| |
| |||||||
Log-Analyse und Auswertung: Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
27.09.2013, 16:57
| #1 |
| |  Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen Hallo, hab keine Ahnung, bin nur User, aber es ist ein Trojaner drauf, der ständig Programme versucht zu öffnen... Hab jetzt auf Anraten eines Spezies aus der Ferne euer Forum besucht und genutzt- d.h. die Programme defogger u.s.w ausgeführt und die log-files gespeichert anbei also diese hier, bitte findet heraus, wie man das wieder losbekommt tausend Dank Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:24 on 27/09/2013 (Petra)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
SPTD -> Disabled
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013
Ran by Petra (administrator) on PETRAPC on 27-09-2013 17:25:41
Running from C:\Users\Petra\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Safe Mode (with Networking)
==================== Processes (Whitelisted) =================
(QIP) C:\Program Files (x86)\QIP 2012 Jeak-Edition\qip.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8067616 2013-05-18] (Realtek Semiconductor)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20684656 2013-07-25] (Skype Technologies S.A.)
HKCU\...\Run: [Infium] - C:\Program Files (x86)\QIP 2012 Jeak-Edition\qip.exe [7318992 2011-12-28] (QIP)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SSDMonitor] - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [105120 2012-08-21] (PC Tools)
HKLM-x32\...\Run: [Iminent] - C:\Program Files (x86)\Iminent\Iminent.exe [1074736 2013-09-10] (Iminent)
HKLM-x32\...\Run: [IminentMessenger] - C:\Program Files (x86)\Iminent\Iminent.Messengers.exe [884784 2013-09-10] (Iminent)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [1300256 2013-09-17] (Conduit)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll c:\progra~3\bitguard\261673~1.238\{c16c1~1\bitguard.dll [2700768 2013-09-10] ()
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP7836C6A9-B298-4FE3-9AEE-AE38E3EB475B
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.golsearch.com/?babsrc=HP_ss_Btisdt6&mntrId=5053BC5FF413E132&affID=119357&tsp=5017
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
URLSearchHook: (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197641
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197644&type=default&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197644&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197644&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197644&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=3E4C8CCD-C0E5-4EA8-8D2E-0969BD4E1AE2&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP7836C6A9-B298-4FE3-9AEE-AE38E3EB475B&q={searchTerms}
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP7836C6A9-B298-4FE3-9AEE-AE38E3EB475B&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.golsearch.com/?q={searchTerms}&babsrc=SP_ss_Btisdt6&mntrId=5053BC5FF413E132&affID=119357&tsp=5017
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282271&type=default&q={searchTerms}
SearchScopes: HKCU - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=3E4C8CCD-C0E5-4EA8-8D2E-0969BD4E1AE2&ref=toolbox&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Plus-HD-2.3 - {11111111-1111-1111-1111-110311341126} - C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-bho.dll (Plus HD)
BHO-x32: iminent Helper Object - {112BA211-334C-4A90-90EC-2AD1CDAB287C} - C:\Program Files (x86)\IminentToolbar\1.8.25.0\bh\iminent.dll (Iminent)
BHO-x32: WebConnect - {2316c625-b487-4410-a1a5-ff040b65245f} - C:\Program Files (x86)\WebConnect\WebConnectbho.dll (Web Connect)
BHO-x32: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Iminent.WebBooster.InternetExplorer.dll (Iminent)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll (Delta-search.com)
BHO-x32: BonanzaDeals - {fe063412-bea4-4d76-8ed3-183be6220d17} - C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll (BonanzaDeals)
Toolbar: HKLM-x32 - Iminent Toolbar - {1FAFD711-ABF9-4F6A-8130-5166C7371427} - C:\Program Files (x86)\IminentToolbar\1.8.25.0\iminentTlbr.dll (Iminent)
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll (Delta-search.com)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default
FF user.js: detected! => C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\user.js
FF NewTab: hxxp://start.iminent.com/?ref=NewTab&appId=3E4C8CCD-C0E5-4EA8-8D2E-0969BD4E1AE2
FF DefaultSearchEngine: delta-homes
FF SearchEngineOrder.1: qvo6
FF SelectedSearchEngine: delta-homes
FF Homepage: hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP7836C6A9-B298-4FE3-9AEE-AE38E3EB475B
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\searchplugins\iminent.xml
FF Extension: No Name - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\7125a285-7e68-47aa-9d72-e81874f4d47e@d3fcdb92-135d-4a8a-8cf6-11e3b57c5fda.com
FF Extension: Delta Toolbar - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\ffxtlbr@delta.com
FF Extension: Iminent Toolbar - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\ffxtlbr@iminent.com
FF Extension: WebConnect - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox@webconnect.co
FF Extension: BonanzaDeals - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}
FF Extension: firefox-hotfix - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox-hotfix@mozilla.org.xpi
FF Extension: firefox - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox@webconnect.co.xpi
FF Extension: webbooster - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\webbooster@iminent.com.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Programme\Mozilla Firefox\firefox.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197641
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: () - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo\1.1.5.2
CHR Extension: (Plus-HD-2.3) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Petra\AppData\Roaming\BabSolution\CR\Delta.crx
CHR HKLM-x32\...\Chrome\Extension: [ieadcoanfjloocmfafkebdnfefmohngj] - C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.crx
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - \User Data\Default\Extensions\newtab.crx
CHR HKLM-x32\...\Chrome\Extension: [pkhojieggfgllhllcegoffdcnmdeojgb] - C:\Program Files (x86)\IminentToolbar\1.8.25.0\iminent.crx
==================== Services (Whitelisted) =================
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-20] (Just Develop It)
S2 BitGuard; C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [2845152 2013-09-10] ()
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-09-26] (BonanzaDeals)
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-09-26] (BonanzaDeals)
S2 Brother XP spl Service; C:\Windows\SysWOW64\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
S2 CltMngSvc; C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe [1752352 2013-09-17] (Conduit)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
S2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [794272 2012-08-21] (PC Tools)
S2 SProtection; C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe [2868544 2013-08-07] (Iminent)
S2 Update WebConnect; C:\Program Files (x86)\WebConnect\updateWebConnect.exe [206632 2013-08-30] (WebConnect)
S2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [480376 2013-09-26] (Wsys Co., Ltd.)
==================== Drivers (Whitelisted) ====================
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2013-05-18] (Duplex Secure Ltd.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-27 17:25 - 2013-09-27 17:25 - 00000000 ____D C:\FRST
2013-09-27 17:24 - 2013-09-27 17:24 - 00000504 _____ C:\Users\Petra\Desktop\defogger_disable.log
2013-09-27 17:24 - 2013-09-27 17:24 - 00000020 _____ C:\Users\Petra\defogger_reenable
2013-09-27 17:20 - 2013-09-27 17:20 - 00377856 _____ C:\Users\Petra\Desktop\gmer_2.1.19163.exe
2013-09-27 17:19 - 2013-09-27 17:20 - 01953854 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2013-09-27 17:17 - 2013-09-27 17:17 - 00050477 _____ C:\Users\Petra\Desktop\Defogger.exe
2013-09-27 17:03 - 2013-09-27 17:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\eUpdate
2013-09-27 16:55 - 2013-09-27 16:56 - 00000000 ____D C:\Users\Petra\Desktop\studiveitsarah
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-26 21:09 - 2013-09-26 21:09 - 00000000 ____D C:\Windows\SysWOW64\SearchProtect
2013-09-26 15:18 - 2013-09-27 09:18 - 00000092 _____ C:\Users\Petra\AppData\Roaming\WB.CFG
2013-09-26 15:18 - 2013-09-27 09:18 - 00000005 _____ C:\Users\Petra\AppData\Roaming\WBPU-TTL.DAT
2013-09-26 14:55 - 2013-09-26 14:55 - 00004096 ____H C:\Users\Petra\AppData\Local\keyfile3.drm
2013-09-26 14:15 - 2013-09-26 14:15 - 00000000 ____D C:\Program Files\DivX
2013-09-26 14:14 - 2013-09-27 17:09 - 00000000 ____D C:\ProgramData\eSafe
2013-09-26 14:14 - 2013-09-26 14:14 - 00000000 ____D C:\User Data
2013-09-26 14:14 - 2013-09-26 14:13 - 00715038 _____ C:\Windows\unins000.exe
2013-09-26 14:14 - 2011-05-30 15:42 - 00255488 _____ C:\Windows\system32\xvidvfw.dll
2013-09-26 14:14 - 2011-05-30 15:42 - 00240640 _____ C:\Windows\SysWOW64\xvidvfw.dll
2013-09-26 14:14 - 2011-05-23 11:52 - 00153088 _____ C:\Windows\SysWOW64\xvid.ax
2013-09-26 14:14 - 2011-05-23 09:49 - 00173568 _____ C:\Windows\system32\xvid.ax
2013-09-26 14:14 - 2011-05-23 09:46 - 00645632 _____ C:\Windows\SysWOW64\xvidcore.dll
2013-09-26 14:14 - 2011-05-23 09:45 - 00696832 _____ C:\Windows\system32\xvidcore.dll
2013-09-26 14:13 - 2013-09-26 14:13 - 00000000 ____D C:\Program Files (x86)\WebConnect
2013-09-26 14:09 - 2013-09-27 17:08 - 00001198 _____ C:\Windows\Tasks\Plus-HD-2.3-codedownloader.job
2013-09-26 14:09 - 2013-09-27 17:08 - 00001194 _____ C:\Windows\Tasks\Plus-HD-2.3-updater.job
2013-09-26 14:09 - 2013-09-27 17:08 - 00001098 _____ C:\Windows\Tasks\Plus-HD-2.3-enabler.job
2013-09-26 14:09 - 2013-09-26 14:09 - 00004228 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-codedownloader
2013-09-26 14:09 - 2013-09-26 14:09 - 00004224 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-updater
2013-09-26 14:09 - 2013-09-26 14:09 - 00004128 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-enabler
2013-09-26 14:08 - 2013-09-27 17:04 - 00003118 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-09-26 14:08 - 2013-09-26 14:16 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:08 - 2013-09-26 14:08 - 00001201 _____ C:\Users\Public\Desktop\Advanced System Protector.lnk
2013-09-26 14:08 - 2013-09-26 14:08 - 00000000 ____D C:\ProgramData\Systweak
2013-09-26 14:08 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\Advanced System Protector
2013-09-26 14:08 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2013-09-26 14:07 - 2013-09-27 17:08 - 00001906 _____ C:\Windows\Tasks\Plus-HD-2.3-chromeinstaller.job
2013-09-26 14:07 - 2013-09-27 17:08 - 00001830 _____ C:\Windows\Tasks\Plus-HD-2.3-firefoxinstaller.job
2013-09-26 14:07 - 2013-09-27 17:08 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-26 14:07 - 2013-09-27 17:04 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-09-26 14:07 - 2013-09-27 16:12 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-26 14:07 - 2013-09-27 15:02 - 00000276 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-09-26 14:07 - 2013-09-27 08:28 - 00000284 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-09-26 14:07 - 2013-09-26 14:16 - 00000000 ____D C:\ProgramData\DivX
2013-09-26 14:07 - 2013-09-26 14:14 - 00003434 _____ C:\Windows\unins000.dat
2013-09-26 14:07 - 2013-09-26 14:14 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-26 14:07 - 2013-09-26 14:14 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-26 14:07 - 2013-09-26 14:14 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-26 14:07 - 2013-09-26 14:14 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-26 14:07 - 2013-09-26 14:09 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.3
2013-09-26 14:07 - 2013-09-26 14:08 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Systweak
2013-09-26 14:07 - 2013-09-26 14:07 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-26 14:07 - 2013-09-26 14:07 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-26 14:07 - 2013-09-26 14:07 - 00003386 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-26 14:07 - 2013-09-26 14:07 - 00003024 _____ C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2013-09-26 14:07 - 2013-09-26 14:07 - 00002868 _____ C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2013-09-26 14:07 - 2013-09-26 14:07 - 00001848 _____ C:\Users\Petra\Desktop\Search.lnk
2013-09-26 14:07 - 2013-09-26 14:07 - 00001050 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\BabSolution
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\BitGuard
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\RegClean Pro
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Delta
2013-09-26 14:07 - 2013-07-22 16:07 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2013-09-26 14:07 - 2012-02-26 16:47 - 00079360 _____ C:\Windows\SysWOW64\ff_vfw.dll
2013-09-26 14:07 - 2012-01-09 20:45 - 00178688 _____ C:\Windows\SysWOW64\unrar.dll
2013-09-26 14:07 - 2011-12-07 19:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll
2013-09-26 14:07 - 2011-12-07 19:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\lagarith.dll
2013-09-26 14:06 - 2013-09-26 14:06 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Babylon
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Local\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\ProgramData\Babylon
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-26 14:05 - 2013-09-27 16:18 - 00000292 _____ C:\Windows\Tasks\DigitalSite.job
2013-09-26 14:05 - 2013-09-26 14:18 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-26 14:05 - 2013-09-26 14:05 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DigitalSite
2013-09-26 14:04 - 2013-09-26 14:04 - 00678968 _____ C:\Users\Petra\Desktop\UltimateCodec.exe
2013-09-26 14:02 - 2013-09-26 14:02 - 00000635 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Iminent
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\ProgramData\Iminent
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Program Files (x86)\IminentToolbar
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Program Files (x86)\Iminent
2013-09-26 14:01 - 2013-09-26 14:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\NwDocx
2013-09-26 14:01 - 2013-09-26 14:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Docx2Rtf
2013-09-26 14:00 - 2013-09-26 14:00 - 00400736 _____ (Softonic ) C:\Users\Petra\Desktop\SoftonicDownloader_fuer_nw-docx-converter.exe
2013-09-25 17:47 - 2013-09-25 17:47 - 00001084 _____ C:\Musik - Verknüpfung.lnk
2013-09-23 13:55 - 2013-09-27 16:56 - 00000000 ____D C:\Users\Petra\Desktop\Bachelorordner
2013-09-23 10:20 - 2013-09-23 10:28 - 00000000 ____D C:\Users\Petra\Documents\Fax
2013-09-19 19:00 - 2013-09-26 20:18 - 00000418 _____ C:\Windows\SysWOW64\AppLog.log
2013-09-19 17:04 - 2013-09-27 17:08 - 00000284 _____ C:\Windows\Tasks\RMAutoUpdate.job
2013-09-19 17:04 - 2013-09-26 20:18 - 00000284 _____ C:\Windows\Tasks\RMSchedule.job
2013-09-19 17:04 - 2013-09-19 17:04 - 00002860 _____ C:\Windows\System32\Tasks\RMSchedule
2013-09-19 17:04 - 2013-09-19 17:04 - 00002520 _____ C:\Windows\System32\Tasks\RMAutoUpdate
2013-09-19 17:04 - 2013-09-19 17:04 - 00001194 _____ C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
2013-09-19 17:04 - 2012-08-21 14:44 - 00513696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml.dll
2013-09-19 17:04 - 2012-08-21 14:44 - 00041632 _____ C:\Windows\system32\CleanMFT64.exe
2013-09-19 17:04 - 2008-09-17 21:17 - 00658432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2013-09-19 17:04 - 2008-04-02 15:54 - 01101824 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBox210.ocx
2013-09-19 17:04 - 2008-04-02 15:53 - 00880640 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBox10.ocx
2013-09-19 17:04 - 2008-04-02 15:53 - 00212992 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBoxVB12.ocx
2013-09-19 17:03 - 2013-09-27 17:08 - 00000000 ____D C:\Program Files (x86)\PC Tools Registry Mechanic
2013-09-19 17:02 - 2013-09-26 21:09 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2013-09-19 17:02 - 2013-09-19 17:02 - 00000000 ____D C:\Users\Petra\AppData\Roaming\OpenCandy
2013-09-19 17:02 - 2013-09-19 17:02 - 00000000 ____D C:\Users\Petra\AppData\Local\SearchProtect
2013-09-19 17:01 - 2013-09-19 17:01 - 00001103 _____ C:\Users\Petra\Desktop\Screenshot Captor.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Windows\SysWOW64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Users\Petra\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\Documents\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\ProgramData\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-09-19 17:00 - 2013-09-26 14:08 - 00001087 _____ C:\Users\Petra\Desktop\MyPC Backup.lnk
2013-09-19 17:00 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-09-19 17:00 - 2013-09-19 17:00 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-09-19 17:00 - 2013-09-19 17:00 - 00000000 _____ C:\END
