Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Unbekanntes Symbol - verschwindet plötzlich (https://www.trojaner-board.de/152102-unbekanntes-symbol-verschwindet-ploetzlich.html)

plings 06.04.2014 18:52
Unbekanntes Symbol - verschwindet plötzlich
 
Liste der Anhänge anzeigen (Anzahl: 1)
Guten Abend,

wenn ich auf meiner Taskleiste unten rechts auf den kleinen Pfeil "Ausgeblendete Symbole einblenden klicke, taucht manchmal ein merkwürdiges Symbol auf, von dem ich nicht weiß, wo es herkommt.

Hier ist es zu sehen (roter Kreis):

http://i60.tinypic.com/20rs9bq.jpg

Das merkwürde ist, dass, immer wenn ich mit der Maus auf das Symbol fahren will um zu sehen, was es damit auf sich hat, das Symbol auf einmal verschwindet.

Weiß jemand, was da los ist und was es damit auf sich hat?

schrauber 07.04.2014 07:01
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


plings 07.04.2014 10:06
FRST Logfile:



FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Admin (administrator) on IAK on 07-04-2014 10:59:36
Running from C:\Users\Kai\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) E:\Programme\AvastAntivirus\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(Valve Corporation) E:\Programme\Steam\Steam.exe
(AVAST Software) E:\Programme\AvastAntivirus\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuSchd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Safer-Networking Ltd.) E:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) E:\Programme\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) E:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) E:\Programme\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Advanced Micro Devices Inc.) c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-02-01] (IDT, Inc.)
HKLM-x32\...\Run: [StartCCC] - c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-08-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - E:\Programme\AvastAntivirus\AvastUI.exe [3854640 2014-04-02] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] - E:\Programme\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\RunOnce: [20131224] - E:\Programme\AvastAntivirus\setup\emupdate\71aee365-dae4-4482-8d38-bbade4e27cbf.exe /check [181136 2014-03-29] (AVAST Software)
HKLM-x32\...\Runonce: [InstallShieldSetup] - C:\PROGRA~2\INSTAL~1\{E3A5A~1\setup.exe -rebootC:\PROGRA~2\INSTAL~1\{E3A5A~1\reboot.ini [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-08-07] (Microsoft Corporation)
HKU\S-1-5-21-4206140673-2134933495-2589258567-1000\...\Run: [Spybot-S&D Cleaning] - E:\Programme\Spybot - Search & Destroy 2\SDCleaner.exe [3666224 2013-09-20] (Safer-Networking Ltd.)
HKU\S-1-5-21-4206140673-2134933495-2589258567-1003\...\Run: [Steam] - E:\Programme\Steam\Steam.exe [1821888 2014-02-25] (Valve Corporation)
HKU\S-1-5-21-4206140673-2134933495-2589258567-1003\...\MountPoints2: {c35a76e6-3dcb-11e3-80d8-101f74ca483d} - J:\autorun.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.search.yahoo.com/?type=402027&fr=spigot-yhp-ie
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x701346576C93CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
URLSearchHook: HKCU - IObit Apps Toolbar - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} -  No File
SearchScopes: HKCU - DefaultScope {BC019CD1-DEA5-4682-BCA8-A24D0820FCF5} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=402027&p={searchTerms}
SearchScopes: HKCU - {BC019CD1-DEA5-4682-BCA8-A24D0820FCF5} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=402027&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Programme\AvastAntivirus\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Programme\AvastAntivirus\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
DPF: HKLM {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect1263.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o4e5tppe.default
FF DefaultSearchEngine: Yahoo!
FF SelectedSearchEngine: Yahoo!
FF Homepage: hxxp://de.search.yahoo.com/?type=402027&fr=spigot-yhp-ff
FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=402027&p=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 - E:\Programme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o4e5tppe.default\searchplugins\yahoo_ff.xml
FF Extension: Slick Savings - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o4e5tppe.default\Extensions\savingsslider@mybrowserbar.com [2013-11-28]
FF Extension: Start Page - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o4e5tppe.default\Extensions\{58d2a791-6199-482f-a9aa-9b725ec61362} [2013-11-28]
FF Extension: HP Detect - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o4e5tppe.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2} [2013-08-07]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - E:\Programme\AvastAntivirus\WebRep\FF
FF Extension: avast! Online Security - E:\Programme\AvastAntivirus\WebRep\FF [2013-08-07]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-01-07]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2014-02-17]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-01-07]
FF StartMenuInternet: FIREFOX.EXE - E:\Programme\Mozilla Firefox\firefox.exe

