0.0 - Valve Corporation)

Super Hexagon (x32 Version:  - Terry Cavanagh)

TeamSpeak 3 Client (Version:  - TeamSpeak Systems GmbH)

The Banner Saga (x32 Version: 1 - )

The Elder Scrolls V: Skyrim (x32 Version:  - Bethesda Game Studios)

The Lord of the Rings FREE Trial  (x32 Version: 1.00.0000 - ATI Technologies Inc.) Hidden

Torchlight II (c) Runic Games version 1 (x32 Version: 1 - )

Total War ROME II (x32 Version: 1 - )

Total War: SHOGUN 2 (x32 Version:  - The Creative Assembly)

Tunngle beta (x32 Version:  - Tunngle.net GmbH)

Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)

Unlocker 1.9.0-x64 (Version: 1.9.0-x64 - Cedrick Collomb)

Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2494150) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2553065) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2566458) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2687509) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760758) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2767886) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2597090) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2598240) 64-Bit Edition (Version:  - Microsoft)

Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition (Version:  - Microsoft)

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

Ventrilo Client for Windows x64 (Version: 3.0.8.0 - Flagship Industries, Inc.)

VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN)

War of the Roses (x32 Version:  - Fatshark)

Warcraft III (x32 Version:  - )

Warcraft III: All Products (HKCU Version:  - )

Winamp (x32 Version: 5.666  - Nullsoft, Inc)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden

Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)

Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)

WinRAR (Version:  - )

Xiph.Org Open Codecs 0.85.17777 (x32 Version: 0.85.17777 - Xiph.Org)
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {096EEAF0-BB7A-4C82-926F-B8BE9F6ADAF8} - System32\Tasks\{CC93E513-5F54-4A32-8F63-7EB9BFA6EB9A} => D:\Programme\Titan Quest\Titan Quest.exe

Task: {2134F164-42A1-4620-A9EB-9A134908A797} - System32\Tasks\{C7280095-C882-49A8-A43C-C71F9401B30D} => D:\Spiele\Mortal Kombat 4\Mortal Kombat 4.exe [1998-06-26] ()

Task: {2B289907-E964-4EE1-BF79-2CF3BEEC4714} - System32\Tasks\{08FF5182-2D41-4D48-92A6-AAA622402E6C} => D:\Programme\Titan Quest\Titan Quest.exe

Task: {2D424E06-7F37-4829-85DC-BD98C66DA02D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-05] (Adobe Systems Incorporated)

Task: {34A2D66E-B395-425F-9E4B-2BDEC5BC1A1F} - System32\Tasks\{636953AB-0572-4449-A7B5-FB6043D1F0BC} => D:\Downloads\6b1546_4bcc4148bac1a\brew-jc2.exe

Task: {397F967B-EEFB-4157-819B-979B5C2BAA14} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {4C557328-0C68-4C44-B9B6-2E56A7365BDB} - System32\Tasks\{EDD841CD-50F1-4656-AAA1-19FD7377DA1A} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)

Task: {548D7D08-6778-419F-A733-955E2715B584} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-297277249-2334410078-3630889142-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe

Task: {6ED00654-5F74-4BFA-B8FD-C42EBCC5021C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {BA56D430-BFDD-48A7-8813-8AE63EB53E6A} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-297277249-2334410078-3630889142-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe

Task: {BBC6BF2B-E70A-48D5-A5AB-E2542C68097C} - System32\Tasks\{4BDF621E-9D6C-4F67-B142-C011AEF4BF3B} => D:\Programme\Medieval - Total War\Medieval_TW.exe

Task: {BD26C237-E14B-4DF4-9BD4-0F2EF26B27AA} - System32\Tasks\SlimDrivers Scan => D:\Programme\SlimDrivers\SlimDrivers.exe

Task: {E19A3C3E-C780-4977-A34A-94C9EE0C743D} - System32\Tasks\avast! Emergency Update => D:\Programme\Avast Antivirus\AvastEmUpdate.exe [2014-01-08] (AVAST Software)

Task: {E9FE79A6-5199-4EAB-8733-4D2BB6212205} - System32\Tasks\{CD91A005-A473-4A57-BA93-CE8D0773F587} => D:\Downloads\MirandaFusion3.0.6Setup.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\SlimDrivers Scan.job => D:\Programme\SlimDrivers\SlimDrivers.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-03-17 00:07 - 2011-03-17 00:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

2004-09-30 19:15 - 2004-09-30 19:15 - 00192000 _____ () D:\Programme\LinkShellExtension\RockallDLL.dll

2014-02-05 11:06 - 2014-02-05 10:22 - 02168320 _____ () D:\Programme\Avast Antivirus\defs\14020500\algo.dll

2011-09-27 06:23 - 2011-09-27 06:23 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2011-09-27 06:22 - 2011-09-27 06:22 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2010-11-01 17:54 - 2009-08-16 17:06 - 00141312 _____ () D:\Programme\WinRar\rarext32.dll

2013-02-13 03:38 - 2013-02-13 03:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll

2013-12-03 20:01 - 2013-12-03 20:01 - 19336120 _____ () D:\Programme\Avast Antivirus\libcef.dll

2014-02-05 17:27 - 2014-02-05 17:27 - 03019376 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll

2014-02-05 17:27 - 2014-02-05 17:27 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll

2014-02-05 17:27 - 2014-02-05 17:27 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll

2013-12-20 02:36 - 2013-12-20 02:37 - 03559024 _____ () D:\Programme\Mozilla Firefox\mozjs.dll

2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2014-02-05 17:11 - 2014-02-05 17:11 - 16287624 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2011-05-24 00:30:58.988

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-05-24 00:30:58.968

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-05-24 00:30:58.628

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-05-24 00:30:58.608

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-05-23 21:23:26.459

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-05-23 21:23:26.439

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-05-23 21:23:26.079

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-05-23 21:23:26.059

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-05-23 15:34:15.408

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2011-05-23 15:34:15.398

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 31%

Total physical RAM: 8183.43 MB

Available physical RAM: 5602.88 MB

Total Pagefile: 16365.04 MB

Available Pagefile: 13613.26 MB

Total Virtual: 8192 MB

Available Virtual: 8191.8 MB
 

==================== Drives ================================
 

Drive c: (Festplatte) (Fixed) (Total:55.8 GB) (Free:5.21 GB) NTFS

Drive d: (Volume) (Fixed) (Total:1863.01 GB) (Free:378.98 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 56 GB) (Disk ID: 6E97DB8B)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=56 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 1863 GB) (Disk ID: FE59FE59)

Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)
 

==================== End Of Log ============================

JRT:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.1 (02.04.2014:1)

OS: Windows 7 Ultimate x64

Ran by Mike on 05.02.2014 at 20:07:41,27

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-297277249-2334410078-3630889142-1000\Software\sweetim

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dt soft\daemon tools toolbar

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskInstallChecker-1_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskInstallChecker-1_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskInstallChecker-1_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskInstallChecker-1_RASMANCS
 
 
 

~~~ Files
 
 
 

~~~ Folders
 

Successfully deleted: [Empty Folder] C:\Users\Mike\appdata\local\{443C19F9-AC21-4331-9113-AD980A4B3CCF}
 