2013-09-18 22:08 - 2013-09-18 22:08 - 00094208 _____ (DivX, Inc.) C:\Windows\SysWOW64\dpl100.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-16 00:57 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-16 00:57 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-16 00:57 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-16 00:57 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-16 00:57 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-16 00:57 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-16 00:57 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-16 00:57 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-16 00:57 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-14 12:28 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-14 12:28 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-14 12:28 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-14 12:28 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-14 12:28 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-14 12:28 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-14 12:28 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-14 12:28 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-14 12:28 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-14 12:28 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-14 12:28 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-14 12:28 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-14 12:28 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-14 12:28 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-14 12:28 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-14 12:28 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-14 12:28 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-02 09:18 - 2013-09-02 09:18 - 214423597 _____ C:\Windows\MEMORY.DMP
2013-09-02 09:18 - 2013-09-02 09:18 - 00290728 _____ C:\Windows\Minidump\090213-9609-01.dmp
2013-09-02 09:18 - 2013-09-02 09:18 - 00000000 ____D C:\Windows\Minidump
==================== One Month Modified Files and Folders =======
2013-09-27 17:25 - 2013-09-27 17:25 - 00000000 ____D C:\FRST
2013-09-27 17:24 - 2013-09-27 17:24 - 00000504 _____ C:\Users\Petra\Desktop\defogger_disable.log
2013-09-27 17:24 - 2013-09-27 17:24 - 00000020 _____ C:\Users\Petra\defogger_reenable
2013-09-27 17:24 - 2013-05-18 21:42 - 00000000 ____D C:\Users\Petra
2013-09-27 17:20 - 2013-09-27 17:20 - 00377856 _____ C:\Users\Petra\Desktop\gmer_2.1.19163.exe
2013-09-27 17:20 - 2013-09-27 17:19 - 01953854 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2013-09-27 17:17 - 2013-09-27 17:17 - 00050477 _____ C:\Users\Petra\Desktop\Defogger.exe
2013-09-27 17:16 - 2011-04-12 09:43 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-09-27 17:16 - 2011-04-12 09:43 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-09-27 17:16 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-27 17:09 - 2013-09-26 14:14 - 00000000 ____D C:\ProgramData\eSafe
2013-09-27 17:08 - 2013-09-26 14:09 - 00001198 _____ C:\Windows\Tasks\Plus-HD-2.3-codedownloader.job
2013-09-27 17:08 - 2013-09-26 14:09 - 00001194 _____ C:\Windows\Tasks\Plus-HD-2.3-updater.job
2013-09-27 17:08 - 2013-09-26 14:09 - 00001098 _____ C:\Windows\Tasks\Plus-HD-2.3-enabler.job
2013-09-27 17:08 - 2013-09-26 14:07 - 00001906 _____ C:\Windows\Tasks\Plus-HD-2.3-chromeinstaller.job
2013-09-27 17:08 - 2013-09-26 14:07 - 00001830 _____ C:\Windows\Tasks\Plus-HD-2.3-firefoxinstaller.job
2013-09-27 17:08 - 2013-09-26 14:07 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-27 17:08 - 2013-09-19 17:04 - 00000284 _____ C:\Windows\Tasks\RMAutoUpdate.job
2013-09-27 17:08 - 2013-09-19 17:03 - 00000000 ____D C:\Program Files (x86)\PC Tools Registry Mechanic
2013-09-27 17:08 - 2013-05-21 15:22 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-27 17:08 - 2013-05-18 23:44 - 00000380 _____ C:\Windows\Tasks\QIPdater 2012.job
2013-09-27 17:08 - 2013-05-18 21:57 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-27 17:08 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-27 17:08 - 2009-07-14 06:51 - 00036594 _____ C:\Windows\setupact.log
2013-09-27 17:05 - 2013-05-18 23:37 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Skype
2013-09-27 17:04 - 2013-09-26 14:08 - 00003118 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-09-27 17:04 - 2013-09-26 14:07 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-09-27 17:03 - 2013-09-27 17:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\eUpdate
2013-09-27 16:57 - 2013-05-18 21:41 - 01618519 _____ C:\Windows\WindowsUpdate.log
2013-09-27 16:56 - 2013-09-27 16:55 - 00000000 ____D C:\Users\Petra\Desktop\studiveitsarah
2013-09-27 16:56 - 2013-09-23 13:55 - 00000000 ____D C:\Users\Petra\Desktop\Bachelorordner
2013-09-27 16:38 - 2013-05-18 22:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-27 16:33 - 2013-05-21 15:22 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-27 16:18 - 2013-09-26 14:05 - 00000292 _____ C:\Windows\Tasks\DigitalSite.job
2013-09-27 16:12 - 2013-09-26 14:07 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-27 15:02 - 2013-09-26 14:07 - 00000276 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-09-27 14:00 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-27 14:00 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-27 09:39 - 2013-05-18 22:16 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8FB5B23C-B447-421A-B575-2FEED7F03542}
2013-09-27 09:18 - 2013-09-26 15:18 - 00000092 _____ C:\Users\Petra\AppData\Roaming\WB.CFG
2013-09-27 09:18 - 2013-09-26 15:18 - 00000005 _____ C:\Users\Petra\AppData\Roaming\WBPU-TTL.DAT
2013-09-27 08:37 - 2009-07-14 06:45 - 00307312 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-27 08:28 - 2013-09-26 14:07 - 00000284 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-09-27 08:28 - 2010-11-21 05:47 - 00007664 _____ C:\Windows\PFRO.log
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-26 21:09 - 2013-09-26 21:09 - 00000000 ____D C:\Windows\SysWOW64\SearchProtect
2013-09-26 21:09 - 2013-09-19 17:02 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2013-09-26 20:18 - 2013-09-19 19:00 - 00000418 _____ C:\Windows\SysWOW64\AppLog.log
2013-09-26 20:18 - 2013-09-19 17:04 - 00000284 _____ C:\Windows\Tasks\RMSchedule.job
2013-09-26 14:55 - 2013-09-26 14:55 - 00004096 ____H C:\Users\Petra\AppData\Local\keyfile3.drm
2013-09-26 14:28 - 2013-05-18 22:02 - 00065552 _____ C:\Users\Petra\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-26 14:18 - 2013-09-26 14:05 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-26 14:16 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:16 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\DivX
2013-09-26 14:16 - 2013-05-18 23:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-09-26 14:16 - 2013-05-18 22:06 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-26 14:15 - 2013-09-26 14:15 - 00000000 ____D C:\Program Files\DivX
2013-09-26 14:14 - 2013-09-26 14:14 - 00000000 ____D C:\User Data
2013-09-26 14:14 - 2013-09-26 14:07 - 00003434 _____ C:\Windows\unins000.dat
2013-09-26 14:14 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-26 14:14 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-26 14:14 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-26 14:14 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-26 14:14 - 2013-05-18 22:06 - 00001156 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-26 14:14 - 2013-05-18 21:42 - 00001727 _____ C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-26 14:13 - 2013-09-26 14:14 - 00715038 _____ C:\Windows\unins000.exe
2013-09-26 14:13 - 2013-09-26 14:13 - 00000000 ____D C:\Program Files (x86)\WebConnect
2013-09-26 14:09 - 2013-09-26 14:09 - 00004228 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-codedownloader
2013-09-26 14:09 - 2013-09-26 14:09 - 00004224 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-updater
2013-09-26 14:09 - 2013-09-26 14:09 - 00004128 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-enabler
2013-09-26 14:09 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.3
2013-09-26 14:08 - 2013-09-26 14:08 - 00001201 _____ C:\Users\Public\Desktop\Advanced System Protector.lnk
2013-09-26 14:08 - 2013-09-26 14:08 - 00000000 ____D C:\ProgramData\Systweak
2013-09-26 14:08 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\Advanced System Protector
2013-09-26 14:08 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Systweak
2013-09-26 14:08 - 2013-09-19 17:00 - 00001087 _____ C:\Users\Petra\Desktop\MyPC Backup.lnk
2013-09-26 14:08 - 2013-09-19 17:00 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-09-26 14:07 - 2013-09-26 14:07 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-26 14:07 - 2013-09-26 14:07 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-26 14:07 - 2013-09-26 14:07 - 00003386 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-26 14:07 - 2013-09-26 14:07 - 00003024 _____ C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2013-09-26 14:07 - 2013-09-26 14:07 - 00002868 _____ C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2013-09-26 14:07 - 2013-09-26 14:07 - 00001848 _____ C:\Users\Petra\Desktop\Search.lnk
2013-09-26 14:07 - 2013-09-26 14:07 - 00001050 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\BabSolution
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\BitGuard
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\RegClean Pro
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Delta
2013-09-26 14:06 - 2013-09-26 14:06 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Babylon
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Local\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\ProgramData\Babylon
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-26 14:05 - 2013-09-26 14:05 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DigitalSite
2013-09-26 14:04 - 2013-09-26 14:04 - 00678968 _____ C:\Users\Petra\Desktop\UltimateCodec.exe
2013-09-26 14:03 - 2013-09-26 14:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\NwDocx
2013-09-26 14:03 - 2013-09-26 14:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Docx2Rtf
2013-09-26 14:02 - 2013-09-26 14:02 - 00000635 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Iminent
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\ProgramData\Iminent
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Program Files (x86)\IminentToolbar
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Program Files (x86)\Iminent
2013-09-26 14:02 - 2013-05-21 15:22 - 00000000 ____D C:\Users\Petra\AppData\Local\Google
2013-09-26 14:00 - 2013-09-26 14:00 - 00400736 _____ (Softonic ) C:\Users\Petra\Desktop\SoftonicDownloader_fuer_nw-docx-converter.exe
2013-09-26 09:20 - 2013-05-20 12:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-26 09:20 - 2013-05-18 23:37 - 00000000 ____D C:\ProgramData\Skype
2013-09-25 17:47 - 2013-09-25 17:47 - 00001084 _____ C:\Musik - Verknüpfung.lnk
2013-09-23 10:28 - 2013-09-23 10:20 - 00000000 ____D C:\Users\Petra\Documents\Fax
2013-09-23 10:20 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-22 18:38 - 2013-05-18 22:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-22 18:38 - 2013-05-18 22:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-22 18:38 - 2013-05-18 22:20 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-19 17:04 - 2013-09-19 17:04 - 00002860 _____ C:\Windows\System32\Tasks\RMSchedule
2013-09-19 17:04 - 2013-09-19 17:04 - 00002520 _____ C:\Windows\System32\Tasks\RMAutoUpdate
2013-09-19 17:04 - 2013-09-19 17:04 - 00001194 _____ C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
2013-09-19 17:02 - 2013-09-19 17:02 - 00000000 ____D C:\Users\Petra\AppData\Roaming\OpenCandy
2013-09-19 17:02 - 2013-09-19 17:02 - 00000000 ____D C:\Users\Petra\AppData\Local\SearchProtect
2013-09-19 17:01 - 2013-09-19 17:01 - 00001103 _____ C:\Users\Petra\Desktop\Screenshot Captor.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Windows\SysWOW64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Users\Petra\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\Documents\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\ProgramData\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-09-19 17:00 - 2013-09-19 17:00 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-09-19 17:00 - 2013-09-19 17:00 - 00000000 _____ C:\END
2013-09-19 17:00 - 2013-05-18 21:42 - 00000000 ___RD C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-18 22:08 - 2013-09-18 22:08 - 00094208 _____ (DivX, Inc.) C:\Windows\SysWOW64\dpl100.dll
2013-09-15 03:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-15 03:23 - 2013-05-18 21:42 - 00000000 ___RD C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-15 03:06 - 2013-08-14 18:52 - 00000000 ____D C:\Windows\system32\MRT
2013-09-15 03:05 - 2013-05-18 22:27 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-03 14:10 - 2013-08-04 11:52 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-09-02 09:18 - 2013-09-02 09:18 - 214423597 _____ C:\Windows\MEMORY.DMP
2013-09-02 09:18 - 2013-09-02 09:18 - 00290728 _____ C:\Windows\Minidump\090213-9609-01.dmp
2013-09-02 09:18 - 2013-09-02 09:18 - 00000000 ____D C:\Windows\Minidump
2013-08-29 13:21 - 2013-08-26 12:27 - 00101386 _____ C:\Users\Petra\Desktop\Ausgabe1.spv
2013-08-29 13:20 - 2013-08-26 12:07 - 00000000 ____D C:\Users\Petra\Dokumente
Some content of TEMP:
====================
C:\Users\Petra\AppData\Local\Temp\BackupSetup.exe
C:\Users\Petra\AppData\Local\Temp\Gw2.exe
C:\Users\Petra\AppData\Local\Temp\IminentSetup-1-.exe
C:\Users\Petra\AppData\Local\Temp\nsl888.exe
C:\Users\Petra\AppData\Local\Temp\nspBAA5.exe
C:\Users\Petra\AppData\Local\Temp\nswB38.exe
C:\Users\Petra\AppData\Local\Temp\nsyB823.exe
C:\Users\Petra\AppData\Local\Temp\nvStInst.exe
C:\Users\Petra\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Petra\AppData\Local\Temp\SPSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-22 18:53
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-09-2013
Ran by Petra at 2013-09-27 17:26:17
Running from C:\Users\Petra\Desktop
Boot Mode: Safe Mode (with Networking)
==========================================================
==================== Security Center ========================
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
Adobe AIR (x32 Version: 3.7.0.1860)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.175)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Advanced System Protector (x32 Version: 2.1.1000.10905)
Ashampoo Burning Studio 2010 Advanced (x32 Version: 9.2.4)
BitGuard (x32)
Bonanza Deals (remove only) (x32 Version: 5.0.1.0)
Brother MFL-Pro Suite DCP-315CN (x32 Version: 1.0.1.0)
Cheat Engine 6.3 (x32)
Codec Pack Packages (HKCU)
Content Manager 2 (x32 Version: 2.0.4.59)
DC-Bass Source 1.3.0 (x32)
Delta Chrome Toolbar (x32)
Delta toolbar (x32 Version: 1.8.24.6)
DirectVobSub 2.40.4209 (x32 Version: 2.40.4209)
DivX-Setup (x32 Version: 2.6.1.8)
Dropbox (HKCU Version: 2.0.22)
EasyBCD 2.1 (x32 Version: 2.1)
Europa Universalis IV (x32)
ffdshow v1.1.4399 [2012-03-22] (x32 Version: 1.1.4399.0)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
Guild Wars 2 (x32)
Haali Media Splitter (x32)
Iminent (x32 Version: 6.37.21.0)
Iminent Toolbar on IE and Chrome (x32 Version: 1.8.25.0)
IrfanView (remove only) (x32 Version: 4.32)
Java 7 Update 9 (64-bit) (Version: 7.0.90)
Lagarith Lossless Codec (1.3.27) (x32)
LAME v3.99.3 (for Windows) (x32)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0)
Microsoft Security Client (Version: 4.3.0215.0)
Microsoft Security Essentials (Version: 4.3.215.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106)
Mozilla Firefox 18.0.1 (x86 de) (x32 Version: 18.0.1)
Mozilla Maintenance Service (x32 Version: 18.0.1)
Mozilla Thunderbird 11.0.1 (x86 de) (x32 Version: 11.0.1)
MyPC Backup (Version: )
Naviextras Toolbox Prerequesities (x32 Version: 1.0.0)
NVIDIA 3D Vision Controller-Treiber 314.07 (Version: 314.07)
NVIDIA 3D Vision Treiber 314.07 (Version: 314.07)
NVIDIA Grafiktreiber 314.07 (Version: 314.07)
NVIDIA Install Application (Version: 2.1002.109.706)
NVIDIA PhysX (x32 Version: 9.12.1031)
NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1407)
NVIDIA Systemsteuerung 314.07 (Version: 314.07)
NVIDIA Update 1.12.12 (Version: 1.12.12)
NVIDIA Update Components (Version: 1.12.12)
OpenSource Flash Video Splitter 1.0.0.5 (x32 Version: 1.0.0.5)
Opera 12.16 (x32 Version: 12.16.1860)
PASW Statistics 18 (x32 Version: 18.0.0)
PC Tools Registry Mechanic 11.1 (x32 Version: 11.1)
Plus-HD-2.3 (x32 Version: 1.27.153.8)
QIP 2012 7058 Jeak-Edition (x32 Version: 4.0.7058)
Realtek Ethernet Controller Driver (x32 Version: 1.00.0008)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5919)
RegClean Pro (x32 Version: 6.21)
Screenshot Captor 3.08.01 (x32)
Search Protect (x32 Version: 2.7.10.19)
Skype™ 6.7 (x32 Version: 6.7.102)
Steam (x32 Version: 1.0.0.0)
TeamSpeak 3 Client (Version: 3.0.11.1)
Update for Codec Pack (HKCU)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
VLC media player 2.0.6 (Version: 2.0.6)
WebConnect 3.0.0 (Version: 3.0.0)
WinRAR 4.00 (64-Bit) (Version: 4.00.0)
Xvid Video Codec (x32 Version: 1.3.2)
==================== Restore Points =========================
26-08-2013 10:01:31 Installed PASW Statistics 18.