==================== Services (Whitelisted) =================

R2 avast! Antivirus; E:\Programme\AvastAntivirus\AvastSvc.exe [50344 2014-04-02] (AVAST Software)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [47416 2014-02-05] (Hewlett-Packard Company)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 SDScannerService; E:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; E:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; E:\Programme\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-02] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-02] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-02] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-02] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-02] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-02] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-02] ()
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2011-10-24] (Huawei Technologies Co., Ltd.)
R1 ISODrive; E:\Programme\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.)
S3 PRESONUS_AUDIOBOX_MIDI; C:\Windows\System32\drivers\psabusbm.sys [37496 2009-12-04] (Ploytec GmbH)
S3 PRESONUS_AUDIOBOX_USB; C:\Windows\System32\Drivers\psabusbu.sys [462968 2009-12-04] (Ploytec GmbH)
S3 PRESONUS_AUDIOBOX_WDM; C:\Windows\System32\drivers\psabusba.sys [50808 2009-12-04] (Ploytec GmbH)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [32496 2013-11-28] (Synaptics Incorporated)
S3 GPU-Z; \??\C:\Users\Admin\AppData\Local\Temp\GPU-Z.sys [X]
S3 STHDA; system32\DRIVERS\stwrt64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-07 10:55 - 2014-04-07 10:59 - 00014347 _____ () C:\Users\Kai\Desktop\FRST.txt
2014-04-07 10:53 - 2014-04-07 10:54 - 02157056 _____ (Farbar) C:\Users\Kai\Desktop\FRST64.exe
2014-04-06 19:42 - 2014-04-06 19:42 - 00013938 _____ () C:\Users\Kai\Desktop\Symbole.xcf
2014-04-06 19:42 - 2014-04-06 19:42 - 00003350 _____ () C:\Users\Kai\AppData\Local\recently-used.xbel
2014-04-05 15:11 - 2014-04-05 16:22 - 1289748480 _____ () C:\Users\Kai\Downloads\linuxmint-16-mate-dvd-32bit.iso
2014-04-04 20:13 - 2014-04-04 20:13 - 00015482 _____ () C:\Users\Kai\Desktop\Gmer.zip
2014-04-04 20:11 - 2014-04-04 20:11 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-04-04 20:11 - 2014-04-04 19:59 - 00324878 _____ () C:\Users\Kai\Documents\Gmer.txt
2014-04-04 20:10 - 2014-04-04 20:10 - 00007757 _____ () C:\Users\Kai\Desktop\Gmer.rar
2014-04-04 19:50 - 2014-04-04 19:50 - 00325296 _____ () C:\Users\Admin\Desktop\Gmer.txt
2014-04-04 19:49 - 2014-04-04 19:49 - 00051808 _____ () C:\Users\Kai\Downloads\69886-alle-hilfesuchenden-eroeffnung-themas-beachten.html
2014-04-04 19:38 - 2014-04-07 10:59 - 00000000 ____D () C:\FRST
2014-04-04 19:36 - 2014-04-04 19:36 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-04-04 12:47 - 2014-04-04 12:47 - 00005246 _____ () C:\Users\Kai\Downloads\Weitergeleitete Nachricht
2014-04-02 11:58 - 2014-04-02 11:58 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-02 03:42 - 2014-04-02 03:42 - 02347384 _____ (ESET) C:\Users\Kai\Downloads\esetsmartinstaller_enu.exe
2014-04-02 03:42 - 2014-04-02 03:42 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-03-29 15:02 - 2014-03-29 15:02 - 06957280 _____ (Microsoft Corporation) C:\Users\Kai\Downloads\Silverlight.exe
2014-03-29 15:02 - 2014-03-29 15:02 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-29 01:55 - 2014-03-31 00:50 - 00000000 ____D () C:\Users\Kai\AppData\Roaming\TS3Client
2014-03-29 01:45 - 2014-03-29 01:45 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-03-29 01:16 - 2014-03-29 01:24 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\TS3Client
2014-03-29 01:16 - 2014-03-29 01:16 - 00000743 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-03-29 01:12 - 2014-03-29 01:14 - 00000000 ____D () C:\Users\Kai\AppData\Roaming\Audacity
2014-03-27 17:01 - 2014-04-01 00:43 - 00023409 _____ () C:\Users\Kai\Desktop\Fake-Studie.odt
2014-03-27 01:27 - 2014-03-27 01:27 - 00000736 _____ () C:\Users\Public\Desktop\XSplit Gamecaster.lnk
2014-03-27 01:27 - 2014-03-27 01:27 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-03-27 01:27 - 2014-03-27 01:27 - 00000000 ____D () C:\ProgramData\SplitMediaLabs
2014-03-27 01:26 - 2014-03-27 01:26 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\SplitMediaLabs
2014-03-27 01:23 - 2014-03-27 01:26 - 45143440 _____ (SplitMediaLabs) C:\Users\Kai\Downloads\xsplit_gc_installer.exe
2014-03-27 01:07 - 2014-04-07 10:49 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-27 01:07 - 2014-04-06 20:23 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-27 01:07 - 2014-04-06 01:18 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-27 01:07 - 2014-04-06 01:18 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-27 01:07 - 2014-03-27 01:07 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-27 01:07 - 2014-03-27 01:07 - 00000000 ____D () C:\Users\Kai\AppData\Local\Google
2014-03-27 01:07 - 2014-03-27 01:07 - 00000000 ____D () C:\Program Files (x86)\Google
2014-03-27 01:05 - 2014-03-27 01:07 - 38147064 _____ (Google Inc.) C:\Users\Kai\Downloads\ChromeStandaloneSetup_33.0.1750.154.exe
2014-03-27 00:47 - 2014-03-27 00:47 - 00000000 ____D () C:\Users\Kai\AppData\Roaming\Opera Software