 
 

~~~ FireFox
 

Successfully deleted the following from C:\Users\Mike\AppData\Roaming\mozilla\firefox\profiles\6pvlo4g1.default\prefs.js
 

user_pref("google.toolbar.button_option.cached.gtbSearchBlogs", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchBlogs\" t

user_pref("google.toolbar.button_option.cached.gtbSearchPhotos", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchPhotos\"

user_pref("google.toolbar.button_option.cached.gtbSearchScholar", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchScholar

user_pref("google.toolbar.button_option.cached.gtbSearchVideo", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchVideo\" t

user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_CTK0Y7F4MTG6NKYH03WT-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o

user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o

user_pref("google.toolbar.search-icon", "data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7PT7/3zF6/9Ptu//RbHx/

Emptied folder: C:\Users\Mike\AppData\Roaming\mozilla\firefox\profiles\6pvlo4g1.default\minidumps [123 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 05.02.2014 at 20:12:43,95

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Sorry, hatte es gerade gesehen dass man das machen muss und gleich geändert. Haben wohl zeitgleich gepostet ;)

Hab das Log gefunden: Malwarebytes

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2014.02.05.07
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16476

Mike :: MIKE-PC [Administrator]
 

05.02.2014 16:28:31

mbam-log-2014-02-05 (16-28-31).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 862108

Laufzeit: 2 Stunde(n), 38 Minute(n), 56 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 8

HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Optional.SoftwareUpdater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Optional.SoftwareUpdater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Optional.SoftwareUpdater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Updater.AmiUpd.1 (PUP.Optional.SoftwareUpdater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Updater.AmiUpd (PUP.Optional.SoftwareUpdater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 2

HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: {E2827155-60B9-11E2-8469-1C6F65391DC1} -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: {E2827155-60B9-11E2-8469-1C6F65391DC1} -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0
 
 

(Ende)

AdwareCleaner 1:

Code:

# AdwCleaner v3.018 - Bericht erstellt am 05/02/2014 um 20:00:12

# Updated 28/01/2014 von Xplode

# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)

# Benutzername : Mike - MIKE-PC

# Gestartet von : D:\Downloads\adwcleaner.exe

# Option : Suchen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Datei Gefunden : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\user.js

Ordner Gefunden C:\Users\Mike\AppData\Local\SwvUpdater

Ordner Gefunden C:\Users\Mike\AppData\Local\thinstall

Ordner Gefunden C:\Users\Mike\AppData\LocalLow\boost_interprocess

Ordner Gefunden C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Conduit

Ordner Gefunden C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\ICQToolbarData

Ordner Gefunden C:\Users\Mike\AppData\Roaming\thinstall
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\AskToolbar

Schlüssel Gefunden : HKCU\Software\Ask.com

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gefunden : HKCU\Software\PrivitizeVPNInstallDates

Schlüssel Gefunden : HKCU\Software\StartSearch

Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar

Schlüssel Gefunden : [x64] HKCU\Software\Ask.com

Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Schlüssel Gefunden : [x64] HKCU\Software\PrivitizeVPNInstallDates

Schlüssel Gefunden : [x64] HKCU\Software\StartSearch

Schlüssel Gefunden : [x64] HKCU\Software\YahooPartnerToolbar

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasapi32

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasmancs

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasapi32

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasmancs

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetpacksupdatemanager_rasapi32

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16428
 

Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://home.sweetim.com/?crg=3.1010000.10005&barid={E2827155-60B9-11E2-8469-1C6F65391DC1}
 

-\\ Mozilla Firefox v26.0 (de)
 

[ Datei : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\prefs.js ]
 

Zeile gefunden : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Zeile gefunden : user_pref("CT2269050.CTID", "CT2269050");

Zeile gefunden : user_pref("CT2269050.CurrentServerDate", "3-11-2010");

Zeile gefunden : user_pref("CT2269050.DialogsAlignMode", "LTR");

Zeile gefunden : user_pref("CT2269050.DownloadReferralCookieData", "");

Zeile gefunden : user_pref("CT2269050.EMailNotifierPollDate", "Thu Sep 23 2010 00:08:44 GMT+0200");

Zeile gefunden : user_pref("CT2269050.EnableClickToSearchBox", false);

Zeile gefunden : user_pref("CT2269050.EnableSearchHistory", false);

Zeile gefunden : user_pref("CT2269050.EnableSearchSuggest", false);

Zeile gefunden : user_pref("CT2269050.EnableUsage", false);

Zeile gefunden : user_pref("CT2269050.FirstServerDate", "23-9-2010");

Zeile gefunden : user_pref("CT2269050.FirstTime", true);

Zeile gefunden : user_pref("CT2269050.FirstTimeFF3", true);

Zeile gefunden : user_pref("CT2269050.FirstTimeSettingsDone", true);

Zeile gefunden : user_pref("CT2269050.FixPageNotFoundErrors", false);

Zeile gefunden : user_pref("CT2269050.GroupingServerCheckInterval", 1440);

Zeile gefunden : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Zeile gefunden : user_pref("CT2269050.Initialize", true);

Zeile gefunden : user_pref("CT2269050.InitializeCommonPrefs", true);

Zeile gefunden : user_pref("CT2269050.InstallationAndCookieDataSentCount", 2);

Zeile gefunden : user_pref("CT2269050.InstallationType", "UnknownIntegration");

Zeile gefunden : user_pref("CT2269050.InstalledDate", "Thu Sep 23 2010 00:08:44 GMT+0200");

Zeile gefunden : user_pref("CT2269050.InvalidateCache", false);

Zeile gefunden : user_pref("CT2269050.IsGrouping", false);

Zeile gefunden : user_pref("CT2269050.IsMulticommunity", false);

Zeile gefunden : user_pref("CT2269050.IsOpenThankYouPage", false);

Zeile gefunden : user_pref("CT2269050.IsOpenUninstallPage", false);

Zeile gefunden : user_pref("CT2269050.LanguagePackLastCheckTime", "Wed Nov 03 2010 13:53:31 GMT+0100");

Zeile gefunden : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440);

Zeile gefunden : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");

Zeile gefunden : user_pref("CT2269050.LastLogin_2.7.2.0", "Wed Nov 03 2010 13:53:27 GMT+0100");

Zeile gefunden : user_pref("CT2269050.LatestVersion", "2.7.2.0");

Zeile gefunden : user_pref("CT2269050.Locale", "en");

Zeile gefunden : user_pref("CT2269050.LoginCache", 4);

Zeile gefunden : user_pref("CT2269050.MCDetectTooltipHeight", "83");

Zeile gefunden : user_pref("CT2269050.MCDetectTooltipShow", false);

Zeile gefunden : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Zeile gefunden : user_pref("CT2269050.MCDetectTooltipWidth", "295");

Zeile gefunden : user_pref("CT2269050.RadioIsPodcast", false);

Zeile gefunden : user_pref("CT2269050.RadioLastCheckTime", "Thu Sep 23 2010 00:08:48 GMT+0200");

Zeile gefunden : user_pref("CT2269050.RadioLastUpdateIPServer", "3");

Zeile gefunden : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000");

Zeile gefunden : user_pref("CT2269050.RadioMediaID", "12473383");

Zeile gefunden : user_pref("CT2269050.RadioMediaType", "Media Player");

Zeile gefunden : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383");

Zeile gefunden : user_pref("CT2269050.RadioStationName", "Hotmix%20108");

Zeile gefunden : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082");

Zeile gefunden : user_pref("CT2269050.SHRINK_TOOLBAR", 1);

Zeile gefunden : user_pref("CT2269050.SearchBackToDefaultEngine", false);

Zeile gefunden : user_pref("CT2269050.SearchBoxWidth", 150);

Zeile gefunden : user_pref("CT2269050.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2269050&octid=EB_ORIGINAL_CTID&SearchSource=1");

Zeile gefunden : user_pref("CT2269050.SearchFromAddressBarIsInit", true);

Zeile gefunden : user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=");

Zeile gefunden : user_pref("CT2269050.SearchInNewTabEnabled", true);

Zeile gefunden : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440);

Zeile gefunden : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Wed Nov 03 2010 13:53:25 GMT+0100");

Zeile gefunden : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");

Zeile gefunden : user_pref("CT2269050.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageService.asmx/UsersRequests?ctid=EB_TOOLBAR_ID");

Zeile gefunden : user_pref("CT2269050.SearchInNewTabUserEnabled", false);

Zeile gefunden : user_pref("CT2269050.SettingsCheckIntervalMin", 120);

Zeile gefunden : user_pref("CT2269050.SettingsLastCheckTime", "Wed Nov 03 2010 13:53:25 GMT+0100");

Zeile gefunden : user_pref("CT2269050.SettingsLastUpdate", "1284635599");

Zeile gefunden : user_pref("CT2269050.ThirdPartyComponentsInterval", 504);

Zeile gefunden : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Wed Nov 03 2010 13:53:25 GMT+0100");

Zeile gefunden : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1246790578");

Zeile gefunden : user_pref("CT2269050.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=101&sealid=112");

Zeile gefunden : user_pref("CT2269050.Uninstall", true);

Zeile gefunden : user_pref("CT2269050.UserID", "UN85256082470327357");

Zeile gefunden : user_pref("CT2269050.ValidationData_Toolbar", 2);

Zeile gefunden : user_pref("CT2269050.WeatherNetwork", "");

Zeile gefunden : user_pref("CT2269050.WeatherPollDate", "Thu Sep 23 2010 00:08:48 GMT+0200");

Zeile gefunden : user_pref("CT2269050.WeatherUnit", "C");

Zeile gefunden : user_pref("CT2269050.alertChannelId", "666138");

Zeile gefunden : user_pref("CT2269050.clientLogIsEnabled", true);

Zeile gefunden : user_pref("CT2269050.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");

Zeile gefunden : user_pref("CT2269050.components.1000034", false);

Zeile gefunden : user_pref("CT2269050.components.1000082", false);

Zeile gefunden : user_pref("CT2269050.components.1000234", false);

Zeile gefunden : user_pref("CT2269050.components.1195972076538955800", false);

Zeile gefunden : user_pref("CT2269050.components.129023235807856892", false);

Zeile gefunden : user_pref("CT2269050.components.129114742153905471", false);

Zeile gefunden : user_pref("CT2269050.components.129121052374999726", false);

Zeile gefunden : user_pref("CT2269050.components.4064511679983222482", false);

Zeile gefunden : user_pref("CT2269050.components.8767590000360389618", false);

Zeile gefunden : user_pref("CT2269050.myStuffEnabled", true);

Zeile gefunden : user_pref("CT2269050.myStuffPublihserMinWidth", 400);

Zeile gefunden : user_pref("CT2269050.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");

Zeile gefunden : user_pref("CT2269050.myStuffServiceIntervalMM", 1440);

Zeile gefunden : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");

Zeile gefunden : user_pref("CT2269050.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");

Zeile gefunden : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=");

Zeile gefunden : user_pref("CommunityToolbar.ToolbarsList", "CT2269050");