26-08-2013 10:22:05 Installed PASW Statistics 18.
27-08-2013 08:32:01 Windows Update
27-08-2013 10:53:19 Windows Update
02-09-2013 07:30:16 Windows Update
14-09-2013 10:23:45 Windows Update
15-09-2013 01:00:23 Windows Update
15-09-2013 22:57:32 Windows Update
17-09-2013 08:49:55 Windows Update
22-09-2013 16:35:00 Windows Update
25-09-2013 18:31:26 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {050C6B2C-EF80-4048-A6FC-36DC16CB05BE} - System32\Tasks\Plus-HD-2.3-firefoxinstaller => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-firefoxinstaller.exe [2013-09-26] (Plus HD)
Task: {1B2F0B73-E099-4EC1-BA84-A4D425E67757} - System32\Tasks\Plus-HD-2.3-enabler => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-enabler.exe [2013-09-26] (Plus HD)
Task: {1D02E449-23BC-4B35-93E4-80DA6426F53D} - System32\Tasks\QIPdater 2012 => C:\Program Files (x86)\QIP 2012 Jeak-Edition\qipdater.exe [2012-01-02] (Caphyon LTD)
Task: {1E8AE278-3CF7-4946-9CB0-060EB4B6FD7B} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-09-26] (BonanzaDeals)
Task: {3CAF173B-B976-4A86-B0FA-89080A5249B4} - System32\Tasks\User_Feed_Synchronization-{8FB5B23C-B447-421A-B575-2FEED7F03542} => C:\Windows\system32\msfeedssync.exe [2013-05-18] (Microsoft Corporation)
Task: {46E57ED1-6D31-4291-9905-0EFB823A4332} - System32\Tasks\RMSchedule => C:\Program Files (x86)\PC Tools Registry Mechanic\RegMech.exe [2012-08-21] (PC Tools)
Task: {4DC3F95D-5211-4614-9B2C-C105BEC1F1C7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-22] (Adobe Systems Incorporated)
Task: {5B29DF5E-3284-4D7B-9E37-0FAC216E895A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-21] (Google Inc.)
Task: {6ED464C5-ABF7-4E4F-B2A0-2C4CB4D3F5FF} - System32\Tasks\Plus-HD-2.3-updater => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-updater.exe [2013-09-26] (Plus HD)
Task: {7D945C31-1BC4-4DBB-A320-1E415A50C4E8} - System32\Tasks\Plus-HD-2.3-chromeinstaller => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-chromeinstaller.exe [2013-09-26] (Plus HD)
Task: {801D1F0C-8AF4-41EA-80F8-3E652E50CFDE} - System32\Tasks\EPUpdater => C:\Users\Petra\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-08-04] ()
Task: {864AB93C-027D-4DCF-853B-E0E9DF1ACCF3} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-09-26] (BonanzaDeals)
Task: {91EBA03B-ADF1-4247-890F-D98513F65FEC} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc)
Task: {A3BC11E4-92F1-464B-BB95-40937A6D2A08} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc)
Task: {AA11DCE1-5A66-4E33-B0E4-21133ED57E4F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-21] (Google Inc.)
Task: {C2F01A47-081D-4B38-B21B-FC782537701B} - System32\Tasks\Advanced System Protector_startup => C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe [2013-05-24] (Systweak)
Task: {C6873381-AFFB-4B43-88C4-A41B0A3C79DA} - System32\Tasks\BonanzaDealsUpdate => C:\Program
Task: {C7F06C02-37E0-48F8-AC96-5AF8A959C460} - System32\Tasks\Plus-HD-2.3-codedownloader => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-codedownloader.exe [2013-09-26] (Plus HD)
Task: {D1BEBF01-CFFE-4C23-A158-B0D5D0C8F57D} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc)
Task: {DA1D3ADB-EA03-4C5A-A891-5FA8802367BD} - System32\Tasks\RMAutoUpdate => C:\Program Files (x86)\PC Tools Registry Mechanic\SULauncher.exe [2012-08-21] (PC Tools)
Task: {DDCF17BA-309D-4568-9BEB-640674385D63} - System32\Tasks\DigitalSite => C:\Users\Petra\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe [2013-04-12] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe
Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe
Task: C:\Windows\Tasks\DigitalSite.job => C:\Users\Petra\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Plus-HD-2.3-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-chromeinstaller.exe
Task: C:\Windows\Tasks\Plus-HD-2.3-codedownloader.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-codedownloader.exe
Task: C:\Windows\Tasks\Plus-HD-2.3-enabler.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-enabler.exe
Task: C:\Windows\Tasks\Plus-HD-2.3-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-firefoxinstaller.exe
Task: C:\Windows\Tasks\Plus-HD-2.3-updater.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-updater.exe
Task: C:\Windows\Tasks\QIPdater 2012.job => C:\Program Files (x86)\QIP 2012 Jeak-Edition\qipdater.exe
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: C:\Windows\Tasks\RMAutoUpdate.job => C:\Program Files (x86)\PC Tools Registry Mechanic\SULauncher.exe
Task: C:\Windows\Tasks\RMSchedule.job => C:\Program Files (x86)\PC Tools Registry Mechanic\RegMech.exe
==================== Loaded Modules (whitelisted) =============
2011-12-28 15:27 - 2011-12-28 15:27 - 02523600 _____ () C:\Program Files (x86)\QIP 2012 Jeak-Edition\Protos\InfICQ\InfICQ.dll
2011-12-28 15:27 - 2011-12-28 15:27 - 01641424 _____ () C:\Program Files (x86)\QIP 2012 Jeak-Edition\Protos\MRA\MRA.dll
2011-12-28 15:27 - 2011-12-28 15:27 - 00049104 _____ () C:\Program Files (x86)\QIP 2012 Jeak-Edition\Protos\MRA\pics.dll
2011-12-28 15:27 - 2011-12-28 15:27 - 00958416 _____ () C:\Program Files (x86)\QIP 2012 Jeak-Edition\Protos\Social\Social.dll
2011-12-28 15:27 - 2011-12-28 15:27 - 04659664 _____ () C:\Program Files (x86)\QIP 2012 Jeak-Edition\Core\voip.dll
2013-05-18 22:06 - 2013-01-16 22:09 - 03022232 _____ () C:\Programme\Mozilla Firefox\mozjs.dll
2013-09-14 14:08 - 2013-09-14 14:08 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"
==================== Faulty Device Manager Devices =============
Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: sptd
Description: sptd
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: sptd
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/27/2013 05:12:37 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 05:10:54 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (09/27/2013 05:04:29 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 01:43:27 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 01:39:27 PM) (Source: Brother BrLog) (User: )
Description: CTLCN BrtCTLCN: [2013/09/27 13:39:27.268]: [00003308]: brccMCtl.exe: ErrorMessage.cpp (0241) : -------- error code is [0x03031f04].
Error: (09/27/2013 01:39:27 PM) (Source: Brother BrLog) (User: )
Description: CTLCN BrtCTLCN: [2013/09/27 13:39:27.234]: [00003308]: brccFCtl.dll: ### ERROR ### Scanning-Image Failed! lErrCode = 0x3031F04
Error: (09/27/2013 01:37:52 PM) (Source: Brother BrLog) (User: )
Description: TWN BrtTWN: [2013/09/27 13:37:52.028]: [00003308]: ##### TIME-OUT occurred! #####
Error: (09/27/2013 09:02:15 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 08:45:27 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: RegCleanPro.exe, Version: 6.21.65.2745, Zeitstempel: 0x51ed0b3b
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xab0
Startzeit der fehlerhaften Anwendung: 0xRegCleanPro.exe0
Pfad der fehlerhaften Anwendung: RegCleanPro.exe1
Pfad des fehlerhaften Moduls: RegCleanPro.exe2
Berichtskennung: RegCleanPro.exe3
Error: (09/26/2013 03:55:44 PM) (Source: Application Hang) (User: )
Description: Programm WINWORD.EXE, Version 11.0.8406.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1374
Startzeit: 01cebab5d47ccea5
Endzeit: 6
Anwendungspfad: C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE
Berichts-ID: 5281055c-26b3-11e3-8f10-bc5ff413e132
System errors:
=============
Error: (09/27/2013 05:25:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:22:24 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Microsoft Office Sessions:
=========================
Error: (09/27/2013 05:12:37 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 05:10:54 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Petra\Desktop\SoftonicDownloader_fuer_nw-docx-converter.exe
Error: (09/27/2013 05:04:29 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 01:43:27 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 01:39:27 PM) (Source: Brother BrLog)(User: )
Description: CTLCNBrtCTLCN: [2013/09/27 13:39:27.268]: [00003308]: brccMCtl.exe: ErrorMessage.cpp (0241) : -------- error code is [0x03031f04].
Error: (09/27/2013 01:39:27 PM) (Source: Brother BrLog)(User: )
Description: CTLCNBrtCTLCN: [2013/09/27 13:39:27.234]: [00003308]: brccFCtl.dll: ### ERROR ### Scanning-Image Failed! lErrCode = 0x3031F04
Error: (09/27/2013 01:37:52 PM) (Source: Brother BrLog)(User: )
Description: TWNBrtTWN: [2013/09/27 13:37:52.028]: [00003308]: ##### TIME-OUT occurred! #####
Error: (09/27/2013 09:02:15 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 08:45:27 AM) (Source: Application Error)(User: )
Description: RegCleanPro.exe6.21.65.274551ed0b3bunknown0.0.0.000000000c000000500000000ab001cebb4c09611853C:\Program Files (x86)\RegClean Pro\RegCleanPro.exeunknown64121238-2740-11e3-b5ba-bc5ff413e132
Error: (09/26/2013 03:55:44 PM) (Source: Application Hang)(User: )
Description: WINWORD.EXE11.0.8406.0137401cebab5d47ccea56C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE5281055c-26b3-11e3-8f10-bc5ff413e132
==================== Memory info ===========================
Percentage of memory in use: 36%
Total physical RAM: 2047.3 MB
Available physical RAM: 1297.54 MB
Total Pagefile: 4094.61 MB
Available Pagefile: 3397.39 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.69 GB) (Free:41.56 GB) NTFS
Drive d: () (Fixed) (Total:232.88 GB) (Free:53.85 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: B79F6CE0)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 233 GB) (Disk ID: 51235122)
Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-27 17:32:21
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T1L0-5 Samsung_SSD_840_Series rev.DXT07B0Q 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Petra\AppData\Local\Temp\uxldapob.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF6 0x31 0xAB 0x0D ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x40 0x01 0x05 0xC6 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xBC 0xB4 0x5E 0x5F ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF6 0x31 0xAB 0x0D ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x40 0x01 0x05 0xC6 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xBC 0xB4 0x5E 0x5F ...
---- EOF - GMER 2.1 ----
|
|
27.09.2013, 17:09
| #2 | |
| /// the machine /// TB-Ausbilder    | Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
27.09.2013, 17:40
| #3 |
| | Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen Hallo und danke,
__________________hier der combofix. Es kam, obwohl der virenscanner auswar die meldung in combofix, habe es dann einfach trotzdem gestartet und ging ok, kam auch keine Meldung wegen reg-schlüssel... Grüße pesavei Code:
ATTFilter ComboFix 13-09-26.03 - Petra 27.09.2013 18:21:58.1.2 - x64 NETWORK
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.2047.1289 [GMT 2:00]
ausgeführt von:: c:\users\Petra\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\program files (x86)\Delta\delta\1.8.24.6\bh\delta.dll
c:\program files (x86)\Delta\delta\1.8.24.6\deltaApp.dll
c:\program files (x86)\Delta\delta\1.8.24.6\deltaEng.dll
c:\program files (x86)\Delta\delta\1.8.24.6\deltasrv.exe
c:\program files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll
c:\programdata\DSearchLink
c:\programdata\DSearchLink\DSearchLink.exe
c:\users\Petra\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage
c:\users\Petra\Desktop\Search.lnk
c:\windows\SysWow64\lsprst7.dll
D:\install.exe
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_WsysSvc
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-08-27 bis 2013-09-27 ))))))))))))))))))))))))))))))
.
.