2014-03-27 00:47 - 2014-03-27 00:47 - 00000000 ____D () C:\Users\Kai\AppData\Local\Opera Software
2014-03-27 00:42 - 2014-03-27 00:42 - 00044550 _____ () C:\Users\Kai\Downloads\bookmarks.html
2014-03-27 00:24 - 2014-03-27 01:05 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Opera Software
2014-03-27 00:24 - 2014-03-27 01:05 - 00000000 ____D () C:\Users\Admin\AppData\Local\Opera Software
2014-03-27 00:24 - 2014-03-27 01:05 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-03-21 19:45 - 2014-03-21 19:47 - 00000000 ____D () C:\Users\Kai\Desktop\WC3
2014-03-17 18:08 - 2014-03-17 18:08 - 00001825 _____ () C:\Users\Public\Desktop\MultiDoge 0.1.2.lnk
2014-03-17 18:08 - 2014-03-17 18:08 - 00000000 ____D () C:\Program Files (x86)\MultiDoge-0.1.2
2014-03-17 18:07 - 2014-03-17 18:07 - 09833984 _____ () C:\Users\Kai\Downloads\multidoge-0.1.2-windows-setup.exe
2014-03-17 18:03 - 2014-03-17 18:04 - 08057278 _____ (Dogecoin) C:\Users\Kai\Downloads\dogecoin-1.6.0.0-win32-setup.exe
2014-03-13 20:25 - 2014-03-13 20:25 - 00000000 ____D () C:\Users\Kai\Downloads\Mathe
2014-03-13 20:24 - 2014-03-13 20:25 - 00857844 _____ () C:\Users\Kai\Downloads\Mathe.rar
2014-03-13 15:36 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-13 15:36 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-13 15:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-13 15:36 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-13 15:36 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-13 15:36 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-13 15:36 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-13 15:36 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-13 15:36 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-13 15:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-13 15:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-13 15:36 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-13 15:36 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-13 15:36 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-13 15:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-13 15:36 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-13 15:36 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-13 15:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-13 15:36 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-13 15:36 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-13 15:36 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-13 15:36 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-13 15:36 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-13 15:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-13 15:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-13 15:36 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-13 15:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-13 15:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-13 15:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-13 15:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-13 15:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-13 15:35 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-13 15:35 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-13 15:35 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-13 15:35 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-13 15:35 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-13 15:35 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-13 15:35 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-13 15:35 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-13 15:35 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-13 15:31 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-13 15:31 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-13 15:31 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-13 15:30 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-13 15:25 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-13 15:25 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-13 15:25 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-13 15:25 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-11 01:57 - 2014-03-11 01:57 - 00002128 _____ () C:\Users\Public\Desktop\Empire Earth - The Art of Conquest.lnk
2014-03-11 01:55 - 2014-03-11 01:55 - 00000000 ____D () C:\GOG Games
2014-03-11 01:28 - 2014-03-11 01:58 - 00000000 ____D () C:\Users\Kai\AppData\Local\GOG.com
2014-03-11 01:27 - 2014-03-11 01:27 - 03701856 _____ (GOG.com ) C:\Users\Kai\Downloads\Setup_Downloader_3.6.0_stable.exe
2014-03-10 23:19 - 2014-03-10 23:20 - 00000000 ____D () C:\ProgramData\Package Cache
2014-03-10 22:19 - 2014-03-10 22:19 - 00000212 _____ () C:\Users\Kai\Desktop\Age of Empires II HD Edition.url
2014-03-08 16:38 - 2014-04-02 13:06 - 00000000 ____D () C:\Users\Kai\AppData\Roaming\MultiDoge
2014-03-08 16:38 - 2014-03-08 16:38 - 00000000 ____D () C:\Program Files (x86)\MultiDoge-0.1.1
2014-03-08 16:28 - 2014-03-08 16:08 - 00073728 _____ () C:\Users\Kai\Desktop\wallet.dat
2014-03-08 16:21 - 2014-03-08 16:21 - 09815552 _____ () C:\Users\Kai\Downloads\multidoge-0.1.1-windows-setup.exe
2014-03-08 14:36 - 2014-03-08 15:55 - 00000960 _____ () C:\Users\Kai\wowdoge.log
2014-03-08 14:32 - 2014-03-08 14:33 - 09250017 _____ (WowDoge.org ) C:\Users\Kai\Downloads\WowDogeSetup.exe