Zeile gefunden : user_pref("CommunityToolbar.ToolbarsList2", "CT2269050");

Zeile gefunden : user_pref("CommunityToolbar.alert.alertInfoInterval", 720);

Zeile gefunden : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Thu Sep 23 2010 01:08:45 GMT+0200");

Zeile gefunden : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Zeile gefunden : user_pref("CommunityToolbar.alert.locale", "en");

Zeile gefunden : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Zeile gefunden : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Thu Sep 23 2010 00:08:41 GMT+0200");

Zeile gefunden : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1283688156");

Zeile gefunden : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Zeile gefunden : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Zeile gefunden : user_pref("CommunityToolbar.alert.showTrayIcon", false);

Zeile gefunden : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Zeile gefunden : user_pref("CommunityToolbar.alert.userId", "{48bf7334-8187-416e-8555-d410fbcde573}");

Zeile gefunden : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Thu Sep 23 2010 00:08:48 GMT+0200");

Zeile gefunden : user_pref("browser.search.defaultenginename", "SweetIM Search");

Zeile gefunden : user_pref("extensions.illimitux.ilx_pref_pt_veoh", true);

Zeile gefunden : user_pref("foxgame.userprefs.foxgameDeltaTime-uni16.ogame.de", "200");

Zeile gefunden : user_pref("icqtoolbar.allowSendURL", false);

Zeile gefunden : user_pref("icqtoolbar.engineVerified", false);

Zeile gefunden : user_pref("icqtoolbar.hiddenElements", "itb_options");

Zeile gefunden : user_pref("icqtoolbar.history", "firefox%203||ogame");

Zeile gefunden : user_pref("icqtoolbar.installTime", "1276942047");

Zeile gefunden : user_pref("icqtoolbar.newtab_state", "1");

Zeile gefunden : user_pref("icqtoolbar.numberOfSearches", 0);

Zeile gefunden : user_pref("icqtoolbar.previousFFVersion", "2.0.0.14");

Zeile gefunden : user_pref("icqtoolbar.skip_default_search", "no");

Zeile gefunden : user_pref("icqtoolbar.suggestions", false);

Zeile gefunden : user_pref("icqtoolbar.uninstStatSent", true);

Zeile gefunden : user_pref("icqtoolbar.uniqueID", "121387924912138792491217974823958");

Zeile gefunden : user_pref("icqtoolbar.usageStatstTimestamp", 1276942054);

Zeile gefunden : user_pref("icqtoolbar.xmlEnableSuggestions", false);

Zeile gefunden : user_pref("icqtoolbar.xmlLanguage", "de");

Zeile gefunden : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&barid={E2827155-60B9-11E2-8469-1C6F65391DC1}&q=");
 

*************************
 

AdwCleaner[R0].txt - [14545 octets] - [05/02/2014 20:00:12]
 

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [14606 octets] ##########

Nummer 2 (weiß nicht wieso)

Code:

# AdwCleaner v3.018 - Bericht erstellt am 05/02/2014 um 20:02:32

# Updated 28/01/2014 von Xplode

# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)

# Benutzername : Mike - MIKE-PC

# Gestartet von : D:\Downloads\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\Users\Mike\AppData\Local\SwvUpdater

Ordner Gelöscht : C:\Users\Mike\AppData\Local\thinstall

Ordner Gelöscht : C:\Users\Mike\AppData\LocalLow\boost_interprocess

Ordner Gelöscht : C:\Users\Mike\AppData\Roaming\thinstall

Ordner Gelöscht : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Conduit

Ordner Gelöscht : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\ICQToolbarData

Datei Gelöscht : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\user.js
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetpacksupdatemanager_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}

Schlüssel Gelöscht : HKCU\Software\Ask.com

Schlüssel Gelöscht : HKCU\Software\PrivitizeVPNInstallDates

Schlüssel Gelöscht : HKCU\Software\StartSearch

Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16428
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
 

-\\ Mozilla Firefox v26.0 (de)
 

[ Datei : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\prefs.js ]
 

Zeile gelöscht : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Zeile gelöscht : user_pref("CT2269050.CTID", "CT2269050");

Zeile gelöscht : user_pref("CT2269050.CurrentServerDate", "3-11-2010");

Zeile gelöscht : user_pref("CT2269050.DialogsAlignMode", "LTR");

Zeile gelöscht : user_pref("CT2269050.DownloadReferralCookieData", "");

Zeile gelöscht : user_pref("CT2269050.EMailNotifierPollDate", "Thu Sep 23 2010 00:08:44 GMT+0200");

Zeile gelöscht : user_pref("CT2269050.EnableClickToSearchBox", false);

Zeile gelöscht : user_pref("CT2269050.EnableSearchHistory", false);

Zeile gelöscht : user_pref("CT2269050.EnableSearchSuggest", false);

Zeile gelöscht : user_pref("CT2269050.EnableUsage", false);

Zeile gelöscht : user_pref("CT2269050.FirstServerDate", "23-9-2010");

Zeile gelöscht : user_pref("CT2269050.FirstTime", true);

Zeile gelöscht : user_pref("CT2269050.FirstTimeFF3", true);

Zeile gelöscht : user_pref("CT2269050.FirstTimeSettingsDone", true);

Zeile gelöscht : user_pref("CT2269050.FixPageNotFoundErrors", false);

Zeile gelöscht : user_pref("CT2269050.GroupingServerCheckInterval", 1440);

Zeile gelöscht : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Zeile gelöscht : user_pref("CT2269050.Initialize", true);

Zeile gelöscht : user_pref("CT2269050.InitializeCommonPrefs", true);

Zeile gelöscht : user_pref("CT2269050.InstallationAndCookieDataSentCount", 2);

Zeile gelöscht : user_pref("CT2269050.InstallationType", "UnknownIntegration");

Zeile gelöscht : user_pref("CT2269050.InstalledDate", "Thu Sep 23 2010 00:08:44 GMT+0200");

Zeile gelöscht : user_pref("CT2269050.InvalidateCache", false);

Zeile gelöscht : user_pref("CT2269050.IsGrouping", false);

Zeile gelöscht : user_pref("CT2269050.IsMulticommunity", false);

Zeile gelöscht : user_pref("CT2269050.IsOpenThankYouPage", false);

Zeile gelöscht : user_pref("CT2269050.IsOpenUninstallPage", false);

Zeile gelöscht : user_pref("CT2269050.LanguagePackLastCheckTime", "Wed Nov 03 2010 13:53:31 GMT+0100");

Zeile gelöscht : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440);

Zeile gelöscht : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");

Zeile gelöscht : user_pref("CT2269050.LastLogin_2.7.2.0", "Wed Nov 03 2010 13:53:27 GMT+0100");

Zeile gelöscht : user_pref("CT2269050.LatestVersion", "2.7.2.0");

Zeile gelöscht : user_pref("CT2269050.Locale", "en");

Zeile gelöscht : user_pref("CT2269050.LoginCache", 4);

Zeile gelöscht : user_pref("CT2269050.MCDetectTooltipHeight", "83");

Zeile gelöscht : user_pref("CT2269050.MCDetectTooltipShow", false);

Zeile gelöscht : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Zeile gelöscht : user_pref("CT2269050.MCDetectTooltipWidth", "295");

Zeile gelöscht : user_pref("CT2269050.RadioIsPodcast", false);

Zeile gelöscht : user_pref("CT2269050.RadioLastCheckTime", "Thu Sep 23 2010 00:08:48 GMT+0200");

Zeile gelöscht : user_pref("CT2269050.RadioLastUpdateIPServer", "3");

Zeile gelöscht : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000");

Zeile gelöscht : user_pref("CT2269050.RadioMediaID", "12473383");

Zeile gelöscht : user_pref("CT2269050.RadioMediaType", "Media Player");

Zeile gelöscht : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383");

Zeile gelöscht : user_pref("CT2269050.RadioStationName", "Hotmix%20108");

Zeile gelöscht : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082");

Zeile gelöscht : user_pref("CT2269050.SHRINK_TOOLBAR", 1);

Zeile gelöscht : user_pref("CT2269050.SearchBackToDefaultEngine", false);

Zeile gelöscht : user_pref("CT2269050.SearchBoxWidth", 150);

Zeile gelöscht : user_pref("CT2269050.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2269050&octid=EB_ORIGINAL_CTID&SearchSource=1");

Zeile gelöscht : user_pref("CT2269050.SearchFromAddressBarIsInit", true);

Zeile gelöscht : user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=");

Zeile gelöscht : user_pref("CT2269050.SearchInNewTabEnabled", true);

Zeile gelöscht : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440);

Zeile gelöscht : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Wed Nov 03 2010 13:53:25 GMT+0100");

Zeile gelöscht : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");

Zeile gelöscht : user_pref("CT2269050.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageService.asmx/UsersRequests?ctid=EB_TOOLBAR_ID");

Zeile gelöscht : user_pref("CT2269050.SearchInNewTabUserEnabled", false);

Zeile gelöscht : user_pref("CT2269050.SettingsCheckIntervalMin", 120);

Zeile gelöscht : user_pref("CT2269050.SettingsLastCheckTime", "Wed Nov 03 2010 13:53:25 GMT+0100");

Zeile gelöscht : user_pref("CT2269050.SettingsLastUpdate", "1284635599");

Zeile gelöscht : user_pref("CT2269050.ThirdPartyComponentsInterval", 504);

Zeile gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Wed Nov 03 2010 13:53:25 GMT+0100");

Zeile gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1246790578");

Zeile gelöscht : user_pref("CT2269050.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=101&sealid=112");

Zeile gelöscht : user_pref("CT2269050.Uninstall", true);

Zeile gelöscht : user_pref("CT2269050.UserID", "UN85256082470327357");

Zeile gelöscht : user_pref("CT2269050.ValidationData_Toolbar", 2);

Zeile gelöscht : user_pref("CT2269050.WeatherNetwork", "");

Zeile gelöscht : user_pref("CT2269050.WeatherPollDate", "Thu Sep 23 2010 00:08:48 GMT+0200");

Zeile gelöscht : user_pref("CT2269050.WeatherUnit", "C");

Zeile gelöscht : user_pref("CT2269050.alertChannelId", "666138");

Zeile gelöscht : user_pref("CT2269050.clientLogIsEnabled", true);

Zeile gelöscht : user_pref("CT2269050.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");

Zeile gelöscht : user_pref("CT2269050.components.1000034", false);

Zeile gelöscht : user_pref("CT2269050.components.1000082", false);

Zeile gelöscht : user_pref("CT2269050.components.1000234", false);

Zeile gelöscht : user_pref("CT2269050.components.1195972076538955800", false);

Zeile gelöscht : user_pref("CT2269050.components.129023235807856892", false);

Zeile gelöscht : user_pref("CT2269050.components.129114742153905471", false);

Zeile gelöscht : user_pref("CT2269050.components.129121052374999726", false);

Zeile gelöscht : user_pref("CT2269050.components.4064511679983222482", false);

Zeile gelöscht : user_pref("CT2269050.components.8767590000360389618", false);

Zeile gelöscht : user_pref("CT2269050.myStuffEnabled", true);

Zeile gelöscht : user_pref("CT2269050.myStuffPublihserMinWidth", 400);

Zeile gelöscht : user_pref("CT2269050.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");

Zeile gelöscht : user_pref("CT2269050.myStuffServiceIntervalMM", 1440);

Zeile gelöscht : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");

Zeile gelöscht : user_pref("CT2269050.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");

Zeile gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=");

Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2269050");

Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2269050");

Zeile gelöscht : user_pref("CommunityToolbar.alert.alertInfoInterval", 720);

Zeile gelöscht : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Thu Sep 23 2010 01:08:45 GMT+0200");

Zeile gelöscht : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Zeile gelöscht : user_pref("CommunityToolbar.alert.locale", "en");

Zeile gelöscht : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Zeile gelöscht : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Thu Sep 23 2010 00:08:41 GMT+0200");

Zeile gelöscht : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1283688156");