2013-09-27 15:25 . 2013-09-27 15:25 -------- d-----w- C:\FRST
2013-09-27 15:03 . 2013-09-27 15:03 -------- d-----w- c:\users\Petra\AppData\Roaming\eUpdate
2013-09-27 07:05 . 2013-09-05 05:32 9694160 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7E1F8CAE-3A12-4F03-B647-91A92F0B11E5}\mpengine.dll
2013-09-26 22:32 . 2013-09-26 22:32 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-09-26 22:32 . 2013-09-26 22:32 -------- d-----w- c:\windows\SysWow64\Extensions
2013-09-26 19:09 . 2013-09-26 19:09 -------- d-----w- c:\windows\SysWow64\SearchProtect
2013-09-26 12:15 . 2013-09-26 12:15 -------- d-----w- c:\program files\DivX
2013-09-26 12:14 . 2013-09-27 15:09 -------- d-----w- c:\programdata\eSafe
2013-09-26 12:14 . 2013-09-26 12:16 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared
2013-09-26 12:14 . 2011-05-30 13:42 255488 ----a-w- c:\windows\system32\xvidvfw.dll
2013-09-26 12:14 . 2011-05-23 07:45 696832 ----a-w- c:\windows\system32\xvidcore.dll
2013-09-26 12:14 . 2011-05-30 13:42 240640 ----a-w- c:\windows\SysWow64\xvidvfw.dll
2013-09-26 12:07 . 2012-01-09 18:45 178688 ----a-w- c:\windows\SysWow64\unrar.dll
2013-09-26 12:06 . 2013-09-26 12:06 -------- d-----w- c:\users\Petra\AppData\Local\BonanzaDealsLive
2013-09-26 12:06 . 2013-09-26 12:06 -------- d-----w- c:\programdata\BonanzaDealsLive
2013-09-26 12:06 . 2013-09-26 12:06 -------- d-----w- c:\program files (x86)\BonanzaDeals
2013-09-26 12:06 . 2013-09-26 12:06 -------- d-----w- c:\users\Petra\AppData\Roaming\Babylon
2013-09-26 12:06 . 2013-09-26 12:06 -------- d-----w- c:\programdata\Babylon
2013-09-26 12:05 . 2013-09-26 12:05 -------- d-----w- c:\users\Petra\AppData\Roaming\DigitalSite
2013-09-26 12:02 . 2013-09-26 12:02 -------- d-----w- c:\users\Petra\AppData\Roaming\Iminent
2013-09-26 12:02 . 2013-09-26 12:02 -------- d-----w- c:\programdata\Iminent
2013-09-26 12:02 . 2013-09-26 12:02 -------- d-----w- c:\program files (x86)\Common Files\Umbrella
2013-09-26 12:02 . 2013-09-26 12:02 -------- d-----w- c:\program files (x86)\Iminent
2013-09-26 12:01 . 2013-09-26 12:03 -------- d-----w- c:\users\Petra\AppData\Roaming\NwDocx
2013-09-26 12:01 . 2013-09-26 12:03 -------- d-----w- c:\users\Petra\AppData\Roaming\Docx2Rtf
2013-09-25 18:31 . 2013-09-05 05:32 9694160 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-09-19 15:04 . 2012-08-21 12:44 513696 ----a-w- c:\windows\SysWow64\msxml.dll
2013-09-19 15:04 . 2012-08-21 12:44 41632 ----a-w- c:\windows\system32\CleanMFT64.exe
2013-09-19 15:04 . 2008-09-17 19:17 658432 ----a-w- c:\windows\SysWow64\MSCOMCT2.OCX
2013-09-19 15:04 . 2008-04-02 13:54 1101824 ----a-w- c:\windows\SysWow64\UniBox210.ocx
2013-09-19 15:04 . 2008-04-02 13:53 212992 ----a-w- c:\windows\SysWow64\UniBoxVB12.ocx
2013-09-19 15:04 . 2008-04-02 13:53 880640 ----a-w- c:\windows\SysWow64\UniBox10.ocx
2013-09-19 15:03 . 2013-09-19 15:03 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2013-09-19 15:03 . 2013-09-27 16:25 -------- d-----w- c:\program files (x86)\PC Tools Registry Mechanic
2013-09-19 15:02 . 2013-09-19 15:02 -------- d-----w- c:\users\Petra\AppData\Roaming\OpenCandy
2013-09-19 15:02 . 2013-09-26 19:09 -------- d-----w- c:\program files (x86)\SearchProtect
2013-09-19 15:02 . 2013-09-19 15:02 -------- d-----w- c:\users\Petra\AppData\Local\SearchProtect
2013-09-19 15:01 . 2013-09-19 15:01 -------- d-----w- c:\users\Petra\AppData\Roaming\DonationCoder
2013-09-19 15:01 . 2013-09-19 15:01 -------- d-----w- c:\program files (x86)\ScreenshotCaptor
2013-09-19 15:01 . 2013-09-19 15:01 -------- d-----w- c:\programdata\DonationCoder
2013-09-19 15:00 . 2013-09-26 12:08 -------- d-----w- c:\program files (x86)\MyPC Backup
2013-09-18 20:08 . 2013-09-18 20:08 94208 ----a-w- c:\windows\SysWow64\dpl100.dll
2013-09-17 08:46 . 2013-09-17 08:46 -------- d-----w- c:\users\Petra\AppData\Local\ElevatedDiagnostics
2013-09-14 10:28 . 2013-08-05 02:25 155584 ----a-w- c:\windows\system32\drivers\ataport.sys
2013-09-14 10:24 . 2013-09-14 10:23 965008 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EC3EFF82-58D2-43E0-A0D5-B2FD4C42F82D}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-22 16:38 . 2013-05-18 20:20 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-22 16:38 . 2013-05-18 20:20 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-15 01:05 . 2013-05-18 20:27 79143768 ----a-w- c:\windows\system32\MRT.exe
2013-08-26 09:13 . 2013-08-26 09:13 354656 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
2013-08-22 17:25 . 2013-05-19 10:58 941720 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-08-04 11:50 . 2013-08-04 11:50 21840 ----atw- c:\windows\SysWow64\SIntfNT.dll
2013-08-04 11:50 . 2013-08-04 11:50 17212 ----atw- c:\windows\SysWow64\SIntf32.dll
2013-08-04 11:50 . 2013-08-04 11:50 12067 ----atw- c:\windows\SysWow64\SIntf16.dll
2013-08-02 01:48 . 2013-09-14 10:28 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-25 09:25 . 2013-08-14 15:29 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-25 08:57 . 2013-08-14 15:29 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-19 01:58 . 2013-08-14 15:29 2048 ----a-w- c:\windows\system32\tzres.dll
2013-07-19 01:41 . 2013-08-14 15:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-07-09 05:52 . 2013-08-14 15:29 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-07-09 05:51 . 2013-08-14 15:29 1217024 ----a-w- c:\windows\system32\rpcrt4.dll
2013-07-09 05:46 . 2013-08-14 15:29 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-07-09 05:46 . 2013-08-14 15:29 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-07-09 05:46 . 2013-08-14 15:29 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-07-09 04:52 . 2013-08-14 15:29 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2013-07-09 04:52 . 2013-08-14 15:29 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-07-09 04:46 . 2013-08-14 15:29 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-07-09 04:46 . 2013-08-14 15:29 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-07-09 04:46 . 2013-08-14 15:29 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-07-06 06:03 . 2013-08-14 15:29 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-01-16 20:10 . 2013-05-18 20:06 262552 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110311341126}]
2013-09-26 12:09 752488 ----a-w- c:\program files (x86)\Plus-HD-2.3\Plus-HD-2.3-bho.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{112BA211-334C-4A90-90EC-2AD1CDAB287C}]
2013-08-22 11:11 307608 ----a-w- c:\program files (x86)\IminentToolbar\1.8.25.0\bh\iminent.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{2316c625-b487-4410-a1a5-ff040b65245f}]
2013-08-30 02:16 149288 ----a-w- c:\program files (x86)\WebConnect\WebConnectBHO.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{fe063412-bea4-4d76-8ed3-183be6220d17}]
2013-08-21 17:36 100336 ----a-w- c:\program files (x86)\BonanzaDeals\BonanzaDealsIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{1FAFD711-ABF9-4F6A-8130-5166C7371427}"= "c:\program files (x86)\IminentToolbar\1.8.25.0\iminentTlbr.dll" [2013-08-22 293784]
.
[HKEY_CLASSES_ROOT\clsid\{1fafd711-abf9-4f6a-8130-5166c7371427}]
[HKEY_CLASSES_ROOT\iminent.iminentdskBnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[HKEY_CLASSES_ROOT\iminent.iminentdskBnd]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-07-25 20684656]
"Infium"="c:\program files (x86)\QIP 2012 Jeak-Edition\qip.exe" [2011-12-28 7318992]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-10 958576]
"SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2012-08-21 105120]
"Iminent"="c:\program files (x86)\Iminent\Iminent.exe" [2013-09-10 1074736]
"IminentMessenger"="c:\program files (x86)\Iminent\Iminent.Messengers.exe" [2013-09-10 884784]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-08-21 450560]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-08-29 1861968]
.
c:\users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MyPC Backup.lnk - c:\program files (x86)\MyPC Backup\MyPC Backup.exe [2013-9-20 1953320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll c:\progra~3\BitGuard\261673~1.238\{C16C1~1\BitGuard.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 BackupStack;Computer Backup (MyPC Backup);c:\program files (x86)\MyPC Backup\BackupStack.exe;c:\program files (x86)\MyPC Backup\BackupStack.exe [x]
R2 bonanzadealslive;BonanzaDealsLive-Dienst (bonanzadealslive);c:\program files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe;c:\program files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Update WebConnect;Update WebConnect;c:\program files (x86)\WebConnect\updateWebConnect.exe;c:\program files (x86)\WebConnect\updateWebConnect.exe [x]
R3 bonanzadealslivem;BonanzaDealsLive-Dienst (bonanzadealslivem);c:\program files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe;c:\program files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S2 BitGuard;BitGuard;c:\programdata\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe;c:\programdata\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [x]
S2 CltMngSvc;Search Protect by Conduit Service;c:\progra~2\SearchProtect\Main\bin\CltMngSvc.exe;c:\progra~2\SearchProtect\Main\bin\CltMngSvc.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [x]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S2 SProtection;SProtection;c:\program files (x86)\Common Files\Umbrella\umbrella.exe;c:\program files (x86)\Common Files\Umbrella\umbrella.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech Webcam C210(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-18 16:38]
.
2013-09-27 c:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
- c:\program files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-09-26 12:06]
.
2013-09-27 c:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
- c:\program files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-09-26 12:06]
.
2013-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-21 13:22]
.
2013-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-21 13:22]
.
2013-09-27 c:\windows\Tasks\Plus-HD-2.3-chromeinstaller.job
- c:\program files (x86)\Plus-HD-2.3\Plus-HD-2.3-chromeinstaller.exe [2013-09-26 12:07]
.
2013-09-27 c:\windows\Tasks\Plus-HD-2.3-codedownloader.job
- c:\program files (x86)\Plus-HD-2.3\Plus-HD-2.3-codedownloader.exe [2013-09-26 12:07]
.
2013-09-27 c:\windows\Tasks\Plus-HD-2.3-enabler.job
- c:\program files (x86)\Plus-HD-2.3\Plus-HD-2.3-enabler.exe [2013-09-26 12:09]
.
2013-09-27 c:\windows\Tasks\Plus-HD-2.3-firefoxinstaller.job
- c:\program files (x86)\Plus-HD-2.3\Plus-HD-2.3-firefoxinstaller.exe [2013-09-26 12:07]
.
2013-09-27 c:\windows\Tasks\Plus-HD-2.3-updater.job
- c:\program files (x86)\Plus-HD-2.3\Plus-HD-2.3-updater.exe [2013-09-26 12:09]
.
2013-09-27 c:\windows\Tasks\QIPdater 2012.job
- c:\program files (x86)\QIP 2012 Jeak-Edition\qipdater.exe [2012-01-02 10:36]
.
2013-09-27 c:\windows\Tasks\RegClean Pro_DEFAULT.job
- c:\program files (x86)\RegClean Pro\RegCleanPro.exe [2013-09-26 14:07]
.
2013-09-27 c:\windows\Tasks\RegClean Pro_UPDATES.job
- c:\program files (x86)\RegClean Pro\RegCleanPro.exe [2013-09-26 14:07]
.
2013-09-27 c:\windows\Tasks\RMAutoUpdate.job
- c:\program files (x86)\PC Tools Registry Mechanic\SULauncher.exe [2013-09-19 12:44]
.
2013-09-26 c:\windows\Tasks\RMSchedule.job
- c:\program files (x86)\PC Tools Registry Mechanic\RegMech.exe [2013-09-19 12:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-05-18 8067616]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-06-20 1356240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP7836C6A9-B298-4FE3-9AEE-AE38E3EB475B
mDefault_Page_URL = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
mStart Page = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\
FF - prefs.js: browser.search.selectedEngine - delta-homes
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP7836C6A9-B298-4FE3-9AEE-AE38E3EB475B
FF - ExtSQL: 2013-08-30 04:16; firefox@webconnect.co; c:\users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\extensions\firefox@webconnect.co.xpi
FF - ExtSQL: 2013-09-26 14:02; webbooster@iminent.com; c:\users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\extensions\webbooster@iminent.com.xpi
FF - ExtSQL: 2013-09-26 14:02; ffxtlbr@iminent.com; c:\users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\extensions\ffxtlbr@iminent.com
FF - ExtSQL: 2013-09-26 14:06; {f9d03c26-0575-497e-821d-f7956d23e0ca}; c:\users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}
FF - ExtSQL: 2013-09-26 14:07; ffxtlbr@delta.com; c:\users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\extensions\ffxtlbr@delta.com
FF - ExtSQL: 2013-09-26 14:07; 7125a285-7e68-47aa-9d72-e81874f4d47e@d3fcdb92-135d-4a8a-8cf6-11e3b57c5fda.com; c:\users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\extensions\7125a285-7e68-47aa-9d72-e81874f4d47e@d3fcdb92-135d-4a8a-8cf6-11e3b57c5fda.com
FF - user.js: extensions.iminent.tlbrSrchUrl - hxxp://start.iminent.com/?ref=toolbarm#q=
FF - user.js: extensions.iminent.id - 50532d79000000000000bc5ff413e132
FF - user.js: extensions.iminent.appId - {0E4B2CAB-B859-4C57-B96E-63DDEC692BC4}
FF - user.js: extensions.iminent.instlDay - 15974
FF - user.js: extensions.iminent.vrsn - 1.8.25.0
FF - user.js: extensions.iminent.vrsni - 1.8.25.0
FF - user.js: extensions.iminent.vrsnTs - 1.8.25.014:02
FF - user.js: extensions.iminent.prtnrId - iminent
FF - user.js: extensions.iminent.prdct - iminent
FF - user.js: extensions.iminent.aflt - orgnl
FF - user.js: extensions.iminent.smplGrp - none
FF - user.js: extensions.iminent.tlbrId - base
FF - user.js: extensions.iminent.instlRef -
FF - user.js: extensions.iminent.dfltLng -
FF - user.js: extensions.iminent.excTlbr - false
FF - user.js: extensions.iminent.ffxUnstlRst - false
FF - user.js: extensions.iminent.admin - false
FF - user.js: extensions.iminent.autoRvrt - false
FF - user.js: extensions.iminent.rvrt - false
FF - user.js: extensions.iminent.newTab - false
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 50532d79000000000000bc5ff413e132
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15974
FF - user.js: extensions.delta.vrsn - 1.8.24.6
FF - user.js: extensions.delta.vrsni - 1.8.24.6
FF - user.js: extensions.delta.vrsnTs - 1.8.24.614:07
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - de
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=119357&tsp=5017
FF - user.js: extensions.delta_i.babExt -
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
BHO-{C1AF5FA5-852C-4C90-812E-A7F75E011D87} - c:\program files (x86)\Delta\delta\1.8.24.6\bh\delta.dll
Toolbar-{82E1477C-B154-48D3-9891-33D83C26BCD3} - c:\program files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\SysWOW64\brsvc01a.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\SysWOW64\brss01a.exe
c:\program files (x86)\Advanced System Protector\AdvancedSystemProtector.exe
c:\program files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe
c:\progra~2\SearchProtect\SearchProtect\bin\cltmng.exe
c:\progra~2\SearchProtect\UI\bin\cltmngui.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-09-27 18:29:30 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-09-27 16:29
.