==================== One Month Modified Files and Folders =======

2014-04-07 10:59 - 2014-04-07 10:55 - 00014347 _____ () C:\Users\Kai\Desktop\FRST.txt
2014-04-07 10:59 - 2014-04-04 19:38 - 00000000 ____D () C:\FRST
2014-04-07 10:56 - 2009-07-14 06:45 - 00024048 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-07 10:56 - 2009-07-14 06:45 - 00024048 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-07 10:55 - 2009-07-14 19:58 - 00699440 _____ () C:\Windows\system32\perfh007.dat
2014-04-07 10:55 - 2009-07-14 19:58 - 00149548 _____ () C:\Windows\system32\perfc007.dat
2014-04-07 10:55 - 2009-07-14 07:13 - 01619700 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-07 10:54 - 2014-04-07 10:53 - 02157056 _____ (Farbar) C:\Users\Kai\Desktop\FRST64.exe
2014-04-07 10:52 - 2013-08-07 00:00 - 01330444 _____ () C:\Windows\WindowsUpdate.log
2014-04-07 10:49 - 2014-03-27 01:07 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-07 10:48 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-07 10:48 - 2009-07-14 06:51 - 00053336 _____ () C:\Windows\setupact.log
2014-04-06 20:23 - 2014-03-27 01:07 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-06 20:22 - 2013-08-07 07:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-06 19:55 - 2014-03-06 14:29 - 00000000 ____D () C:\Users\Kai\.gimp-2.8
2014-04-06 19:54 - 2014-03-06 14:36 - 00000000 ____D () C:\Users\Kai\AppData\Local\gtk-2.0
2014-04-06 19:42 - 2014-04-06 19:42 - 00013938 _____ () C:\Users\Kai\Desktop\Symbole.xcf
2014-04-06 19:42 - 2014-04-06 19:42 - 00003350 _____ () C:\Users\Kai\AppData\Local\recently-used.xbel
2014-04-06 16:07 - 2014-01-07 17:07 - 00000324 _____ () C:\Windows\Tasks\WebReg HP Officejet 4500 G510g-m.job
2014-04-06 12:24 - 2013-08-07 00:40 - 00004162 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-06 01:18 - 2014-03-27 01:07 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-06 01:18 - 2014-03-27 01:07 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-05 16:22 - 2014-04-05 15:11 - 1289748480 _____ () C:\Users\Kai\Downloads\linuxmint-16-mate-dvd-32bit.iso
2014-04-04 20:13 - 2014-04-04 20:13 - 00015482 _____ () C:\Users\Kai\Desktop\Gmer.zip
2014-04-04 20:11 - 2014-04-04 20:11 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-04-04 20:10 - 2014-04-04 20:10 - 00007757 _____ () C:\Users\Kai\Desktop\Gmer.rar
2014-04-04 19:59 - 2014-04-04 20:11 - 00324878 _____ () C:\Users\Kai\Documents\Gmer.txt
2014-04-04 19:50 - 2014-04-04 19:50 - 00325296 _____ () C:\Users\Admin\Desktop\Gmer.txt
2014-04-04 19:49 - 2014-04-04 19:49 - 00051808 _____ () C:\Users\Kai\Downloads\69886-alle-hilfesuchenden-eroeffnung-themas-beachten.html
2014-04-04 19:41 - 2013-08-08 16:48 - 00000000 ____D () C:\Users\Kai\AppData\Roaming\Spotify
2014-04-04 19:36 - 2014-04-04 19:36 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-04-04 19:36 - 2013-08-07 00:12 - 00000000 ____D () C:\Users\Admin
2014-04-04 12:47 - 2014-04-04 12:47 - 00005246 _____ () C:\Users\Kai\Downloads\Weitergeleitete Nachricht
2014-04-03 22:42 - 2013-08-07 00:45 - 00201764 _____ () C:\Windows\PFRO.log
2014-04-02 13:06 - 2014-03-08 16:38 - 00000000 ____D () C:\Users\Kai\AppData\Roaming\MultiDoge