Zeile gelöscht : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Zeile gelöscht : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Zeile gelöscht : user_pref("CommunityToolbar.alert.showTrayIcon", false);

Zeile gelöscht : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Zeile gelöscht : user_pref("CommunityToolbar.alert.userId", "{48bf7334-8187-416e-8555-d410fbcde573}");

Zeile gelöscht : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Thu Sep 23 2010 00:08:48 GMT+0200");

Zeile gelöscht : user_pref("browser.search.defaultenginename", "SweetIM Search");

Zeile gelöscht : user_pref("extensions.illimitux.ilx_pref_pt_veoh", true);

Zeile gelöscht : user_pref("foxgame.userprefs.foxgameDeltaTime-uni16.ogame.de", "200");

Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);

Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false);

Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");

Zeile gelöscht : user_pref("icqtoolbar.history", "firefox%203||ogame");

Zeile gelöscht : user_pref("icqtoolbar.installTime", "1276942047");

Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "1");

Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);

Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "2.0.0.14");

Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");

Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);

Zeile gelöscht : user_pref("icqtoolbar.uninstStatSent", true);

Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "121387924912138792491217974823958");

Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1276942054);

Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);

Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");

Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&barid={E2827155-60B9-11E2-8469-1C6F65391DC1}&q=");
 

*************************
 

AdwCleaner[R0].txt - [14715 octets] - [05/02/2014 20:00:12]

AdwCleaner[S0].txt - [14201 octets] - [05/02/2014 20:02:32]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14262 octets] ##########

JRT siehe erster Post :)

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hi,
ich habe gesehen dass das Schadprogramm einen Namen hat, und hier gefunden C:\ProgramData\8EGKXbpz.exe und nach dem Löschen des Progamms,tritt das Popup nicht mehr auf, schein als wäre es beseitigt!
Habe einen FRST Scan angehängt, ist das System sauber?
Danke!

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2014

Ran by Mike (administrator) on MIKE-PC on 06-02-2014 17:05:46

Running from D:\Downloads

Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AVAST Software) D:\Programme\Avast Antivirus\AvastSvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hi-Rez Studios) D:\Programme\Tribes Ascend\HiPatchService.exe

() C:\Windows\SysWOW64\XSrvSetup.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Software 2000 Limited) C:\Windows\System32\spool\drivers\x64\3\HP1006MC.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(DT Soft Ltd) D:\Programme\DAEMON Tools Pro\DTShellHlp.exe

(Spotify Ltd) C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Flux Software LLC) C:\Users\Mike\AppData\Local\FluxSoftware\Flux\flux.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Razer USA Ltd) C:\Program Files (x86)\Razer\Imperator\RazerImperatorTray.exe

(Razer USA Ltd.) D:\Programme\Razer\Tarantula\razerhid.exe

(Apple Inc.) D:\Programme\iTunes\iTunesHelper.exe

(Advanced Micro Devices Inc.) D:\Programme\ATI\ATI.ACE\Core-Static\MOM.exe

() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(AVAST Software) D:\Programme\Avast Antivirus\AvastUI.exe

(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

(ATI Technologies Inc.) D:\Programme\ATI\ATI.ACE\Core-Static\CCC.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

() D:\Programme\Razer\Tarantula\razertra.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(Mozilla Corporation) D:\Programme\Mozilla Firefox\firefox.exe

(Mozilla Corporation) D:\Programme\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe

(Farbar) D:\Downloads\FRST64(1).exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2000-01-01] (Realtek Semiconductor)

HKLM-x32\...\Run: [ATICustomerCare] - C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-05-04] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [43608 2000-01-01] ()

HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Razer Imperator Driver] - C:\Program Files (x86)\Razer\Imperator\RazerImperatorTray.exe [2787224 2010-09-07] (Razer USA Ltd)

HKLM-x32\...\Run: [Tarantula] - D:\Programme\Razer\Tarantula\razerhid.exe [159744 2007-05-07] (Razer USA Ltd.)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-11-01] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\iTunes\iTunesHelper.exe [421736 2012-01-16] (Apple Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [StartCCC] - D:\Programme\ATI\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [AvastUI.exe] - D:\Programme\Avast Antivirus\AvastUI.exe [3764024 2014-01-08] (AVAST Software)

HKLM-x32\...\Run: [] - [X]

HKLM-x32\...\Run: [Razer Synapse] - C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [442712 2013-11-17] (Razer Inc.)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [ISUSPM Startup] - "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-12-08] (AMD)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [Pando Media Booster] - "null\Pando Networks\Media Booster\PMB.exe"

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [Spotify Web Helper] - C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-22] (Spotify Ltd)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [f.lux] - C:\Users\Mike\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [8EGKXbpz] - C:\ProgramData\8EGKXbpz.exe

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\MountPoints2: {9dcfcac0-408e-11e1-a9f2-806e6f6e6963} - F:\setup.exe

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\MountPoints2: {9dcfcac1-408e-11e1-a9f2-806e6f6e6963} - G:\setup.exe

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\MountPoints2: {c604cc0f-e5c1-11df-9344-1c6f65391dc1} - G:\autorun.exe

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\MountPoints2: {d1d1ed68-fe0a-11df-b871-1c6f65391dc1} - J:\LaunchU3.exe -a
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1EF3F36AB9BECD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at

BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\Avast Antivirus\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)

Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - D:\Programme\Avast Antivirus\aswWebRepIE.dll (AVAST Software)

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
 

FireFox:

========

FF ProfilePath: C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default

FF Homepage: hxxp://orf.at/

FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"

FF NetworkProxy: "type", 2

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - null\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @raidcall.en/RCplugin - C:\Users\Mike\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)

FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - D:\Programme\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - D:\Programme\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - D:\Programme\Adobe Reader X\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @doubletwist.com/NPPodcast - C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll No File

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - D:\Downloads\null\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: GFACE Experience Plugin - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\cryenginebrowserplugin@crytek.com [2013-11-07]

FF Extension: TinEye Reverse Image Search - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\tineye@ideeinc.com [2011-02-18]

FF Extension: Microsoft .NET Framework Assistant - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-10-31]

FF Extension: Google Toolbar for Firefox - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-06-01]

FF Extension: EPUBReader - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2013-12-02]

FF Extension: InFormEnter - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{5546F97E-11A5-46b0-9082-32AD74AAA920} [2013-10-21]

FF Extension: Nightly Tester Tools - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{8620c15f-30dc-4dba-a131-7c5d20cf4a29} [2013-10-31]

FF Extension: Block site - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2013-08-11]

FF Extension: Honey - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\jid1-93CWPmRbVPjRQA@jetpack.xpi [2013-10-09]

FF Extension: Media Hint - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\mediahint@jetpack.xpi [2013-08-01]

FF Extension: FlashGot - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2011-04-10]

FF Extension: Adblock Plus - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-03-27]

FF Extension: DownThemAll! - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2011-05-19]

FF Extension: Greasemonkey - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012-08-25]

FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}

FF Extension: Adobe Contribute Toolbar - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-12-07]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - D:\Programme\Avast Antivirus\WebRep\FF

FF Extension: avast! Online Security - D:\Programme\Avast Antivirus\WebRep\FF [2013-01-21]

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-18]

FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla Firefox\firefox.exe
 

==================== Services (Whitelisted) =================
 

R2 avast! Antivirus; D:\Programme\Avast Antivirus\AvastSvc.exe [50344 2014-01-08] (AVAST Software)

S3 DAUpdaterSvc; D:\Programme\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2013-12-11] (BioWare)

R2 HiPatchService; D:\Programme\Tribes Ascend\HiPatchService.exe [9216 2013-11-26] (Hi-Rez Studios)

R2 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72304 2000-01-01] ()

S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Microsoft Office\Office14\GROOVE.EXE [50899608 2012-09-20] (Microsoft Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4089336 2011-03-08] (INCA Internet Co., Ltd.)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-08-16] ()

S3 SandraAgentSrv; C:\Programme\SiSoftware\SiSoftware Sandra Lite 2010.SP3\RpcAgentSrv.exe [93848 2009-08-10] (SiSoftware)

S4 TlntSvr; C:\Windows\System32\tlntsvr.exe [81920 2009-07-14] (Microsoft Corporation)

S3 TunngleService; D:\Programme\Tunngle\TnglCtrl.exe [743320 2012-09-25] (Tunngle.net GmbH)
 

==================== Drivers (Whitelisted) ====================
 

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-01-08] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-03] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-03] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2014-01-08] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2014-01-08] (AVAST Software)

R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2014-01-08] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-08] ()

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-01-31] ()

S3 CYUSB; C:\Windows\System32\Drivers\CYUSB.sys [47104 2009-08-10] (Cypress Semiconductor)

S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [556120 2013-01-21] (Kaspersky Lab)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-01-31] ()

S3 Lycosa; C:\Windows\System32\drivers\Lycosa.sys [18816 2008-01-17] (Razer USA Ltd.)