Vor Suchlauf: 15 Verzeichnis(se), 44.567.097.344 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 45.022.052.352 Bytes frei
.
- - End Of File - - 54DF695D791B6230549F5EC82CC55D3B
A36C5E4F47E84449FF07ED3517B43A31
|
|
28.09.2013, 12:12
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.09.2013, 18:30
| #5 |
| | Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen Hallo Schrauber, hab alles so gemacht und hier die entsprechenden Files Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.28.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Petra :: PETRAPC [Administrator] Schutz: Deaktiviert 29.09.2013 17:21:26 mbam-log-2013-09-29 (17-21-26).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 221039 Laufzeit: 5 Minute(n), 12 Sekunde(n) Infizierte Speicherprozesse: 1 C:\ProgramData\eSafe\eGdpSvc.exe (PUP.Optional.DProtect.A) -> 1292 -> Löschen bei Neustart. Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 49 HKLM\SYSTEM\CurrentControlSet\Services\WsysSvc (PUP.Optional.DProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl (PUP.Optional.DProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SYSTEM\CurrentControlSet\Services\BitGuard (PUP.Optional.PerformerSoft.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\escort.escortIEPane.1 (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\escort.escortIEPane (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltaHlpr.1 (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltaHlpr (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{112BA211-334C-4A90-90EC-2AD1CDAB287C} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\iminent.iminentHlpr.1 (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\iminent.iminentHlpr (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{112BA211-334C-4A90-90EC-2AD1CDAB287C} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{1FAFD711-ABF9-4F6A-8130-5166C7371427} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltadskBnd.1 (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltadskBnd (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\iminent.iminentdskBnd.1 (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\iminent.iminentdskBnd (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\esrv.deltaESrvc.1 (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\esrv.deltaESrvc (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23} (PUP.Optional.BrowseFox.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Typelib\{4599D05A-D545-4069-BB42-5895B4EAE05B} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{1231839B-064E-4788-B865-465A1B5266FD} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DigitalSite (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DELTA\DELTA (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\qvo6Software (PUP.Optional.qvo6.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Delta\delta\Instl (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltaappCore.1 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltaappCore (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\d (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} (PUP.Optional.BitGuard.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 10 HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Iminent.A) -> Daten: Delta Toolbar -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{1FAFD711-ABF9-4F6A-8130-5166C7371427} (PUP.Optional.Iminent.A) -> Daten: Iminent Toolbar -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{1FAFD711-ABF9-4F6A-8130-5166C7371427} (PUP.Optional.Iminent.A) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Delta\Delta|tlbrSrchUrl (PUP.Optional.Delta.A) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|bProtector Start Page (PUP.BProtector) -> Daten: hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=5053BC5FF413E132&affID=119357&tsp=5019 -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|bProtectorDefaultScope (PUP.BProtector) -> Daten: {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0W0U -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SYSTEM\CurrentControlSet\Services\BitGuard|ImagePath (PUP.Optional.BitGuard.A) -> Daten: C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SYSTEM\CurrentControlSet\Services\WsysSvc|ImagePath (PUP.Optional.Esafe.A) -> Daten: C:\ProgramData\eSafe\eGdpSvc.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 1 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs (PUP.Optional.PerformerSoft.A) -> Bösartig: (c:\progra~3\bitguard\261673~1.238\{c16c1~1\bitguard.dll) Gut: () -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 16 C:\Users\Petra\AppData\Roaming\DigitalSite\UpdateProc (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\BabSolution (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\BabSolution\CR (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\BabSolution\Shared (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.24.6 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.24.6\bh (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0 (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.24.6 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BitGuard\2.6.1673.238 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8} (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension (PUP.Optional.BitGuard.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. Infizierte Dateien: 77 C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.dll (PUP.Optional.PerformerSoft.A) -> Löschen bei Neustart. C:\ProgramData\eSafe\eGdpSvc.exe (PUP.Optional.DProtect.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe (PUP.Optional.PerformerSoft.A) -> Löschen bei Neustart. C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.24.6\deltasrv.exe (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\DSearchLink\DSearchLink.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\BabSolution\Shared\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\Desktop\ImageEditorSetup.exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\Desktop\SoftonicDownloader_fuer_nw-docx-converter.exe (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\Desktop\UltimateCodec(1).exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\Desktop\UltimateCodec.exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\32AA100E-BAB0-7891-8386-7638463DC601\Latest\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\32AA100E-BAB0-7891-8386-7638463DC601\Latest\BExternal.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\32AA100E-BAB0-7891-8386-7638463DC601\Latest\CrxInstaller.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\32AA100E-BAB0-7891-8386-7638463DC601\Latest\DSearchLink.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\32AA100E-BAB0-7891-8386-7638463DC601\Latest\MntrDLLInstall.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\32AA100E-BAB0-7891-8386-7638463DC601\Latest\MyDeltaTB.exe (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\32AA100E-BAB0-7891-8386-7638463DC601\Latest\Setup.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\BCB386AF-BAB0-7891-8816-EC3A180C8D37\Latest\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\BCB386AF-BAB0-7891-8816-EC3A180C8D37\Latest\BExternal.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\BCB386AF-BAB0-7891-8816-EC3A180C8D37\Latest\CrxInstaller.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\BCB386AF-BAB0-7891-8816-EC3A180C8D37\Latest\DSearchLink.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\BCB386AF-BAB0-7891-8816-EC3A180C8D37\Latest\MntrDLLInstall.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\BCB386AF-BAB0-7891-8816-EC3A180C8D37\Latest\MyDeltaTB.exe (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\BCB386AF-BAB0-7891-8816-EC3A180C8D37\Latest\Setup.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\eIntaller\2176EE3C1A704e648A44DBD9EAEAE6D5\eGdpSvc.exe (PUP.Optional.DProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\is1590112554\259855_stp\DeltaTB.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\is1590112554\291870_stp\DeltaTB.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Temp\is357113909\640882_stp\cor_ar_201392319852_qvo6.exe (PUP.Optional.Elex) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Installer\10260cb.msi (PUP.Optional.Iminent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\DigitalSite\UpdateProc\config.dat (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\DigitalSite\UpdateProc\prod.dat (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\Mozilla Firefox\defaults\pref\all-iminent.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\User Data\Default\Extensions\newtab.crx (PUP.Optional.Elex.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\BabSolution\CR\Delta.crx (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\BabSolution\Shared\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\BabSolution\Shared\Delta.ico (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\BabSolution\Shared\GUninstaller.exe (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\BabSolution\Shared\SetupParams.ini (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Roaming\BabSolution\Shared\sqlite3.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaApp.dll (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaEng.dll (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.24.6\GUninstaller.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.24.6\uninstall.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\appCntrl.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\bg.html (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\bg.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\CrmAdpt.dll (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\ct.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\CTB.dll (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\dpk.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\hprtkMsg.htm (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\hprtkMsg.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\json2.min.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\logo.png (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\manifest.json (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Petra\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\pref.json (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.settings (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\bl (PUP.Optional.BitGuard.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\dm (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\uninstall.exe (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\00 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\01 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\02 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\03 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\10 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\11 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\12 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\13 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\20 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\21 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\22 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\23 (PUP.Optional.BitGuard.A) -> Löschen bei Neustart. (Ende) Code:
ATTFilter # AdwCleaner v3.005 - Bericht erstellt am 29/09/2013 um 17:41:54
# Updated 22/09/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Petra - PETRAPC
# Gestartet von : C:\Users\Petra\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BitGuard
Ordner Gelöscht : C:\ProgramData\DSearchLink
Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\Program Files (x86)\delta
Ordner Gelöscht : C:\Program Files (x86)\openit
Ordner Gelöscht : C:\Users\Petra\AppData\Local\Temp\eIntaller
Ordner Gelöscht : C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
Ordner Gelöscht : C:\Users\Petra\AppData\Roaming\digitalsite
Ordner Gelöscht : C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
Ordner Gelöscht : C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\ffxtlbr@delta.com
Datei Gelöscht : C:\Users\Public\Desktop\Open It!.lnk
Datei Gelöscht : C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\bprotector_prefs.js
Datei Gelöscht : C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\BitGuard
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
Verknüpfung Desinfiziert : C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Petra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Petra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Petra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Petra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Opera.lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKCU\Software\5e6dbdab668eb48
Schlüssel Gelöscht : HKLM\SOFTWARE\5e6dbdab668eb48
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\eSafeSecControl
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenIt Open It!
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v18.0.1 (de)
[ Datei : C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www.qvo6.com/newtab/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=nt&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380392790");
Zeile gelöscht : user_pref("browser.search.defaultenginename", "qvo6");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "qvo6");
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380392790");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "50532d79000000000000bc5ff413e132");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15976");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.620:20:47");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=119357&tsp=5019");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
*************************
AdwCleaner[R0].txt - [44149 octets] - [28/09/2013 20:13:11]
AdwCleaner[R1].txt - [10925 octets] - [29/09/2013 17:39:55]
AdwCleaner[S0].txt - [40658 octets] - [28/09/2013 20:14:50]
AdwCleaner[S1].txt - [8451 octets] - [29/09/2013 17:41:54]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [8511 octets] ##########
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Petra (administrator) on PETRAPC on 29-09-2013 17:59:55
Running from C:\Users\Petra\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Safe Mode (with Networking)
==================== Processes (Whitelisted) =================
(Mozilla Corporation) C:\Programme\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(QIP) C:\Program Files (x86)\QIP 2012 Jeak-Edition\qip.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8067616 2013-05-18] (Realtek Semiconductor)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20684656 2013-07-25] (Skype Technologies S.A.)
HKCU\...\Run: [Infium] - C:\Program Files (x86)\QIP 2012 Jeak-Edition\qip.exe [7318992 2011-12-28] (QIP)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SSDMonitor] - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [105120 2012-08-21] (PC Tools)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [97280 2009-07-14] ()
AppInit_DLLs-x32: c:\PROGRA~3\BitGuard\261673~1.238\{C16C1~1\BitGuard.dll [ ] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\searchplugins\iminent.xml
FF Extension: Iminent Toolbar - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\ffxtlbr@iminent.com
FF Extension: WebConnect - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox@webconnect.co
FF Extension: BonanzaDeals - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}
FF Extension: firefox-hotfix - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox-hotfix@mozilla.org.xpi
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [ieadcoanfjloocmfafkebdnfefmohngj] - C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.crx
CHR HKLM-x32\...\Chrome\Extension: [pkhojieggfgllhllcegoffdcnmdeojgb] - C:\Program Files (x86)\IminentToolbar\1.8.25.0\iminent.crx
==================== Services (Whitelisted) =================
S2 Brother XP spl Service; C:\Windows\SysWOW64\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
S2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [794272 2012-08-21] (PC Tools)
==================== Drivers (Whitelisted) ====================
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2013-05-18] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-29 17:58 - 2013-09-29 17:59 - 01953880 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2013-09-29 17:50 - 2013-09-29 17:51 - 00001254 _____ C:\Users\Petra\Desktop\JRT.txt
2013-09-29 17:48 - 2013-09-29 17:48 - 01030305 _____ (Thisisu) C:\Users\Petra\Desktop\JRT.exe
2013-09-29 17:48 - 2013-09-29 17:48 - 00000000 ____D C:\Windows\ERUNT
2013-09-29 17:43 - 2013-09-29 17:43 - 00008599 _____ C:\Users\Petra\Desktop\AdwCleaner[S1].txt
2013-09-29 17:41 - 2013-09-29 17:41 - 00010925 _____ C:\Users\Petra\Desktop\AdwCleaner[R1].txt
2013-09-29 17:39 - 2013-09-29 17:39 - 01042066 _____ C:\Users\Petra\Desktop\adwcleaner.exe
2013-09-29 17:18 - 2013-09-29 17:18 - 00040658 _____ C:\Users\Petra\Desktop\AdwCleaner[S0].txt
2013-09-28 20:41 - 2013-09-28 20:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Petra\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-28 20:39 - 2013-09-28 20:39 - 00715038 _____ C:\Windows\unins000.exe
2013-09-28 20:39 - 2011-05-30 15:42 - 00255488 _____ C:\Windows\system32\xvidvfw.dll
2013-09-28 20:39 - 2011-05-30 15:42 - 00240640 _____ C:\Windows\SysWOW64\xvidvfw.dll
2013-09-28 20:39 - 2011-05-23 11:52 - 00153088 _____ C:\Windows\SysWOW64\xvid.ax
2013-09-28 20:39 - 2011-05-23 09:49 - 00173568 _____ C:\Windows\system32\xvid.ax
2013-09-28 20:39 - 2011-05-23 09:46 - 00645632 _____ C:\Windows\SysWOW64\xvidcore.dll
2013-09-28 20:39 - 2011-05-23 09:45 - 00696832 _____ C:\Windows\system32\xvidcore.dll
2013-09-28 20:26 - 2013-09-28 20:36 - 00001266 _____ C:\Users\Public\Desktop\Image Converter.lnk
2013-09-28 20:26 - 2013-09-28 20:26 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-28 20:17 - 2013-09-28 20:17 - 10063000 _____ (Malwarebytes Corporation ) C:\Users\Petra\Desktop\mbam-setup-1.61.0.1400.exe
2013-09-28 20:13 - 2013-09-29 17:42 - 00000000 ____D C:\AdwCleaner
2013-09-28 20:05 - 2013-09-28 20:05 - 00000276 ____H C:\Windows\Tasks\User_Feed_Synchronization-{8FB5B23C-B447-421A-B575-2FEED7F03542}.job
2013-09-28 19:49 - 2013-09-28 20:20 - 00001848 _____ C:\Users\Petra\Desktop\Search.lnk