2014-04-02 11:59 - 2013-08-07 00:40 - 00000892 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-02 11:58 - 2014-04-02 11:58 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-02 11:58 - 2014-01-09 23:13 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-04-02 11:58 - 2013-08-07 00:40 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-02 11:58 - 2013-08-07 00:40 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-02 11:58 - 2013-08-07 00:40 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-02 11:58 - 2013-08-07 00:40 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-02 11:58 - 2013-08-07 00:40 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-02 11:58 - 2013-08-07 00:40 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-02 11:58 - 2013-08-07 00:40 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-02 05:45 - 2013-11-28 20:31 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Slick Savings
2014-04-02 03:42 - 2014-04-02 03:42 - 02347384 _____ (ESET) C:\Users\Kai\Downloads\esetsmartinstaller_enu.exe
2014-04-02 03:42 - 2014-04-02 03:42 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-01 00:43 - 2014-03-27 17:01 - 00023409 _____ () C:\Users\Kai\Desktop\Fake-Studie.odt
2014-03-31 00:50 - 2014-03-29 01:55 - 00000000 ____D () C:\Users\Kai\AppData\Roaming\TS3Client
2014-03-29 16:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-29 15:02 - 2014-03-29 15:02 - 06957280 _____ (Microsoft Corporation) C:\Users\Kai\Downloads\Silverlight.exe
2014-03-29 15:02 - 2014-03-29 15:02 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-29 01:45 - 2014-03-29 01:45 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-03-29 01:45 - 2014-01-04 19:04 - 00000000 ____D () C:\Users\Kai\AppData\Local\WarThunder
2014-03-29 01:24 - 2014-03-29 01:16 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\TS3Client
2014-03-29 01:16 - 2014-03-29 01:16 - 00000743 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-03-29 01:14 - 2014-03-29 01:12 - 00000000 ____D () C:\Users\Kai\AppData\Roaming\Audacity
2014-03-29 00:37 - 2014-02-18 00:22 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-03-29 00:36 - 2014-02-18 00:18 - 00000000 ____D () C:\Users\Kai\AppData\Local\Battle.net
2014-03-27 03:23 - 2013-11-13 02:34 - 00000000 ____D () C:\Users\Kai\Documents\StarCraft II
2014-03-27 01:27 - 2014-03-27 01:27 - 00000736 _____ () C:\Users\Public\Desktop\XSplit Gamecaster.lnk
2014-03-27 01:27 - 2014-03-27 01:27 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-03-27 01:27 - 2014-03-27 01:27 - 00000000 ____D () C:\ProgramData\SplitMediaLabs
2014-03-27 01:26 - 2014-03-27 01:26 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\SplitMediaLabs
2014-03-27 01:26 - 2014-03-27 01:23 - 45143440 _____ (SplitMediaLabs) C:\Users\Kai\Downloads\xsplit_gc_installer.exe
2014-03-27 01:07 - 2014-03-27 01:07 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-27 01:07 - 2014-03-27 01:07 - 00000000 ____D () C:\Users\Kai\AppData\Local\Google
2014-03-27 01:07 - 2014-03-27 01:07 - 00000000 ____D () C:\Program Files (x86)\Google
2014-03-27 01:07 - 2014-03-27 01:05 - 38147064 _____ (Google Inc.) C:\Users\Kai\Downloads\ChromeStandaloneSetup_33.0.1750.154.exe
2014-03-27 01:05 - 2014-03-27 00:24 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Opera Software
2014-03-27 01:05 - 2014-03-27 00:24 - 00000000 ____D () C:\Users\Admin\AppData\Local\Opera Software
2014-03-27 01:05 - 2014-03-27 00:24 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-03-27 01:05 - 2013-08-07 00:13 - 00001425 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-03-27 00:47 - 2014-03-27 00:47 - 00000000 ____D () C:\Users\Kai\AppData\Roaming\Opera Software