S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2005-01-03] (INCA Internet Co., Ltd.)

S3 RzSynapse; C:\Windows\System32\DRIVERS\RzSynapse.sys [126464 2011-03-31] (Razer USA Ltd)

S3 s1018bus; C:\Windows\System32\DRIVERS\s1018bus.sys [113704 2009-03-25] (MCCI Corporation)

S3 s1018mdfl; C:\Windows\System32\DRIVERS\s1018mdfl.sys [19496 2009-03-25] (MCCI Corporation)

S3 s1018mdm; C:\Windows\System32\DRIVERS\s1018mdm.sys [153128 2009-03-25] (MCCI Corporation)

S3 s1018mgmt; C:\Windows\System32\DRIVERS\s1018mgmt.sys [133160 2009-03-25] (MCCI Corporation)

S3 s1018nd5; C:\Windows\System32\DRIVERS\s1018nd5.sys [34856 2009-03-25] (MCCI Corporation)

S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [128552 2009-03-25] (MCCI Corporation)

S3 s1018unic; C:\Windows\System32\DRIVERS\s1018unic.sys [146472 2009-03-25] (MCCI Corporation)

S3 SANDRA; C:\Programme\SiSoftware\SiSoftware Sandra Lite 2010.SP3\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [526392 2012-01-16] ()

S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-12-29] ()

R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

R3 TarFltr; C:\Windows\System32\drivers\UsbFltr.sys [49664 2007-04-11] (Razer USA Ltd.)

S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [19200 2005-10-21] (Motorola)

S3 uisp; C:\Windows\SysWOW64\Drivers\usbicp.sys [14592 2005-12-21] (Motorola)

U3 azq8nwe1; C:\Windows\System32\Drivers\azq8nwe1.sys [0 ] (Advanced Micro Devices)

S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]

S4 DAdderFltr; system32\drivers\dadder.sys [X]

S3 dump_wmimmc; \??\D:\Programme\Garena Messenger\Apps\BlackShot\BlackShot\System\GameGuard\dump_wmimmc.sys [X]

S3 GGSAFERDriver; \??\D:\Programme\Garena\safedrv.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 TEAM; system32\DRIVERS\RtTeam60.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

U5 UnlockerDriver5; D:\Programme\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()

S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

S3 VLAN; system32\DRIVERS\RtVLAN60.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-05 20:24 - 2014-02-06 17:05 - 00000000 ____D () C:\FRST

2014-02-05 20:14 - 2014-02-05 20:14 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-05 20:07 - 2014-02-05 20:07 - 00000000 ____D () C:\Windows\ERUNT

2014-02-05 20:00 - 2014-02-06 12:26 - 00000000 ____D () C:\AdwCleaner

2014-02-05 17:27 - 2014-02-05 20:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Malwarebytes

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-01-21 09:26 - 2014-01-21 09:26 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-01-15 19:53 - 2014-01-15 19:53 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\TheBannerSaga

2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-01-14 02:53 - 2014-01-14 02:53 - 00296448 _____ (Razer Inc) C:\Windows\SysWOW64\rzaudiodll.dll

2014-01-14 02:53 - 2014-01-14 02:53 - 00088576 _____ (Razer Inc) C:\Windows\SysWOW64\rzdevinfo.dll

2014-01-10 16:15 - 2014-01-10 16:15 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online

2014-01-08 11:53 - 2014-01-08 11:53 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
 

==================== One Month Modified Files and Folders =======
 

2014-02-06 17:05 - 2014-02-05 20:24 - 00000000 ____D () C:\FRST

2014-02-06 16:51 - 2009-07-14 18:58 - 24051934 _____ () C:\Windows\system32\perfh007.dat

2014-02-06 16:51 - 2009-07-14 18:58 - 07532130 _____ () C:\Windows\system32\perfc007.dat

2014-02-06 16:51 - 2009-07-14 06:13 - 00006506 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-06 16:51 - 2009-07-14 05:45 - 00014416 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-06 16:51 - 2009-07-14 05:45 - 00014416 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-06 16:48 - 2013-01-21 19:08 - 00004164 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-02-06 16:46 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-06 16:46 - 2009-07-14 05:51 - 00168323 _____ () C:\Windows\setupact.log

2014-02-06 13:43 - 2010-10-27 17:04 - 01930322 _____ () C:\Windows\WindowsUpdate.log

2014-02-06 13:11 - 2012-09-21 23:43 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-06 12:44 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-02-06 12:26 - 2014-02-05 20:00 - 00000000 ____D () C:\AdwCleaner

2014-02-06 12:26 - 2012-10-14 02:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-02-06 12:26 - 2010-11-01 18:46 - 00286146 _____ () C:\Windows\PFRO.log

2014-02-05 20:14 - 2014-02-05 20:14 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-05 20:07 - 2014-02-05 20:07 - 00000000 ____D () C:\Windows\ERUNT

2014-02-05 20:05 - 2014-02-05 17:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-02-05 17:11 - 2012-09-21 23:43 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-05 17:11 - 2012-04-08 10:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-05 17:11 - 2011-05-19 15:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Malwarebytes

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-04 03:11 - 2013-03-05 02:34 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\vlc

2014-01-31 01:27 - 2010-11-14 15:43 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Skype

2014-01-28 23:57 - 2010-10-28 17:51 - 00770958 _____ () C:\Windows\DPINST.LOG

2014-01-27 16:49 - 2010-10-28 13:44 - 00571322 _____ () C:\Windows\DirectX.log

2014-01-24 14:44 - 2011-03-14 17:03 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\uTorrent

2014-01-22 00:03 - 2013-04-02 23:43 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Spotify

2014-01-21 20:44 - 2013-04-02 23:44 - 00000000 ____D () C:\Users\Mike\AppData\Local\Spotify

2014-01-21 09:27 - 2013-10-17 21:52 - 00000000 ____D () C:\ProgramData\Oracle

2014-01-21 09:26 - 2014-01-21 09:26 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-01-21 09:26 - 2010-10-28 18:32 - 00000000 ____D () C:\Program Files (x86)\Java

2014-01-21 09:05 - 2010-11-03 13:53 - 00000000 ____D () C:\Users\Mike\AppData\Local\Adobe

2014-01-18 14:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-01-18 03:08 - 2013-10-25 20:49 - 00000000 ____D () C:\Users\Mike\AppData\Local\Battle.net

2014-01-16 11:10 - 2009-07-14 05:45 - 04992608 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-01-16 01:31 - 2013-08-15 10:50 - 00000000 ____D () C:\Windows\system32\MRT

2014-01-16 01:29 - 2010-02-09 23:33 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-01-15 19:53 - 2014-01-15 19:53 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\TheBannerSaga

2014-01-14 02:53 - 2014-01-14 02:53 - 00296448 _____ (Razer Inc) C:\Windows\SysWOW64\rzaudiodll.dll

2014-01-14 02:53 - 2014-01-14 02:53 - 00088576 _____ (Razer Inc) C:\Windows\SysWOW64\rzdevinfo.dll

2014-01-10 17:47 - 2013-11-16 23:26 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Awesomium

2014-01-10 16:15 - 2014-01-10 16:15 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online

2014-01-08 11:53 - 2014-01-08 11:53 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-01-08 11:53 - 2013-03-19 13:22 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-01-08 11:53 - 2013-01-21 19:08 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-01-08 11:53 - 2013-01-21 19:08 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-01-08 11:53 - 2013-01-21 19:08 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-01-08 11:53 - 2013-01-21 19:08 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-01-08 11:53 - 2013-01-21 19:08 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
 

Some content of TEMP:

====================

C:\Users\Mike\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe

C:\Users\Mike\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-31 18:57
 

==================== End Of Log ============================

--- --- ---

Ich poste Combofix nicht aus Spass, da is noch mehr :)

Combofix:

Code:

ComboFix 14-02-05.02 - Mike 07.02.2014  17:59:39.1.4 - x64

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.43.1031.18.8183.6007 [GMT 1:00]

ausgeführt von:: d:\downloads\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\xml1AD0.tmp

c:\programdata\xml20BB.tmp

c:\programdata\xml23B8.tmp

c:\windows\IsUn0407.exe

c:\windows\SysWow64\tmpC6A9.tmp

c:\windows\SysWow64\tmpC6AA.tmp

c:\windows\usgwmt

c:\windows\usgwmt\BReWErS.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-01-07 bis 2014-02-07  ))))))))))))))))))))))))))))))

.

.

2014-02-07 17:17 . 2014-02-07 17:17        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-02-07 17:05 . 2014-02-07 17:05        75888        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{976342B1-4F89-4AFF-8BF2-97A0C62AE139}\offreg.dll

2014-02-05 19:24 . 2014-02-06 16:06        --------        d-----w-        C:\FRST

2014-02-05 19:14 . 2014-02-05 19:14        --------        d-----w-        c:\program files (x86)\ESET

2014-02-05 19:07 . 2014-02-05 19:07        --------        d-----w-        c:\windows\ERUNT

2014-02-05 19:00 . 2014-02-06 11:26        --------        d-----w-        C:\AdwCleaner

2014-02-05 16:27 . 2014-02-05 19:05        --------        d-----w-        c:\program files (x86)\Mozilla Thunderbird

2014-02-05 15:27 . 2014-02-05 15:27        --------        d-----w-        c:\users\Mike\AppData\Roaming\Malwarebytes

2014-02-05 15:27 . 2014-02-05 15:27        --------        d-----w-        c:\programdata\Malwarebytes

2014-02-04 12:02 . 2013-12-04 03:28        10315576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{976342B1-4F89-4AFF-8BF2-97A0C62AE139}\mpengine.dll

2014-01-15 18:53 . 2014-01-15 18:53        --------        d-----w-        c:\users\Mike\AppData\Roaming\TheBannerSaga

2014-01-15 17:41 . 2013-11-27 01:41        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys

2014-01-15 17:41 . 2013-11-27 01:41        99840        ----a-w-        c:\windows\system32\drivers\usbccgp.sys

2014-01-15 17:41 . 2013-11-27 01:41        53248        ----a-w-        c:\windows\system32\drivers\usbehci.sys

2014-01-15 17:41 . 2013-11-27 01:41        325120        ----a-w-        c:\windows\system32\drivers\usbport.sys

2014-01-15 17:41 . 2013-11-27 01:41        25600        ----a-w-        c:\windows\system32\drivers\usbohci.sys

2014-01-15 17:41 . 2013-11-27 01:41        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys

2014-01-15 17:41 . 2013-11-27 01:41        7808        ----a-w-        c:\windows\system32\drivers\usbd.sys

2014-01-15 17:41 . 2013-11-26 10:32        3156480        ----a-w-        c:\windows\system32\win32k.sys

2014-01-15 17:41 . 2013-11-26 11:40        376768        ----a-w-        c:\windows\system32\drivers\netio.sys

2014-01-14 01:53 . 2014-01-14 01:53        88576        ----a-w-        c:\windows\SysWow64\rzdevinfo.dll

2014-01-14 01:53 . 2014-01-14 01:53        296448        ----a-w-        c:\windows\SysWow64\rzaudiodll.dll

2014-01-10 15:15 . 2014-01-10 15:15        --------        d-----w-        c:\programdata\Elder Scrolls Online

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-02-05 16:11 . 2012-04-08 09:57        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-02-05 16:11 . 2011-05-19 14:12        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-01-16 00:29 . 2010-02-09 22:33        86054176        ----a-w-        c:\windows\system32\MRT.exe

2014-01-08 10:53 . 2014-01-08 10:53        79672        ----a-w-        c:\windows\system32\drivers\aswstm.sys

2014-01-08 10:53 . 2013-03-19 12:22        207904        ----a-w-        c:\windows\system32\drivers\aswVmm.sys