2013-09-28 19:49 - 2013-09-28 19:49 - 00000000 ____D C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B
2013-09-28 19:48 - 2013-09-28 19:48 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-28 19:40 - 2013-09-28 20:41 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-28 19:40 - 2013-09-28 19:43 - 09502424 _____ (Malwarebytes Corporation ) C:\Users\Petra\Desktop\mbam-setup-1.60.1.1000.exe
2013-09-27 18:38 - 2013-09-27 18:38 - 00030820 _____ C:\Users\Petra\Desktop\combofix.txt
2013-09-27 18:37 - 2013-09-27 18:37 - 00030820 _____ C:\Users\Petra\Desktop\scan.txt
2013-09-27 18:29 - 2013-09-27 18:29 - 00030820 _____ C:\ComboFix.txt
2013-09-27 18:21 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-27 18:21 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-27 18:21 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-27 18:17 - 2013-09-27 18:29 - 00000000 ____D C:\Qoobox
2013-09-27 18:17 - 2013-09-27 18:27 - 00000000 ____D C:\Windows\erdnt
2013-09-27 18:16 - 2013-09-27 18:16 - 05129766 ____R (Swearware) C:\Users\Petra\Desktop\ComboFix.exe
2013-09-27 17:54 - 2013-09-27 17:54 - 00003121 _____ C:\Users\Petra\Desktop\gmer.txt
2013-09-27 17:26 - 2013-09-27 17:26 - 00024091 _____ C:\Users\Petra\Desktop\Addition.txt
2013-09-27 17:25 - 2013-09-27 17:25 - 00000000 ____D C:\FRST
2013-09-27 17:24 - 2013-09-27 17:24 - 00000504 _____ C:\Users\Petra\Desktop\defogger_disable.log
2013-09-27 17:24 - 2013-09-27 17:24 - 00000020 _____ C:\Users\Petra\defogger_reenable
2013-09-27 17:20 - 2013-09-27 17:20 - 00377856 _____ C:\Users\Petra\Desktop\gmer_2.1.19163.exe
2013-09-27 17:17 - 2013-09-27 17:17 - 00050477 _____ C:\Users\Petra\Desktop\Defogger.exe
2013-09-27 16:55 - 2013-09-27 16:56 - 00000000 ____D C:\Users\Petra\Desktop\studiveitsarah
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-26 15:18 - 2013-09-27 09:18 - 00000092 _____ C:\Users\Petra\AppData\Roaming\WB.CFG
2013-09-26 15:18 - 2013-09-27 09:18 - 00000005 _____ C:\Users\Petra\AppData\Roaming\WBPU-TTL.DAT
2013-09-26 14:55 - 2013-09-26 14:55 - 00004096 ____H C:\Users\Petra\AppData\Local\keyfile3.drm
2013-09-26 14:15 - 2013-09-26 14:15 - 00000000 ____D C:\Program Files\DivX
2013-09-26 14:14 - 2013-09-26 14:14 - 00000000 ____D C:\User Data
2013-09-26 14:08 - 2013-09-28 19:50 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-09-26 14:08 - 2013-09-26 14:16 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:08 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2013-09-26 14:07 - 2013-09-29 17:42 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-26 14:07 - 2013-09-28 20:39 - 00004879 _____ C:\Windows\unins000.dat
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\ProgramData\DivX
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-26 14:07 - 2013-09-28 19:46 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-09-26 14:07 - 2013-09-27 19:12 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-26 14:07 - 2013-09-26 14:07 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-26 14:07 - 2013-09-26 14:07 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:07 - 2012-02-26 16:47 - 00079360 _____ C:\Windows\SysWOW64\ff_vfw.dll
2013-09-26 14:07 - 2012-01-09 20:45 - 00178688 _____ C:\Windows\SysWOW64\unrar.dll
2013-09-26 14:07 - 2011-12-07 19:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll
2013-09-26 14:07 - 2011-12-07 19:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\lagarith.dll
2013-09-26 14:06 - 2013-09-26 14:06 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-26 14:02 - 2013-09-26 14:02 - 00000635 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-26 14:01 - 2013-09-26 14:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\NwDocx
2013-09-26 14:01 - 2013-09-26 14:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Docx2Rtf
2013-09-25 17:47 - 2013-09-25 17:47 - 00001084 _____ C:\Musik - Verknüpfung.lnk
2013-09-23 13:55 - 2013-09-27 16:56 - 00000000 ____D C:\Users\Petra\Desktop\Bachelorordner
2013-09-23 10:20 - 2013-09-23 10:28 - 00000000 ____D C:\Users\Petra\Documents\Fax
2013-09-19 19:00 - 2013-09-27 19:12 - 00000416 _____ C:\Windows\SysWOW64\AppLog.log
2013-09-19 17:04 - 2013-09-29 17:42 - 00000284 _____ C:\Windows\Tasks\RMAutoUpdate.job
2013-09-19 17:04 - 2013-09-19 17:04 - 00002860 _____ C:\Windows\System32\Tasks\RMSchedule
2013-09-19 17:04 - 2013-09-19 17:04 - 00002520 _____ C:\Windows\System32\Tasks\RMAutoUpdate
2013-09-19 17:04 - 2013-09-19 17:04 - 00001194 _____ C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
2013-09-19 17:04 - 2012-08-21 14:44 - 00513696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml.dll
2013-09-19 17:04 - 2012-08-21 14:44 - 00041632 _____ C:\Windows\system32\CleanMFT64.exe
2013-09-19 17:04 - 2008-09-17 21:17 - 00658432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2013-09-19 17:04 - 2008-04-02 15:54 - 01101824 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBox210.ocx
2013-09-19 17:04 - 2008-04-02 15:53 - 00880640 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBox10.ocx
2013-09-19 17:04 - 2008-04-02 15:53 - 00212992 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBoxVB12.ocx
2013-09-19 17:03 - 2013-09-29 17:42 - 00000000 ____D C:\Program Files (x86)\PC Tools Registry Mechanic
2013-09-19 17:01 - 2013-09-19 17:01 - 00001103 _____ C:\Users\Petra\Desktop\Screenshot Captor.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Windows\SysWOW64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Users\Petra\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\Documents\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\ProgramData\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-09-18 22:08 - 2013-09-18 22:08 - 00094208 _____ (DivX, Inc.) C:\Windows\SysWOW64\dpl100.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-16 00:57 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-16 00:57 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-16 00:57 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-16 00:57 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-16 00:57 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-16 00:57 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-16 00:57 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-16 00:57 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-16 00:57 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-14 12:28 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-14 12:28 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-14 12:28 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-14 12:28 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-14 12:28 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-14 12:28 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-14 12:28 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-14 12:28 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-14 12:28 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-14 12:28 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-14 12:28 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-14 12:28 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-14 12:28 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-14 12:28 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-14 12:28 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-14 12:28 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-14 12:28 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-02 09:18 - 2013-09-02 09:18 - 214423597 _____ C:\Windows\MEMORY.DMP
2013-09-02 09:18 - 2013-09-02 09:18 - 00290728 _____ C:\Windows\Minidump\090213-9609-01.dmp
2013-09-02 09:18 - 2013-09-02 09:18 - 00000000 ____D C:\Windows\Minidump
==================== One Month Modified Files and Folders =======
2013-09-29 17:59 - 2013-09-29 17:58 - 01953880 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2013-09-29 17:51 - 2013-09-29 17:50 - 00001254 _____ C:\Users\Petra\Desktop\JRT.txt
2013-09-29 17:51 - 2011-04-12 09:43 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-09-29 17:51 - 2011-04-12 09:43 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-09-29 17:51 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-29 17:48 - 2013-09-29 17:48 - 01030305 _____ (Thisisu) C:\Users\Petra\Desktop\JRT.exe
2013-09-29 17:48 - 2013-09-29 17:48 - 00000000 ____D C:\Windows\ERUNT
2013-09-29 17:45 - 2013-05-18 21:41 - 01690083 _____ C:\Windows\WindowsUpdate.log
2013-09-29 17:45 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-29 17:45 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-29 17:43 - 2013-09-29 17:43 - 00008599 _____ C:\Users\Petra\Desktop\AdwCleaner[S1].txt
2013-09-29 17:43 - 2013-05-21 15:22 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-29 17:43 - 2013-05-18 23:37 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Skype
2013-09-29 17:42 - 2013-09-28 20:13 - 00000000 ____D C:\AdwCleaner
2013-09-29 17:42 - 2013-09-26 14:07 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-29 17:42 - 2013-09-19 17:04 - 00000284 _____ C:\Windows\Tasks\RMAutoUpdate.job
2013-09-29 17:42 - 2013-09-19 17:03 - 00000000 ____D C:\Program Files (x86)\PC Tools Registry Mechanic
2013-09-29 17:42 - 2013-05-18 23:44 - 00000380 _____ C:\Windows\Tasks\QIPdater 2012.job
2013-09-29 17:42 - 2013-05-18 21:57 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-29 17:42 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-29 17:42 - 2009-07-14 06:51 - 00037042 _____ C:\Windows\setupact.log
2013-09-29 17:41 - 2013-09-29 17:41 - 00010925 _____ C:\Users\Petra\Desktop\AdwCleaner[R1].txt
2013-09-29 17:41 - 2013-05-18 22:06 - 00000792 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-29 17:41 - 2013-05-18 21:42 - 00000995 _____ C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-29 17:39 - 2013-09-29 17:39 - 01042066 _____ C:\Users\Petra\Desktop\adwcleaner.exe
2013-09-29 17:38 - 2013-05-18 22:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-29 17:33 - 2013-05-21 15:22 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-29 17:33 - 2010-11-21 05:47 - 00030252 _____ C:\Windows\PFRO.log
2013-09-29 17:18 - 2013-09-29 17:18 - 00040658 _____ C:\Users\Petra\Desktop\AdwCleaner[S0].txt
2013-09-28 20:41 - 2013-09-28 20:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Petra\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-28 20:41 - 2013-09-28 19:40 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-28 20:41 - 2013-05-18 22:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-28 20:39 - 2013-09-28 20:39 - 00715038 _____ C:\Windows\unins000.exe
2013-09-28 20:39 - 2013-09-26 14:07 - 00004879 _____ C:\Windows\unins000.dat
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\DivX
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-28 20:36 - 2013-09-28 20:26 - 00001266 _____ C:\Users\Public\Desktop\Image Converter.lnk
2013-09-28 20:29 - 2013-05-18 21:42 - 00000000 ____D C:\Users\Petra
2013-09-28 20:26 - 2013-09-28 20:26 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-28 20:20 - 2013-09-28 19:49 - 00001848 _____ C:\Users\Petra\Desktop\Search.lnk
2013-09-28 20:17 - 2013-09-28 20:17 - 10063000 _____ (Malwarebytes Corporation ) C:\Users\Petra\Desktop\mbam-setup-1.61.0.1400.exe
2013-09-28 20:14 - 2013-05-18 22:23 - 00000000 ____D C:\Users\Petra\Desktop\Programme
2013-09-28 20:14 - 2013-05-18 21:42 - 00000000 ___RD C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-28 20:05 - 2013-09-28 20:05 - 00000276 ____H C:\Windows\Tasks\User_Feed_Synchronization-{8FB5B23C-B447-421A-B575-2FEED7F03542}.job
2013-09-28 19:55 - 2013-05-18 23:50 - 00000000 ____D C:\Users\Petra\AppData\Roaming\TS3Client
2013-09-28 19:55 - 2013-05-18 23:37 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-09-28 19:51 - 2013-05-18 22:16 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8FB5B23C-B447-421A-B575-2FEED7F03542}
2013-09-28 19:50 - 2013-09-26 14:08 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-09-28 19:49 - 2013-09-28 19:49 - 00000000 ____D C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B
2013-09-28 19:48 - 2013-09-28 19:48 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-28 19:46 - 2013-09-26 14:07 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-09-28 19:43 - 2013-09-28 19:40 - 09502424 _____ (Malwarebytes Corporation ) C:\Users\Petra\Desktop\mbam-setup-1.60.1.1000.exe
2013-09-27 19:12 - 2013-09-26 14:07 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-27 19:12 - 2013-09-19 19:00 - 00000416 _____ C:\Windows\SysWOW64\AppLog.log
2013-09-27 18:38 - 2013-09-27 18:38 - 00030820 _____ C:\Users\Petra\Desktop\combofix.txt
2013-09-27 18:37 - 2013-09-27 18:37 - 00030820 _____ C:\Users\Petra\Desktop\scan.txt
2013-09-27 18:29 - 2013-09-27 18:29 - 00030820 _____ C:\ComboFix.txt
2013-09-27 18:29 - 2013-09-27 18:17 - 00000000 ____D C:\Qoobox
2013-09-27 18:29 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-27 18:27 - 2013-09-27 18:17 - 00000000 ____D C:\Windows\erdnt
2013-09-27 18:25 - 2009-07-14 04:34 - 60030976 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 14680064 _____ C:\Windows\system32\config\SYSTEM.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\DEFAULT.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-27 18:16 - 2013-09-27 18:16 - 05129766 ____R (Swearware) C:\Users\Petra\Desktop\ComboFix.exe
2013-09-27 17:54 - 2013-09-27 17:54 - 00003121 _____ C:\Users\Petra\Desktop\gmer.txt
2013-09-27 17:26 - 2013-09-27 17:26 - 00024091 _____ C:\Users\Petra\Desktop\Addition.txt
2013-09-27 17:25 - 2013-09-27 17:25 - 00000000 ____D C:\FRST
2013-09-27 17:24 - 2013-09-27 17:24 - 00000504 _____ C:\Users\Petra\Desktop\defogger_disable.log
2013-09-27 17:24 - 2013-09-27 17:24 - 00000020 _____ C:\Users\Petra\defogger_reenable
2013-09-27 17:20 - 2013-09-27 17:20 - 00377856 _____ C:\Users\Petra\Desktop\gmer_2.1.19163.exe
2013-09-27 17:17 - 2013-09-27 17:17 - 00050477 _____ C:\Users\Petra\Desktop\Defogger.exe
2013-09-27 16:56 - 2013-09-27 16:55 - 00000000 ____D C:\Users\Petra\Desktop\studiveitsarah
2013-09-27 16:56 - 2013-09-23 13:55 - 00000000 ____D C:\Users\Petra\Desktop\Bachelorordner
2013-09-27 09:18 - 2013-09-26 15:18 - 00000092 _____ C:\Users\Petra\AppData\Roaming\WB.CFG
2013-09-27 09:18 - 2013-09-26 15:18 - 00000005 _____ C:\Users\Petra\AppData\Roaming\WBPU-TTL.DAT
2013-09-27 08:37 - 2009-07-14 06:45 - 00307312 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-26 14:55 - 2013-09-26 14:55 - 00004096 ____H C:\Users\Petra\AppData\Local\keyfile3.drm
2013-09-26 14:28 - 2013-05-18 22:02 - 00065552 _____ C:\Users\Petra\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-26 14:16 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:16 - 2013-05-18 23:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-09-26 14:16 - 2013-05-18 22:06 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-26 14:15 - 2013-09-26 14:15 - 00000000 ____D C:\Program Files\DivX
2013-09-26 14:14 - 2013-09-26 14:14 - 00000000 ____D C:\User Data
2013-09-26 14:07 - 2013-09-26 14:07 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-26 14:07 - 2013-09-26 14:07 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:06 - 2013-09-26 14:06 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-26 14:03 - 2013-09-26 14:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\NwDocx
2013-09-26 14:03 - 2013-09-26 14:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Docx2Rtf
2013-09-26 14:02 - 2013-09-26 14:02 - 00000635 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-26 14:02 - 2013-05-21 15:22 - 00000000 ____D C:\Users\Petra\AppData\Local\Google
2013-09-26 09:20 - 2013-05-20 12:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-26 09:20 - 2013-05-18 23:37 - 00000000 ____D C:\ProgramData\Skype
2013-09-25 17:47 - 2013-09-25 17:47 - 00001084 _____ C:\Musik - Verknüpfung.lnk
2013-09-23 10:28 - 2013-09-23 10:20 - 00000000 ____D C:\Users\Petra\Documents\Fax
2013-09-23 10:20 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-22 18:38 - 2013-05-18 22:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-22 18:38 - 2013-05-18 22:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-22 18:38 - 2013-05-18 22:20 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-19 17:04 - 2013-09-19 17:04 - 00002860 _____ C:\Windows\System32\Tasks\RMSchedule
2013-09-19 17:04 - 2013-09-19 17:04 - 00002520 _____ C:\Windows\System32\Tasks\RMAutoUpdate
2013-09-19 17:04 - 2013-09-19 17:04 - 00001194 _____ C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00001103 _____ C:\Users\Petra\Desktop\Screenshot Captor.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Windows\SysWOW64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Users\Petra\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\Documents\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\ProgramData\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-09-18 22:08 - 2013-09-18 22:08 - 00094208 _____ (DivX, Inc.) C:\Windows\SysWOW64\dpl100.dll
2013-09-15 03:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-15 03:23 - 2013-05-18 21:42 - 00000000 ___RD C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-15 03:06 - 2013-08-14 18:52 - 00000000 ____D C:\Windows\system32\MRT
2013-09-15 03:05 - 2013-05-18 22:27 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-03 14:10 - 2013-08-04 11:52 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-09-02 09:18 - 2013-09-02 09:18 - 214423597 _____ C:\Windows\MEMORY.DMP
2013-09-02 09:18 - 2013-09-02 09:18 - 00290728 _____ C:\Windows\Minidump\090213-9609-01.dmp
2013-09-02 09:18 - 2013-09-02 09:18 - 00000000 ____D C:\Windows\Minidump
Some content of TEMP:
====================
C:\Users\Petra\AppData\Local\Temp\ICReinstall_ZipExtractorSetup(1).exe
C:\Users\Petra\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-22 18:53
==================== End Of Log ============================
--- --- --- Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.3 (09.27.2013:1)
OS: Windows 7 Professional x64
Ran by Petra on 29.09.2013 at 18:21:51,44
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.09.2013 at 18:23:55,09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Viele Grüße Petra noch eine meldung hinterher, nach normalem hocfahren hat sich jetzt doc h wieder ein programm namens PC Tool Registry Mechanic von allein gestartet und angefangen zu scanne-scheint noch was zu sein, was soll ich tun? |
|
30.09.2013, 08:40
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen Nochmal mit MBAM scannen und löschen lassen, dann ein frisches FRST log bitte.