2014-03-27 00:47 - 2014-03-27 00:47 - 00000000 ____D () C:\Users\Kai\AppData\Local\Opera Software
2014-03-27 00:42 - 2014-03-27 00:42 - 00044550 _____ () C:\Users\Kai\Downloads\bookmarks.html
2014-03-27 00:18 - 2013-08-07 08:18 - 00076360 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-24 16:50 - 2013-08-08 16:49 - 00000000 ____D () C:\Users\Kai\AppData\Local\Spotify
2014-03-23 17:00 - 2013-11-04 14:21 - 00000000 ____D () C:\Users\Admin\AppData\Local\HiSuite
2014-03-23 17:00 - 2013-11-04 14:20 - 00000000 ____D () C:\Program Files (x86)\HiSuite
2014-03-21 19:47 - 2014-03-21 19:45 - 00000000 ____D () C:\Users\Kai\Desktop\WC3
2014-03-19 02:17 - 2014-02-24 19:14 - 00000000 ____D () C:\Users\Kai\Downloads\4
2014-03-18 19:02 - 2013-08-07 08:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-18 19:00 - 2013-08-07 08:20 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-17 18:08 - 2014-03-17 18:08 - 00001825 _____ () C:\Users\Public\Desktop\MultiDoge 0.1.2.lnk
2014-03-17 18:08 - 2014-03-17 18:08 - 00000000 ____D () C:\Program Files (x86)\MultiDoge-0.1.2
2014-03-17 18:07 - 2014-03-17 18:07 - 09833984 _____ () C:\Users\Kai\Downloads\multidoge-0.1.2-windows-setup.exe
2014-03-17 18:07 - 2013-12-22 18:50 - 00000000 ____D () C:\Users\Kai\AppData\Roaming\DogeCoin
2014-03-17 18:05 - 2013-12-22 18:49 - 00000000 ____D () C:\Users\Kai\Desktop\DogeCoin
2014-03-17 18:04 - 2014-03-17 18:03 - 08057278 _____ (Dogecoin) C:\Users\Kai\Downloads\dogecoin-1.6.0.0-win32-setup.exe
2014-03-17 12:51 - 2009-07-14 06:45 - 00322232 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-13 20:25 - 2014-03-13 20:25 - 00000000 ____D () C:\Users\Kai\Downloads\Mathe
2014-03-13 20:25 - 2014-03-13 20:24 - 00857844 _____ () C:\Users\Kai\Downloads\Mathe.rar
2014-03-12 18:22 - 2013-08-07 07:53 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 18:22 - 2013-08-07 07:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 18:22 - 2013-08-07 07:53 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-11 13:29 - 2013-09-30 15:23 - 00112664 _____ () C:\Windows\DirectX.log
2014-03-11 01:58 - 2014-03-11 01:28 - 00000000 ____D () C:\Users\Kai\AppData\Local\GOG.com
2014-03-11 01:57 - 2014-03-11 01:57 - 00002128 _____ () C:\Users\Public\Desktop\Empire Earth - The Art of Conquest.lnk
2014-03-11 01:57 - 2014-01-07 02:02 - 00001962 _____ () C:\Users\Public\Desktop\Empire Earth.lnk
2014-03-11 01:55 - 2014-03-11 01:55 - 00000000 ____D () C:\GOG Games
2014-03-11 01:55 - 2013-08-07 16:00 - 00076360 _____ () C:\Users\Kai\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-11 01:27 - 2014-03-11 01:27 - 03701856 _____ (GOG.com ) C:\Users\Kai\Downloads\Setup_Downloader_3.6.0_stable.exe
2014-03-10 23:20 - 2014-03-10 23:19 - 00000000 ____D () C:\ProgramData\Package Cache
2014-03-10 22:19 - 2014-03-10 22:19 - 00000212 _____ () C:\Users\Kai\Desktop\Age of Empires II HD Edition.url
2014-03-08 16:38 - 2014-03-08 16:38 - 00000000 ____D () C:\Program Files (x86)\MultiDoge-0.1.1
2014-03-08 16:21 - 2014-03-08 16:21 - 09815552 _____ () C:\Users\Kai\Downloads\multidoge-0.1.1-windows-setup.exe
2014-03-08 16:08 - 2014-03-08 16:28 - 00073728 _____ () C:\Users\Kai\Desktop\wallet.dat
2014-03-08 15:55 - 2014-03-08 14:36 - 00000960 _____ () C:\Users\Kai\wowdoge.log
2014-03-08 14:36 - 2013-08-07 15:58 - 00000000 ____D () C:\Users\Kai
2014-03-08 14:33 - 2014-03-08 14:32 - 09250017 _____ (WowDoge.org ) C:\Users\Kai\Downloads\WowDogeSetup.exe