2014-01-08 10:53 . 2013-01-21 18:08        78648        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2014-01-08 10:53 . 2013-01-21 18:08        422216        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2014-01-08 10:53 . 2013-01-21 18:08        334136        ----a-w-        c:\windows\system32\aswBoot.exe

2014-01-08 10:53 . 2013-01-21 18:08        1034464        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2014-01-08 10:53 . 2013-01-21 18:08        43152        ----a-w-        c:\windows\avastSS.scr

2013-12-29 12:21 . 2011-10-09 01:00        16152        ----a-w-        c:\windows\system32\drivers\SWDUMon.sys

2013-12-18 20:09 . 2013-10-17 20:52        96168        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-12-18 05:13 . 2010-02-09 22:35        270496        ------w-        c:\windows\system32\MpSigStub.exe

2013-12-03 19:01 . 2013-03-19 12:22        65776        ----a-w-        c:\windows\system32\drivers\aswRvrt.sys

2013-12-03 19:01 . 2013-01-21 18:08        92544        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys

2013-11-26 11:54 . 2013-12-12 17:10        23183360        ----a-w-        c:\windows\system32\mshtml.dll

2013-11-26 10:19 . 2013-12-12 17:10        2724864        ----a-w-        c:\windows\system32\mshtml.tlb

2013-11-26 10:18 . 2013-12-12 17:10        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll

2013-11-26 09:48 . 2013-12-12 17:10        66048        ----a-w-        c:\windows\system32\iesetup.dll

2013-11-26 09:46 . 2013-12-12 17:10        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll

2013-11-26 09:41 . 2013-12-12 17:10        2764288        ----a-w-        c:\windows\system32\iertutil.dll

2013-11-26 09:29 . 2013-12-12 17:10        53760        ----a-w-        c:\windows\system32\jsproxy.dll

2013-11-26 09:27 . 2013-12-12 17:10        33792        ----a-w-        c:\windows\system32\iernonce.dll

2013-11-26 09:23 . 2013-12-12 17:10        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2013-11-26 09:21 . 2013-12-12 17:10        574976        ----a-w-        c:\windows\system32\ieui.dll

2013-11-26 09:18 . 2013-12-12 17:10        139264        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-11-26 09:18 . 2013-12-12 17:10        111616        ----a-w-        c:\windows\system32\ieetwcollector.exe

2013-11-26 09:16 . 2013-12-12 17:10        708608        ----a-w-        c:\windows\system32\jscript9diag.dll

2013-11-26 08:57 . 2013-12-12 17:10        218624        ----a-w-        c:\windows\system32\ie4uinit.exe

2013-11-26 08:35 . 2013-12-12 17:10        5769216        ----a-w-        c:\windows\system32\jscript9.dll

2013-11-26 08:28 . 2013-12-12 17:10        553472        ----a-w-        c:\windows\SysWow64\jscript9diag.dll

2013-11-26 08:16 . 2013-12-12 17:10        4243968        ----a-w-        c:\windows\SysWow64\jscript9.dll

2013-11-26 08:02 . 2013-12-12 17:10        1995264        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-11-26 07:48 . 2013-12-12 17:10        12996608        ----a-w-        c:\windows\system32\ieframe.dll

2013-11-26 07:32 . 2013-12-12 17:10        1928192        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-11-26 07:07 . 2013-12-12 17:10        2334208        ----a-w-        c:\windows\system32\wininet.dll

2013-11-26 06:40 . 2013-12-12 17:10        1395200        ----a-w-        c:\windows\system32\urlmon.dll

2013-11-26 06:34 . 2013-12-12 17:10        817664        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-11-26 06:33 . 2013-12-12 17:10        1820160        ----a-w-        c:\windows\SysWow64\wininet.dll

2013-11-23 18:26 . 2013-12-12 16:55        417792        ----a-w-        c:\windows\SysWow64\WMPhoto.dll

2013-11-23 17:47 . 2013-12-12 16:55        465920        ----a-w-        c:\windows\system32\WMPhoto.dll

2013-11-19 13:10 . 2013-11-19 13:10        940032        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-11-19 13:10 . 2013-11-19 13:10        194048        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-11-19 13:10 . 2013-11-19 13:10        942592        ----a-w-        c:\windows\system32\jsIntl.dll

2013-11-19 13:10 . 2013-11-19 13:10        90112        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-11-19 13:10 . 2013-11-19 13:10        86016        ----a-w-        c:\windows\SysWow64\iesysprep.dll

2013-11-19 13:10 . 2013-11-19 13:10        86016        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe

2013-11-19 13:10 . 2013-11-19 13:10        84992        ----a-w-        c:\windows\system32\mshtmled.dll

2013-11-19 13:10 . 2013-11-19 13:10        83968        ----a-w-        c:\windows\system32\MshtmlDac.dll

2013-11-19 13:10 . 2013-11-19 13:10        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-11-19 13:10 . 2013-11-19 13:10        774144        ----a-w-        c:\windows\system32\jscript.dll

2013-11-19 13:10 . 2013-11-19 13:10        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-11-19 13:10 . 2013-11-19 13:10        74240        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-11-19 13:10 . 2013-11-19 13:10        71680        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe

2013-11-19 13:10 . 2013-11-19 13:10        645120        ----a-w-        c:\windows\SysWow64\jsIntl.dll

2013-11-19 13:10 . 2013-11-19 13:10        626176        ----a-w-        c:\windows\system32\msfeeds.dll

2013-11-19 13:10 . 2013-11-19 13:10        62464        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-11-19 13:10 . 2013-11-19 13:10        62464        ----a-w-        c:\windows\system32\pngfilt.dll

2013-11-19 13:10 . 2013-11-19 13:10        61952        ----a-w-        c:\windows\SysWow64\MshtmlDac.dll

2013-11-19 13:10 . 2013-11-19 13:10        61952        ----a-w-        c:\windows\SysWow64\iesetup.dll

2013-11-19 13:10 . 2013-11-19 13:10        616104        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-11-19 13:10 . 2013-11-19 13:10        548352        ----a-w-        c:\windows\system32\vbscript.dll

2013-11-19 13:10 . 2013-11-19 13:10        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-11-19 13:10 . 2013-11-19 13:10        51200        ----a-w-        c:\windows\SysWow64\ieetwproxystub.dll

2013-11-19 13:10 . 2013-11-19 13:10        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-11-19 13:10 . 2013-11-19 13:10        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-11-19 13:10 . 2013-11-19 13:10        48128        ----a-w-        c:\windows\system32\imgutil.dll

2013-11-19 13:10 . 2013-11-19 13:10        454656        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-11-19 13:10 . 2013-11-19 13:10        453120        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-11-19 13:10 . 2013-11-19 13:10        413696        ----a-w-        c:\windows\system32\html.iec

2013-11-19 13:10 . 2013-11-19 13:10        40448        ----a-w-        c:\windows\system32\JavaScriptCollectionAgent.dll

2013-11-19 13:10 . 2013-11-19 13:10        36352        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-11-19 13:10 . 2013-11-19 13:10        34816        ----a-w-        c:\windows\SysWow64\JavaScriptCollectionAgent.dll

2013-11-19 13:10 . 2013-11-19 13:10        337408        ----a-w-        c:\windows\SysWow64\html.iec

2013-11-19 13:10 . 2013-11-19 13:10        30208        ----a-w-        c:\windows\system32\licmgr10.dll

2013-11-19 13:10 . 2013-11-19 13:10        296960        ----a-w-        c:\windows\system32\dxtrans.dll

2013-11-19 13:10 . 2013-11-19 13:10        263376        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-11-19 13:10 . 2013-11-19 13:10        247808        ----a-w-        c:\windows\system32\msls31.dll

2013-11-19 13:10 . 2013-11-19 13:10        24576        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-11-19 13:10 . 2013-11-19 13:10        243200        ----a-w-        c:\windows\system32\webcheck.dll

2013-11-19 13:10 . 2013-11-19 13:10        235520        ----a-w-        c:\windows\system32\url.dll

2013-11-19 13:10 . 2013-11-19 13:10        235008        ----a-w-        c:\windows\system32\elshyph.dll

2013-11-19 13:10 . 2013-11-19 13:10        195584        ----a-w-        c:\windows\system32\msrating.dll

2013-11-19 13:10 . 2013-11-19 13:10        182272        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-11-19 13:10 . 2013-11-19 13:10        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-11-19 13:10 . 2013-11-19 13:10        151552        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-11-19 13:10 . 2013-11-19 13:10        147968        ----a-w-        c:\windows\system32\occache.dll

2013-11-19 13:10 . 2013-11-19 13:10        143872        ----a-w-        c:\windows\system32\wextract.exe

2013-11-19 13:10 . 2013-11-19 13:10        139264        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-11-19 13:10 . 2013-11-19 13:10        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-11-19 13:10 . 2013-11-19 13:10        135680        ----a-w-        c:\windows\system32\iepeers.dll

2013-11-19 13:10 . 2013-11-19 13:10        13312        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-11-19 13:10 . 2013-11-19 13:10        13312        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-11-19 13:10 . 2013-11-19 13:10        131072        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-11-19 13:10 . 2013-11-19 13:10        1228800        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-11-19 13:10 . 2013-11-19 13:10        112128        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-11-19 13:10 . 2013-11-19 13:10        111616        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-11-19 13:10 . 2013-11-19 13:10        105984        ----a-w-        c:\windows\system32\iesysprep.dll

2013-11-19 13:10 . 2013-11-19 13:10        1051136        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-11-19 13:10 . 2013-11-19 13:10        101376        ----a-w-        c:\windows\system32\inseng.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-12-08 393216]

"Spotify Web Helper"="c:\users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-01-21 1171968]

"f.lux"="c:\users\Mike\AppData\Local\FluxSoftware\Flux\flux.exe" [2013-10-23 1017224]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-09-16 115048]

"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2000-01-01 43608]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"Razer Imperator Driver"="c:\program files (x86)\Razer\Imperator\RazerImperatorTray.exe" [2010-09-07 2787224]

"Tarantula"="d:\programme\Razer\Tarantula\razerhid.exe" [2007-05-07 159744]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]

"iTunesHelper"="d:\programme\iTunes\iTunesHelper.exe" [2012-01-16 421736]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]

"StartCCC"="d:\programme\ATI\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-02-13 1263952]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]

"AvastUI.exe"="d:\programme\Avast Antivirus\AvastUI.exe" [2014-01-08 3764024]

"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2013-11-17 442712]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]

R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]

R3 CYUSB;Cypress Generic USB Driver;c:\windows\system32\Drivers\CYUSB.sys;c:\windows\SYSNATIVE\Drivers\CYUSB.sys [x]

R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\programme\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe;d:\programme\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]