__________________ --> Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen |
|
30.09.2013, 17:22
| #7 |
| | Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen Hallo, hab gescannt (und eig. sagt der Scan nichts infiziert). Hier die txt-datei dazu und auch das frische frst. Was mich wundert, ich habe dieses Programm PC Tools Registry Mechanic nicht installiert, sondern es steht da am 19.9. - ev. die Zedit, wo auch System Protector drauf kam und es steht in C/Program Files (x86) ..... Nun weiß ich nicht, ob das ein "normales Programm" ist, oder selbst nur getarnt? ich würde es einfach gern runterhaben-kann man es nicht deinstallieren? Vielen Dank jedenfalls soweit. Grüße pesavei Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.30.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Petra :: PETRAPC [Administrator] Schutz: Deaktiviert 30.09.2013 17:24:27 mbam-log-2013-09-30 (17-24-27).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 221304 Laufzeit: 2 Minute(n), 21 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Petra (administrator) on PETRAPC on 30-09-2013 17:30:33
Running from C:\Users\Petra\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(brother Industries Ltd) C:\Windows\SysWOW64\brsvc01a.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
(brother Industries Ltd) C:\Windows\SysWOW64\brss01a.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(QIP) C:\Program Files (x86)\QIP 2012 Jeak-Edition\qip.exe
(PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler64.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8067616 2013-05-18] (Realtek Semiconductor)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20684656 2013-07-25] (Skype Technologies S.A.)
HKCU\...\Run: [Infium] - C:\Program Files (x86)\QIP 2012 Jeak-Edition\qip.exe [7318992 2011-12-28] (QIP)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SSDMonitor] - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [105120 2012-08-21] (PC Tools)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [97280 2009-07-14] ()
AppInit_DLLs-x32: c:\PROGRA~3\BitGuard\261673~1.238\{C16C1~1\BitGuard.dll [ ] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\searchplugins\iminent.xml
FF Extension: Iminent Toolbar - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\ffxtlbr@iminent.com
FF Extension: WebConnect - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox@webconnect.co
FF Extension: BonanzaDeals - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}
FF Extension: firefox-hotfix - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox-hotfix@mozilla.org.xpi
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [ieadcoanfjloocmfafkebdnfefmohngj] - C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.crx
CHR HKLM-x32\...\Chrome\Extension: [pkhojieggfgllhllcegoffdcnmdeojgb] - C:\Program Files (x86)\IminentToolbar\1.8.25.0\iminent.crx
==================== Services (Whitelisted) =================
R2 Brother XP spl Service; C:\Windows\SysWOW64\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [794272 2012-08-21] (PC Tools)
==================== Drivers (Whitelisted) ====================
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2013-05-18] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-29 20:26 - 2013-09-29 20:26 - 00001104 _____ C:\Users\Petra\Desktop\AdwCleaner[S2].txt
2013-09-29 19:00 - 2013-09-29 19:22 - 00000284 _____ C:\Windows\Tasks\RMSchedule.job
2013-09-29 18:24 - 2013-09-29 18:24 - 00000625 _____ C:\Users\Petra\Desktop\JRT2.txt
2013-09-29 18:23 - 2013-09-29 18:23 - 00000625 _____ C:\Users\Petra\Desktop\JRT.txt
2013-09-29 18:01 - 2013-09-29 18:01 - 00047395 _____ C:\Users\Petra\Desktop\FRST2.txt
2013-09-29 17:58 - 2013-09-29 17:59 - 01953880 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2013-09-29 17:48 - 2013-09-29 17:48 - 01030305 _____ (Thisisu) C:\Users\Petra\Desktop\JRT.exe
2013-09-29 17:48 - 2013-09-29 17:48 - 00000000 ____D C:\Windows\ERUNT
2013-09-29 17:43 - 2013-09-29 17:43 - 00008599 _____ C:\Users\Petra\Desktop\AdwCleaner[S1].txt
2013-09-29 17:41 - 2013-09-29 17:41 - 00010925 _____ C:\Users\Petra\Desktop\AdwCleaner[R1].txt
2013-09-29 17:39 - 2013-09-29 17:39 - 01042066 _____ C:\Users\Petra\Desktop\adwcleaner.exe
2013-09-29 17:18 - 2013-09-29 17:18 - 00040658 _____ C:\Users\Petra\Desktop\AdwCleaner[S0].txt
2013-09-28 20:41 - 2013-09-28 20:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Petra\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-28 20:39 - 2013-09-28 20:39 - 00715038 _____ C:\Windows\unins000.exe
2013-09-28 20:39 - 2011-05-30 15:42 - 00255488 _____ C:\Windows\system32\xvidvfw.dll
2013-09-28 20:39 - 2011-05-30 15:42 - 00240640 _____ C:\Windows\SysWOW64\xvidvfw.dll
2013-09-28 20:39 - 2011-05-23 11:52 - 00153088 _____ C:\Windows\SysWOW64\xvid.ax
2013-09-28 20:39 - 2011-05-23 09:49 - 00173568 _____ C:\Windows\system32\xvid.ax
2013-09-28 20:39 - 2011-05-23 09:46 - 00645632 _____ C:\Windows\SysWOW64\xvidcore.dll
2013-09-28 20:39 - 2011-05-23 09:45 - 00696832 _____ C:\Windows\system32\xvidcore.dll
2013-09-28 20:26 - 2013-09-28 20:36 - 00001266 _____ C:\Users\Public\Desktop\Image Converter.lnk
2013-09-28 20:26 - 2013-09-28 20:26 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-28 20:13 - 2013-09-29 20:25 - 00000000 ____D C:\AdwCleaner
2013-09-28 19:49 - 2013-09-28 20:20 - 00001848 _____ C:\Users\Petra\Desktop\Search.lnk
2013-09-28 19:49 - 2013-09-28 19:49 - 00000000 ____D C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B
2013-09-28 19:48 - 2013-09-28 19:48 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-28 19:40 - 2013-09-28 20:41 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-28 19:40 - 2013-09-28 19:43 - 09502424 _____ (Malwarebytes Corporation ) C:\Users\Petra\Desktop\mbam-setup-1.60.1.1000.exe
2013-09-27 18:38 - 2013-09-27 18:38 - 00030820 _____ C:\Users\Petra\Desktop\combofix.txt
2013-09-27 18:37 - 2013-09-27 18:37 - 00030820 _____ C:\Users\Petra\Desktop\scan.txt
2013-09-27 18:29 - 2013-09-27 18:29 - 00030820 _____ C:\ComboFix.txt
2013-09-27 18:21 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-27 18:21 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-27 18:21 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-27 18:17 - 2013-09-27 18:29 - 00000000 ____D C:\Qoobox
2013-09-27 18:17 - 2013-09-27 18:27 - 00000000 ____D C:\Windows\erdnt
2013-09-27 18:16 - 2013-09-27 18:16 - 05129766 ____R (Swearware) C:\Users\Petra\Desktop\ComboFix.exe
2013-09-27 17:54 - 2013-09-27 17:54 - 00003121 _____ C:\Users\Petra\Desktop\gmer.txt
2013-09-27 17:26 - 2013-09-27 17:26 - 00024091 _____ C:\Users\Petra\Desktop\Addition.txt
2013-09-27 17:25 - 2013-09-27 17:25 - 00000000 ____D C:\FRST
2013-09-27 17:24 - 2013-09-27 17:24 - 00000504 _____ C:\Users\Petra\Desktop\defogger_disable.log
2013-09-27 17:24 - 2013-09-27 17:24 - 00000020 _____ C:\Users\Petra\defogger_reenable
2013-09-27 17:20 - 2013-09-27 17:20 - 00377856 _____ C:\Users\Petra\Desktop\gmer_2.1.19163.exe
2013-09-27 17:17 - 2013-09-27 17:17 - 00050477 _____ C:\Users\Petra\Desktop\Defogger.exe
2013-09-27 16:55 - 2013-09-29 18:43 - 00000000 ____D C:\Users\Petra\Desktop\studiveitsarah
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-26 15:18 - 2013-09-27 09:18 - 00000092 _____ C:\Users\Petra\AppData\Roaming\WB.CFG
2013-09-26 15:18 - 2013-09-27 09:18 - 00000005 _____ C:\Users\Petra\AppData\Roaming\WBPU-TTL.DAT
2013-09-26 14:55 - 2013-09-26 14:55 - 00004096 ____H C:\Users\Petra\AppData\Local\keyfile3.drm
2013-09-26 14:15 - 2013-09-26 14:15 - 00000000 ____D C:\Program Files\DivX
2013-09-26 14:14 - 2013-09-26 14:14 - 00000000 ____D C:\User Data
2013-09-26 14:08 - 2013-09-28 19:50 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-09-26 14:08 - 2013-09-26 14:16 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:08 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2013-09-26 14:07 - 2013-09-30 17:20 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-26 14:07 - 2013-09-29 20:12 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-26 14:07 - 2013-09-28 20:39 - 00004879 _____ C:\Windows\unins000.dat
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\ProgramData\DivX
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-26 14:07 - 2013-09-28 19:46 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-09-26 14:07 - 2013-09-26 14:07 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-26 14:07 - 2013-09-26 14:07 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:07 - 2012-02-26 16:47 - 00079360 _____ C:\Windows\SysWOW64\ff_vfw.dll
2013-09-26 14:07 - 2012-01-09 20:45 - 00178688 _____ C:\Windows\SysWOW64\unrar.dll
2013-09-26 14:07 - 2011-12-07 19:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll
2013-09-26 14:07 - 2011-12-07 19:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\lagarith.dll
2013-09-26 14:06 - 2013-09-26 14:06 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-26 14:02 - 2013-09-26 14:02 - 00000635 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-26 14:01 - 2013-09-26 14:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\NwDocx
2013-09-26 14:01 - 2013-09-26 14:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Docx2Rtf
2013-09-25 17:47 - 2013-09-25 17:47 - 00001084 _____ C:\Musik - Verknüpfung.lnk
2013-09-23 13:55 - 2013-09-27 16:56 - 00000000 ____D C:\Users\Petra\Desktop\Bachelorordner
2013-09-23 10:20 - 2013-09-23 10:28 - 00000000 ____D C:\Users\Petra\Documents\Fax
2013-09-19 19:00 - 2013-09-29 19:22 - 00000418 _____ C:\Windows\SysWOW64\AppLog.log
2013-09-19 17:04 - 2013-09-30 17:20 - 00000284 _____ C:\Windows\Tasks\RMAutoUpdate.job
2013-09-19 17:04 - 2013-09-29 19:00 - 00002860 _____ C:\Windows\System32\Tasks\RMSchedule
2013-09-19 17:04 - 2013-09-19 17:04 - 00002520 _____ C:\Windows\System32\Tasks\RMAutoUpdate
2013-09-19 17:04 - 2013-09-19 17:04 - 00001194 _____ C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
2013-09-19 17:04 - 2012-08-21 14:44 - 00513696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml.dll
2013-09-19 17:04 - 2012-08-21 14:44 - 00041632 _____ C:\Windows\system32\CleanMFT64.exe
2013-09-19 17:04 - 2008-09-17 21:17 - 00658432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2013-09-19 17:04 - 2008-04-02 15:54 - 01101824 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBox210.ocx
2013-09-19 17:04 - 2008-04-02 15:53 - 00880640 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBox10.ocx
2013-09-19 17:04 - 2008-04-02 15:53 - 00212992 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBoxVB12.ocx
2013-09-19 17:03 - 2013-09-30 17:20 - 00000000 ____D C:\Program Files (x86)\PC Tools Registry Mechanic
2013-09-19 17:01 - 2013-09-19 17:01 - 00001103 _____ C:\Users\Petra\Desktop\Screenshot Captor.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Windows\SysWOW64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Users\Petra\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\Documents\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\ProgramData\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-09-18 22:08 - 2013-09-18 22:08 - 00094208 _____ (DivX, Inc.) C:\Windows\SysWOW64\dpl100.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-16 00:57 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-16 00:57 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-16 00:57 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-16 00:57 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-16 00:57 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-16 00:57 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-16 00:57 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-16 00:57 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-16 00:57 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-14 12:28 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-14 12:28 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-14 12:28 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-14 12:28 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-14 12:28 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-14 12:28 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-14 12:28 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-14 12:28 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-14 12:28 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-14 12:28 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-14 12:28 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-14 12:28 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-14 12:28 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-14 12:28 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-14 12:28 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-14 12:28 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-14 12:28 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-02 09:18 - 2013-09-02 09:18 - 214423597 _____ C:\Windows\MEMORY.DMP
2013-09-02 09:18 - 2013-09-02 09:18 - 00290728 _____ C:\Windows\Minidump\090213-9609-01.dmp
2013-09-02 09:18 - 2013-09-02 09:18 - 00000000 ____D C:\Windows\Minidump
==================== One Month Modified Files and Folders =======
2013-09-30 17:28 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-30 17:28 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-30 17:24 - 2011-04-12 09:43 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-09-30 17:24 - 2011-04-12 09:43 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-09-30 17:24 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-30 17:23 - 2013-05-18 22:16 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8FB5B23C-B447-421A-B575-2FEED7F03542}
2013-09-30 17:23 - 2013-05-18 21:41 - 01715623 _____ C:\Windows\WindowsUpdate.log
2013-09-30 17:20 - 2013-09-26 14:07 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-30 17:20 - 2013-09-19 17:04 - 00000284 _____ C:\Windows\Tasks\RMAutoUpdate.job
2013-09-30 17:20 - 2013-09-19 17:03 - 00000000 ____D C:\Program Files (x86)\PC Tools Registry Mechanic