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\AutoRun.exe
C:\Users\Admin\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Admin\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exe
C:\Users\Admin\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Admin\AppData\Local\Temp\GameuxInstallHelper.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-02 06:01

==================== End Of Log ============================
--- --- ---

--- --- ---






Ich finde die Addition.txt nicht, habe versucht alles aus diesem Thread:
www.trojaner-board.de/152016-win7-pc-check-virenfund.html
zu löschen, liegt es daran, dass ich nicht alles erwischt habe?

schrauber 07.04.2014 14:10
warum machst du ein zweites thema auf wenn der rechner schon in arbeit is?

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKLM-x32\...\Runonce: [InstallShieldSetup] - C:\PROGRA~2\INSTAL~1\{E3A5A~1\setup.exe -rebootC:\PROGRA~2\INSTAL~1\{E3A5A~1\reboot.ini [X]

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


plings 07.04.2014 15:00
Ich dachte, das seien vielleicht zwei unterschiedliche Paar Schuhe und wollte es trennen. Aber ich merks mir.

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by Admin at 2014-04-07 15:59:21 Run:1
Running from C:\Users\Kai\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM-x32\...\Runonce: [InstallShieldSetup] - C:\PROGRA~2\INSTAL~1\{E3A5A~1\setup.exe -rebootC:\PROGRA~2\INSTAL~1\{E3A5A~1\reboot.ini [X]

*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\InstallShieldSetup => Value deleted successfully.

==== End of Fixlog ====

schrauber 08.04.2014 11:11
was macht das Symbol?

plings 08.04.2014 14:39
Taucht immer noch auf..

schrauber 09.04.2014 13:27
Auf jeden Fall ist das keine Malware. Das ist irgend ein Systemprogramm, was nicht richtig läuft. Ich kenne das Symbol auch, weiß nur nit wo ich es hinstecken soll im Moment.

plings 10.04.2014 15:30
Kann ich irgendwie rausbekommen was falsch läuft?

schrauber 11.04.2014 06:50
Jede Menge Suchen bei Google. Oder einfach Windows Scheibe rein und mal ne Rep-Installation machen. Auch schauen dass alles externe am Rechner abgeklemmt ist.


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:00 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131