R3 dump_wmimmc;dump_wmimmc;d:\programme\Garena Messenger\Apps\BlackShot\BlackShot\System\GameGuard\dump_wmimmc.sys;d:\programme\Garena Messenger\Apps\BlackShot\BlackShot\System\GameGuard\dump_wmimmc.sys [x]

R3 GGSAFERDriver;GGSAFER Driver;d:\programme\Garena\safedrv.sys;d:\programme\Garena\safedrv.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 Lycosa;Lycosa Keyboard;c:\windows\system32\drivers\Lycosa.sys;c:\windows\SYSNATIVE\drivers\Lycosa.sys [x]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]

R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 RzSynapse;Razer Driver;c:\windows\system32\DRIVERS\RzSynapse.sys;c:\windows\SYSNATIVE\DRIVERS\RzSynapse.sys [x]

R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys;c:\windows\SYSNATIVE\DRIVERS\s1018bus.sys [x]

R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys;c:\windows\SYSNATIVE\DRIVERS\s1018mdfl.sys [x]

R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys;c:\windows\SYSNATIVE\DRIVERS\s1018mdm.sys [x]

R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys;c:\windows\SYSNATIVE\DRIVERS\s1018mgmt.sys [x]

R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys;c:\windows\SYSNATIVE\DRIVERS\s1018nd5.sys [x]

R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys;c:\windows\SYSNATIVE\DRIVERS\s1018obex.sys [x]

R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys;c:\windows\SYSNATIVE\DRIVERS\s1018unic.sys [x]

R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\programme\SiSoftware\SiSoftware Sandra Lite 2010.SP3\RpcAgentSrv.exe;c:\programme\SiSoftware\SiSoftware Sandra Lite 2010.SP3\RpcAgentSrv.exe [x]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]

R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys;c:\windows\SYSNATIVE\DRIVERS\SWDUMon.sys [x]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]

R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]

R3 TunngleService;TunngleService;d:\programme\Tunngle\TnglCtrl.exe;d:\programme\Tunngle\TnglCtrl.exe [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]

R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]

R3 VKbms;Virtual HID Minidriver;c:\windows\system32\DRIVERS\VKbms.sys;c:\windows\SYSNATIVE\DRIVERS\VKbms.sys [x]

R3 VLAN;Realtek Virtual Miniport Driver for VLAN (NDIS 6.2);c:\windows\system32\DRIVERS\RtVLAN60.sys;c:\windows\SYSNATIVE\DRIVERS\RtVLAN60.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R4 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys;c:\windows\SYSNATIVE\drivers\dadder.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 aswRvrt;avast! Revert; [x]

S0 aswVmm;avast! VM Monitor; [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]

S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]

S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;d:\programme\Tribes Ascend\HiPatchService.exe;d:\programme\Tribes Ascend\HiPatchService.exe [x]

S2 JMB36X;JMB36X;c:\windows\SysWOW64\XSrvSetup.exe;c:\windows\SysWOW64\XSrvSetup.exe [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]

S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]

S3 TarFltr;Razer Tarantula USB Keyboard;c:\windows\system32\drivers\UsbFltr.sys;c:\windows\SYSNATIVE\drivers\UsbFltr.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2014-02-07 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 16:11]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2014-01-08 10:53        287280        ----a-w-        d:\programme\Avast Antivirus\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HardLinkMenu]

@="{0A479751-02BC-11d3-A855-0004AC2568AA}"

[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568AA}]

2011-06-24 06:03        456704        ----a-w-        d:\programme\LinkShellExtension\HardlinkShellExt.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHardLink]

@="{0A479751-02BC-11d3-A855-0004AC2568DD}"

[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568DD}]

2011-06-24 06:03        456704        ----a-w-        d:\programme\LinkShellExtension\HardlinkShellExt.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlaySymbolicLink]

@="{0A479751-02BC-11d3-A855-0004AC2568EE}"

[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568EE}]

2011-06-24 06:03        456704        ----a-w-        d:\programme\LinkShellExtension\HardlinkShellExt.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2000-01-01 13662936]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: An OneNote s&enden - d:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105

IE: Nach Microsoft E&xcel exportieren - d:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 10.0.0.138

FF - ProfilePath - c:\users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\

FF - prefs.js: browser.search.defaulturl - 

FF - prefs.js: browser.startup.homepage - hxxp://orf.at/

FF - prefs.js: network.proxy.type - 2

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKCU-Run-ISUSPM Startup - c:\program files (x86)\Common Files\InstallShield\UpdateService\isuspm.exe

Wow6432Node-HKCU-Run-Pando Media Booster - null\Pando Networks\Media Booster\PMB.exe

Wow6432Node-HKCU-Run-8EGKXbpz - c:\programdata\8EGKXbpz.exe

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

AddRemove-Age of Empires 2.0 - d:\programme\UNINSTAL.EXE

AddRemove-Age of Empires II: The Conquerors Expansion 1.0 - d:\programme\UNINSTALX.EXE

AddRemove-ESET Online Scanner - c:\program files (x86)\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe

AddRemove-Medieval Total War - d:\programme\medieval - total war\Uninst.isu

AddRemove-Risen 2: Dark Waters_is1 - d:\programme\Risen 2 Dark Waters\unins000.exe

AddRemove-Kies Air Discovery Service - c:\windows\system32\javaws.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-297277249-2334410078-3630889142-1000\Software\SecuROM\License information*]

"datasecu"=hex:b8,41,b0,77,3e,e1,83,7a,1e,b2,a1,18,7b,de,51,36,d6,a3,f6,78,f4,

   86,ed,85,3c,33,1c,b9,e7,5e,4a,c9,3e,cf,e2,fe,43,ca,48,3d,f1,b3,f8,4e,c8,7d,\

"rkeysecu"=hex:0b,f6,1e,1b,38,51,ab,dc,fa,42,76,e1,f6,69,ef,ea

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2014-02-07  18:19:00

ComboFix-quarantined-files.txt  2014-02-07 17:18

.

Vor Suchlauf: 4.530.073.600 Bytes frei

Nach Suchlauf: 5.961.011.200 Bytes frei

.

- - End Of File - - 46CC266B3C81248A1EDD436D6C43AAF0

5FB38429D5D77768867C76DCBDB35194

Supi, frisches FRST log bitte.

Bitteschön ;)

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2014

Ran by Mike (administrator) on MIKE-PC on 08-02-2014 13:27:39

Running from D:\Downloads

Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

The only official download link for FRST:

Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 

Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forums
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AVAST Software) D:\Programme\Avast Antivirus\AvastSvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hi-Rez Studios) D:\Programme\Tribes Ascend\HiPatchService.exe

() C:\Windows\SysWOW64\XSrvSetup.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Software 2000 Limited) C:\Windows\System32\spool\drivers\x64\3\HP1006MC.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(DT Soft Ltd) D:\Programme\DAEMON Tools Pro\DTShellHlp.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(Spotify Ltd) C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(Flux Software LLC) C:\Users\Mike\AppData\Local\FluxSoftware\Flux\flux.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Razer USA Ltd) C:\Program Files (x86)\Razer\Imperator\RazerImperatorTray.exe

(Razer USA Ltd.) D:\Programme\Razer\Tarantula\razerhid.exe

(Apple Inc.) D:\Programme\iTunes\iTunesHelper.exe

() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

(Advanced Micro Devices Inc.) D:\Programme\ATI\ATI.ACE\Core-Static\MOM.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(AVAST Software) D:\Programme\Avast Antivirus\AvastUI.exe

(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

(ATI Technologies Inc.) D:\Programme\ATI\ATI.ACE\Core-Static\CCC.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

() D:\Programme\Razer\Tarantula\razertra.exe

(Mozilla Corporation) D:\Programme\Mozilla Firefox\firefox.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(Mozilla Corporation) D:\Programme\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe

(Valve Corporation) D:\Programme\Steam\Steam.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2000-01-01] (Realtek Semiconductor)

HKLM-x32\...\Run: [ATICustomerCare] - C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-05-04] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [43608 2000-01-01] ()

HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Razer Imperator Driver] - C:\Program Files (x86)\Razer\Imperator\RazerImperatorTray.exe [2787224 2010-09-07] (Razer USA Ltd)

HKLM-x32\...\Run: [Tarantula] - D:\Programme\Razer\Tarantula\razerhid.exe [159744 2007-05-07] (Razer USA Ltd.)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-11-01] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\iTunes\iTunesHelper.exe [421736 2012-01-16] (Apple Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [StartCCC] - D:\Programme\ATI\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [AvastUI.exe] - D:\Programme\Avast Antivirus\AvastUI.exe [3764024 2014-01-08] (AVAST Software)

HKLM-x32\...\Run: [] - [X]

HKLM-x32\...\Run: [Razer Synapse] - C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [442712 2013-11-17] (Razer Inc.)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-12-08] (AMD)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [Spotify Web Helper] - C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-22] (Spotify Ltd)

HKU\S-1-5-21-297277249-2334410078-3630889142-1000\...\Run: [f.lux] - C:\Users\Mike\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1EF3F36AB9BECD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\Avast Antivirus\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - D:\Programme\Avast Antivirus\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)

Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - D:\Programme\Avast Antivirus\aswWebRepIE.dll (AVAST Software)

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
 

FireFox:

========

FF ProfilePath: C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default

FF Homepage: hxxp://orf.at/

FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"

FF NetworkProxy: "type", 2

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - null\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @raidcall.en/RCplugin - C:\Users\Mike\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)

FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - D:\Programme\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - D:\Programme\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - D:\Programme\Adobe Reader X\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @doubletwist.com/NPPodcast - C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll No File

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - D:\Downloads\null\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: GFACE Experience Plugin - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\cryenginebrowserplugin@crytek.com [2013-11-07]

FF Extension: TinEye Reverse Image Search - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\tineye@ideeinc.com [2011-02-18]

FF Extension: Microsoft .NET Framework Assistant - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-10-31]

FF Extension: Google Toolbar for Firefox - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-06-01]

FF Extension: EPUBReader - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2013-12-02]

FF Extension: InFormEnter - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{5546F97E-11A5-46b0-9082-32AD74AAA920} [2013-10-21]

FF Extension: Nightly Tester Tools - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{8620c15f-30dc-4dba-a131-7c5d20cf4a29} [2013-10-31]

FF Extension: Block site - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2013-08-11]

FF Extension: Honey - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\jid1-93CWPmRbVPjRQA@jetpack.xpi [2013-10-09]

FF Extension: Media Hint - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\mediahint@jetpack.xpi [2013-08-01]

FF Extension: FlashGot - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2011-04-10]

FF Extension: Adblock Plus - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-03-27]

FF Extension: DownThemAll! - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2011-05-19]

FF Extension: Greasemonkey - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6pvlo4g1.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012-08-25]

FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}

FF Extension: Adobe Contribute Toolbar - D:\Programme\Adobe CS5 MC\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-12-07]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - D:\Programme\Avast Antivirus\WebRep\FF

FF Extension: avast! Online Security - D:\Programme\Avast Antivirus\WebRep\FF [2013-01-21]

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-18]

FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla Firefox\firefox.exe
 

==================== Services (Whitelisted) =================
 

R2 avast! Antivirus; D:\Programme\Avast Antivirus\AvastSvc.exe [50344 2014-01-08] (AVAST Software)

S3 DAUpdaterSvc; D:\Programme\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2013-12-11] (BioWare)

R2 HiPatchService; D:\Programme\Tribes Ascend\HiPatchService.exe [9216 2013-11-26] (Hi-Rez Studios)

R2 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72304 2000-01-01] ()

S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Microsoft Office\Office14\GROOVE.EXE [50899608 2012-09-20] (Microsoft Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4089336 2011-03-08] (INCA Internet Co., Ltd.)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-08-16] ()

S3 SandraAgentSrv; C:\Programme\SiSoftware\SiSoftware Sandra Lite 2010.SP3\RpcAgentSrv.exe [93848 2009-08-10] (SiSoftware)

S4 TlntSvr; C:\Windows\System32\tlntsvr.exe [81920 2009-07-14] (Microsoft Corporation)

S3 TunngleService; D:\Programme\Tunngle\TnglCtrl.exe [743320 2012-09-25] (Tunngle.net GmbH)
 

==================== Drivers (Whitelisted) ====================
 

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-01-08] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-03] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-03] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2014-01-08] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2014-01-08] (AVAST Software)

R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2014-01-08] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-08] ()

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-01-31] ()

S3 CYUSB; C:\Windows\System32\Drivers\CYUSB.sys [47104 2009-08-10] (Cypress Semiconductor)

S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [556120 2013-01-21] (Kaspersky Lab)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-01-31] ()

S3 Lycosa; C:\Windows\System32\drivers\Lycosa.sys [18816 2008-01-17] (Razer USA Ltd.)

S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2005-01-03] (INCA Internet Co., Ltd.)

S3 RzSynapse; C:\Windows\System32\DRIVERS\RzSynapse.sys [126464 2011-03-31] (Razer USA Ltd)

S3 s1018bus; C:\Windows\System32\DRIVERS\s1018bus.sys [113704 2009-03-25] (MCCI Corporation)

S3 s1018mdfl; C:\Windows\System32\DRIVERS\s1018mdfl.sys [19496 2009-03-25] (MCCI Corporation)

S3 s1018mdm; C:\Windows\System32\DRIVERS\s1018mdm.sys [153128 2009-03-25] (MCCI Corporation)

S3 s1018mgmt; C:\Windows\System32\DRIVERS\s1018mgmt.sys [133160 2009-03-25] (MCCI Corporation)

S3 s1018nd5; C:\Windows\System32\DRIVERS\s1018nd5.sys [34856 2009-03-25] (MCCI Corporation)

S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [128552 2009-03-25] (MCCI Corporation)

S3 s1018unic; C:\Windows\System32\DRIVERS\s1018unic.sys [146472 2009-03-25] (MCCI Corporation)

S3 SANDRA; C:\Programme\SiSoftware\SiSoftware Sandra Lite 2010.SP3\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [526392 2012-01-16] ()

S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-12-29] ()

R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

R3 TarFltr; C:\Windows\System32\drivers\UsbFltr.sys [49664 2007-04-11] (Razer USA Ltd.)

S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [19200 2005-10-21] (Motorola)

S3 uisp; C:\Windows\SysWOW64\Drivers\usbicp.sys [14592 2005-12-21] (Motorola)

U3 azwzndsh; C:\Windows\System32\Drivers\azwzndsh.sys [0 ] (Advanced Micro Devices)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]

S4 DAdderFltr; system32\drivers\dadder.sys [X]

S3 dump_wmimmc; \??\D:\Programme\Garena Messenger\Apps\BlackShot\BlackShot\System\GameGuard\dump_wmimmc.sys [X]

S3 GGSAFERDriver; \??\D:\Programme\Garena\safedrv.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 TEAM; system32\DRIVERS\RtTeam60.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

S3 VLAN; system32\DRIVERS\RtVLAN60.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-07 18:19 - 2014-02-07 18:19 - 00034397 _____ () C:\ComboFix.txt

2014-02-07 17:58 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-02-07 17:58 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-02-07 17:58 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-02-07 17:58 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-02-07 17:58 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-02-07 17:58 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2014-02-07 17:58 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2014-02-07 17:58 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2014-02-07 17:56 - 2014-02-07 18:19 - 00000000 ____D () C:\Qoobox

2014-02-07 17:55 - 2014-02-07 18:17 - 00000000 ____D () C:\Windows\erdnt

2014-02-05 20:24 - 2014-02-08 13:27 - 00000000 ____D () C:\FRST

2014-02-05 20:14 - 2014-02-05 20:14 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-05 20:07 - 2014-02-05 20:07 - 00000000 ____D () C:\Windows\ERUNT

2014-02-05 20:00 - 2014-02-06 12:26 - 00000000 ____D () C:\AdwCleaner

2014-02-05 17:27 - 2014-02-05 20:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Malwarebytes

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-01-21 09:26 - 2014-01-21 09:26 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-01-15 19:53 - 2014-01-15 19:53 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\TheBannerSaga

2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-01-14 02:53 - 2014-01-14 02:53 - 00296448 _____ (Razer Inc) C:\Windows\SysWOW64\rzaudiodll.dll

2014-01-14 02:53 - 2014-01-14 02:53 - 00088576 _____ (Razer Inc) C:\Windows\SysWOW64\rzdevinfo.dll

2014-01-10 16:15 - 2014-01-10 16:15 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online
 

==================== One Month Modified Files and Folders =======
 

2014-02-08 13:27 - 2014-02-05 20:24 - 00000000 ____D () C:\FRST

2014-02-08 13:21 - 2009-07-14 05:45 - 00014416 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-08 13:21 - 2009-07-14 05:45 - 00014416 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-08 13:20 - 2009-07-14 18:58 - 24110774 _____ () C:\Windows\system32\perfh007.dat

2014-02-08 13:20 - 2009-07-14 18:58 - 07550874 _____ () C:\Windows\system32\perfc007.dat

2014-02-08 13:20 - 2009-07-14 06:13 - 00006506 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-08 13:16 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-08 13:16 - 2009-07-14 05:51 - 00168547 _____ () C:\Windows\setupact.log

2014-02-08 04:29 - 2010-10-27 17:04 - 01348920 _____ () C:\Windows\WindowsUpdate.log

2014-02-08 04:11 - 2012-09-21 23:43 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-07 23:07 - 2010-11-01 18:46 - 00286686 _____ () C:\Windows\PFRO.log

2014-02-07 18:19 - 2014-02-07 18:19 - 00034397 _____ () C:\ComboFix.txt

2014-02-07 18:19 - 2014-02-07 17:56 - 00000000 ____D () C:\Qoobox

2014-02-07 18:19 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default

2014-02-07 18:17 - 2014-02-07 17:55 - 00000000 ____D () C:\Windows\erdnt

2014-02-07 18:17 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2014-02-06 23:21 - 2010-11-14 15:43 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Skype

2014-02-06 16:48 - 2013-01-21 19:08 - 00004164 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-02-06 12:44 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-02-06 12:26 - 2014-02-05 20:00 - 00000000 ____D () C:\AdwCleaner

2014-02-06 12:26 - 2012-10-14 02:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-02-05 20:14 - 2014-02-05 20:14 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-05 20:07 - 2014-02-05 20:07 - 00000000 ____D () C:\Windows\ERUNT

2014-02-05 20:05 - 2014-02-05 17:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-02-05 17:11 - 2012-09-21 23:43 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-05 17:11 - 2012-04-08 10:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-05 17:11 - 2011-05-19 15:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Malwarebytes

2014-02-05 16:27 - 2014-02-05 16:27 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-04 03:11 - 2013-03-05 02:34 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\vlc

2014-01-28 23:57 - 2010-10-28 17:51 - 00770958 _____ () C:\Windows\DPINST.LOG

2014-01-27 16:49 - 2010-10-28 13:44 - 00571322 _____ () C:\Windows\DirectX.log

2014-01-24 14:44 - 2011-03-14 17:03 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\uTorrent

2014-01-22 00:03 - 2013-04-02 23:43 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Spotify

2014-01-21 20:44 - 2013-04-02 23:44 - 00000000 ____D () C:\Users\Mike\AppData\Local\Spotify

2014-01-21 09:27 - 2013-10-17 21:52 - 00000000 ____D () C:\ProgramData\Oracle

2014-01-21 09:26 - 2014-01-21 09:26 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-01-21 09:26 - 2010-10-28 18:32 - 00000000 ____D () C:\Program Files (x86)\Java

2014-01-21 09:05 - 2010-11-03 13:53 - 00000000 ____D () C:\Users\Mike\AppData\Local\Adobe

2014-01-18 14:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-01-18 03:08 - 2013-10-25 20:49 - 00000000 ____D () C:\Users\Mike\AppData\Local\Battle.net

2014-01-16 11:10 - 2009-07-14 05:45 - 04992608 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-01-16 01:31 - 2013-08-15 10:50 - 00000000 ____D () C:\Windows\system32\MRT

2014-01-16 01:29 - 2010-02-09 23:33 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-01-15 19:53 - 2014-01-15 19:53 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\TheBannerSaga

2014-01-14 02:53 - 2014-01-14 02:53 - 00296448 _____ (Razer Inc) C:\Windows\SysWOW64\rzaudiodll.dll

2014-01-14 02:53 - 2014-01-14 02:53 - 00088576 _____ (Razer Inc) C:\Windows\SysWOW64\rzdevinfo.dll

2014-01-10 17:47 - 2013-11-16 23:26 - 00000000 ____D () C:\Users\Mike\AppData\Roaming\Awesomium

2014-01-10 16:15 - 2014-01-10 16:15 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-31 18:57
 

==================== End Of Log ============================

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)