2013-09-30 17:20 - 2013-05-21 15:22 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-30 17:20 - 2013-05-18 23:44 - 00000380 _____ C:\Windows\Tasks\QIPdater 2012.job
2013-09-30 17:20 - 2013-05-18 23:37 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Skype
2013-09-30 17:20 - 2013-05-18 21:57 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-30 17:20 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-30 17:20 - 2009-07-14 06:51 - 00037434 _____ C:\Windows\setupact.log
2013-09-29 20:26 - 2013-09-29 20:26 - 00001104 _____ C:\Users\Petra\Desktop\AdwCleaner[S2].txt
2013-09-29 20:25 - 2013-09-28 20:13 - 00000000 ____D C:\AdwCleaner
2013-09-29 20:20 - 2010-11-21 05:47 - 00030638 _____ C:\Windows\PFRO.log
2013-09-29 20:12 - 2013-09-26 14:07 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-29 19:33 - 2013-05-21 15:22 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-29 19:22 - 2013-09-29 19:00 - 00000284 _____ C:\Windows\Tasks\RMSchedule.job
2013-09-29 19:22 - 2013-09-19 19:00 - 00000418 _____ C:\Windows\SysWOW64\AppLog.log
2013-09-29 19:00 - 2013-09-19 17:04 - 00002860 _____ C:\Windows\System32\Tasks\RMSchedule
2013-09-29 18:43 - 2013-09-27 16:55 - 00000000 ____D C:\Users\Petra\Desktop\studiveitsarah
2013-09-29 18:38 - 2013-05-18 22:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-29 18:24 - 2013-09-29 18:24 - 00000625 _____ C:\Users\Petra\Desktop\JRT2.txt
2013-09-29 18:23 - 2013-09-29 18:23 - 00000625 _____ C:\Users\Petra\Desktop\JRT.txt
2013-09-29 18:01 - 2013-09-29 18:01 - 00047395 _____ C:\Users\Petra\Desktop\FRST2.txt
2013-09-29 17:59 - 2013-09-29 17:58 - 01953880 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2013-09-29 17:48 - 2013-09-29 17:48 - 01030305 _____ (Thisisu) C:\Users\Petra\Desktop\JRT.exe
2013-09-29 17:48 - 2013-09-29 17:48 - 00000000 ____D C:\Windows\ERUNT
2013-09-29 17:43 - 2013-09-29 17:43 - 00008599 _____ C:\Users\Petra\Desktop\AdwCleaner[S1].txt
2013-09-29 17:41 - 2013-09-29 17:41 - 00010925 _____ C:\Users\Petra\Desktop\AdwCleaner[R1].txt
2013-09-29 17:41 - 2013-05-18 22:06 - 00000792 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-29 17:41 - 2013-05-18 21:42 - 00000995 _____ C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-29 17:39 - 2013-09-29 17:39 - 01042066 _____ C:\Users\Petra\Desktop\adwcleaner.exe
2013-09-29 17:18 - 2013-09-29 17:18 - 00040658 _____ C:\Users\Petra\Desktop\AdwCleaner[S0].txt
2013-09-28 20:41 - 2013-09-28 20:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Petra\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-28 20:41 - 2013-09-28 19:40 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-28 20:41 - 2013-05-18 22:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-28 20:39 - 2013-09-28 20:39 - 00715038 _____ C:\Windows\unins000.exe
2013-09-28 20:39 - 2013-09-26 14:07 - 00004879 _____ C:\Windows\unins000.dat
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\DivX
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-28 20:36 - 2013-09-28 20:26 - 00001266 _____ C:\Users\Public\Desktop\Image Converter.lnk
2013-09-28 20:29 - 2013-05-18 21:42 - 00000000 ____D C:\Users\Petra
2013-09-28 20:26 - 2013-09-28 20:26 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-28 20:20 - 2013-09-28 19:49 - 00001848 _____ C:\Users\Petra\Desktop\Search.lnk
2013-09-28 20:14 - 2013-05-18 22:23 - 00000000 ____D C:\Users\Petra\Desktop\Programme
2013-09-28 20:14 - 2013-05-18 21:42 - 00000000 ___RD C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-28 19:55 - 2013-05-18 23:50 - 00000000 ____D C:\Users\Petra\AppData\Roaming\TS3Client
2013-09-28 19:55 - 2013-05-18 23:37 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-09-28 19:50 - 2013-09-26 14:08 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-09-28 19:49 - 2013-09-28 19:49 - 00000000 ____D C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B
2013-09-28 19:48 - 2013-09-28 19:48 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-28 19:46 - 2013-09-26 14:07 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-09-28 19:43 - 2013-09-28 19:40 - 09502424 _____ (Malwarebytes Corporation ) C:\Users\Petra\Desktop\mbam-setup-1.60.1.1000.exe
2013-09-27 18:38 - 2013-09-27 18:38 - 00030820 _____ C:\Users\Petra\Desktop\combofix.txt
2013-09-27 18:37 - 2013-09-27 18:37 - 00030820 _____ C:\Users\Petra\Desktop\scan.txt
2013-09-27 18:29 - 2013-09-27 18:29 - 00030820 _____ C:\ComboFix.txt
2013-09-27 18:29 - 2013-09-27 18:17 - 00000000 ____D C:\Qoobox
2013-09-27 18:29 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-27 18:27 - 2013-09-27 18:17 - 00000000 ____D C:\Windows\erdnt
2013-09-27 18:25 - 2009-07-14 04:34 - 60030976 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 14680064 _____ C:\Windows\system32\config\SYSTEM.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\DEFAULT.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-27 18:16 - 2013-09-27 18:16 - 05129766 ____R (Swearware) C:\Users\Petra\Desktop\ComboFix.exe
2013-09-27 17:54 - 2013-09-27 17:54 - 00003121 _____ C:\Users\Petra\Desktop\gmer.txt
2013-09-27 17:26 - 2013-09-27 17:26 - 00024091 _____ C:\Users\Petra\Desktop\Addition.txt
2013-09-27 17:25 - 2013-09-27 17:25 - 00000000 ____D C:\FRST
2013-09-27 17:24 - 2013-09-27 17:24 - 00000504 _____ C:\Users\Petra\Desktop\defogger_disable.log
2013-09-27 17:24 - 2013-09-27 17:24 - 00000020 _____ C:\Users\Petra\defogger_reenable
2013-09-27 17:20 - 2013-09-27 17:20 - 00377856 _____ C:\Users\Petra\Desktop\gmer_2.1.19163.exe
2013-09-27 17:17 - 2013-09-27 17:17 - 00050477 _____ C:\Users\Petra\Desktop\Defogger.exe
2013-09-27 16:56 - 2013-09-23 13:55 - 00000000 ____D C:\Users\Petra\Desktop\Bachelorordner
2013-09-27 09:18 - 2013-09-26 15:18 - 00000092 _____ C:\Users\Petra\AppData\Roaming\WB.CFG
2013-09-27 09:18 - 2013-09-26 15:18 - 00000005 _____ C:\Users\Petra\AppData\Roaming\WBPU-TTL.DAT
2013-09-27 08:37 - 2009-07-14 06:45 - 00307312 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-26 14:55 - 2013-09-26 14:55 - 00004096 ____H C:\Users\Petra\AppData\Local\keyfile3.drm
2013-09-26 14:28 - 2013-05-18 22:02 - 00065552 _____ C:\Users\Petra\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-26 14:16 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:16 - 2013-05-18 23:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-09-26 14:16 - 2013-05-18 22:06 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-26 14:15 - 2013-09-26 14:15 - 00000000 ____D C:\Program Files\DivX
2013-09-26 14:14 - 2013-09-26 14:14 - 00000000 ____D C:\User Data
2013-09-26 14:07 - 2013-09-26 14:07 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-26 14:07 - 2013-09-26 14:07 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:06 - 2013-09-26 14:06 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-26 14:03 - 2013-09-26 14:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\NwDocx
2013-09-26 14:03 - 2013-09-26 14:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Docx2Rtf
2013-09-26 14:02 - 2013-09-26 14:02 - 00000635 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-26 14:02 - 2013-05-21 15:22 - 00000000 ____D C:\Users\Petra\AppData\Local\Google
2013-09-26 09:20 - 2013-05-20 12:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-26 09:20 - 2013-05-18 23:37 - 00000000 ____D C:\ProgramData\Skype
2013-09-25 17:47 - 2013-09-25 17:47 - 00001084 _____ C:\Musik - Verknüpfung.lnk
2013-09-23 10:28 - 2013-09-23 10:20 - 00000000 ____D C:\Users\Petra\Documents\Fax
2013-09-23 10:20 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-22 18:38 - 2013-05-18 22:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-22 18:38 - 2013-05-18 22:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-22 18:38 - 2013-05-18 22:20 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-19 17:04 - 2013-09-19 17:04 - 00002520 _____ C:\Windows\System32\Tasks\RMAutoUpdate
2013-09-19 17:04 - 2013-09-19 17:04 - 00001194 _____ C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00001103 _____ C:\Users\Petra\Desktop\Screenshot Captor.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Windows\SysWOW64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Users\Petra\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\Documents\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\ProgramData\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-09-18 22:08 - 2013-09-18 22:08 - 00094208 _____ (DivX, Inc.) C:\Windows\SysWOW64\dpl100.dll
2013-09-15 03:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-15 03:23 - 2013-05-18 21:42 - 00000000 ___RD C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-15 03:06 - 2013-08-14 18:52 - 00000000 ____D C:\Windows\system32\MRT
2013-09-15 03:05 - 2013-05-18 22:27 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-03 14:10 - 2013-08-04 11:52 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-09-02 09:18 - 2013-09-02 09:18 - 214423597 _____ C:\Windows\MEMORY.DMP
2013-09-02 09:18 - 2013-09-02 09:18 - 00290728 _____ C:\Windows\Minidump\090213-9609-01.dmp
2013-09-02 09:18 - 2013-09-02 09:18 - 00000000 ____D C:\Windows\Minidump
Some content of TEMP:
====================
C:\Users\Petra\AppData\Local\Temp\ICReinstall_ZipExtractorSetup(1).exe
C:\Users\Petra\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-22 18:53
==================== End Of Log ============================
|
|
01.10.2013, 11:46
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [97280 2009-07-14] ()
AppInit_DLLs-x32: c:\PROGRA~3\BitGuard\261673~1.238\{C16C1~1\BitGuard.dll [ ] ()
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF SearchPlugin: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\searchplugins\iminent.xml
FF Extension: Iminent Toolbar - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\ffxtlbr@iminent.com
FF Extension: WebConnect - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox@webconnect.co
FF Extension: BonanzaDeals - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}
FF Extension: firefox-hotfix - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox-hotfix@mozilla.org.xpi
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [ieadcoanfjloocmfafkebdnfefmohngj] - C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.crx
CHR HKLM-x32\...\Chrome\Extension: [pkhojieggfgllhllcegoffdcnmdeojgb] - C:\Program Files (x86)\IminentToolbar\1.8.25.0\iminent.crx
2013-09-26 14:08 - 2013-09-28 19:50 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-09-26 14:08 - 2013-09-26 14:16 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:08 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2013-09-26 14:07 - 2013-09-30 17:20 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-26 14:07 - 2013-09-29 20:12 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-26 14:07 - 2013-09-28 20:39 - 00004879 _____ C:\Windows\unins000.dat
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\ProgramData\DivX
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-26 14:07 - 2013-09-28 19:46 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-09-26 14:07 - 2013-09-26 14:07 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-26 14:07 - 2013-09-26 14:07 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:07 - 2012-02-26 16:47 - 00079360 _____ C:\Windows\SysWOW64\ff_vfw.dll
2013-09-26 14:07 - 2012-01-09 20:45 - 00178688 _____ C:\Windows\SysWOW64\unrar.dll
2013-09-26 14:07 - 2011-12-07 19:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll
2013-09-26 14:07 - 2011-12-07 19:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\lagarith.dll
2013-09-26 14:06 - 2013-09-26 14:06 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.10.2013, 13:10
| #9 |
| | Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen Hi Schrauber und tausend Dank. Es geht jetzt alles, das lass ich so.... Grüße Pesavei FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Petra (administrator) on PETRAPC on 02-10-2013 19:45:38
Running from C:\Users\Petra\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(brother Industries Ltd) C:\Windows\SysWOW64\brsvc01a.exe
(brother Industries Ltd) C:\Windows\SysWOW64\brss01a.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(QIP) C:\Program Files (x86)\QIP 2012 Jeak-Edition\qip.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8067616 2013-05-18] (Realtek Semiconductor)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20684656 2013-07-25] (Skype Technologies S.A.)
HKCU\...\Run: [Infium] - C:\Program Files (x86)\QIP 2012 Jeak-Edition\qip.exe [7318992 2011-12-28] (QIP)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [97280 2009-07-14] ()
AppInit_DLLs-x32: c:\PROGRA~3\BitGuard\261673~1.238\{C16C1~1\BitGuard.dll [ ] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\searchplugins\iminent.xml
FF Extension: Iminent Toolbar - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\ffxtlbr@iminent.com
FF Extension: WebConnect - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox@webconnect.co
FF Extension: firefox-hotfix - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox-hotfix@mozilla.org.xpi
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [ieadcoanfjloocmfafkebdnfefmohngj] - C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.crx
CHR HKLM-x32\...\Chrome\Extension: [pkhojieggfgllhllcegoffdcnmdeojgb] - C:\Program Files (x86)\IminentToolbar\1.8.25.0\iminent.crx
==================== Services (Whitelisted) =================
R2 Brother XP spl Service; C:\Windows\SysWOW64\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2013-05-18] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-01 10:32 - 2013-10-01 10:32 - 00000000 ____D C:\Windows\system32\appmgmt
2013-09-30 17:31 - 2013-09-30 17:31 - 00048338 _____ C:\Users\Petra\Desktop\FRST3.txt
2013-09-29 20:26 - 2013-09-29 20:26 - 00001104 _____ C:\Users\Petra\Desktop\AdwCleaner[S2].txt
2013-09-29 18:24 - 2013-09-29 18:24 - 00000625 _____ C:\Users\Petra\Desktop\JRT2.txt
2013-09-29 18:23 - 2013-09-29 18:23 - 00000625 _____ C:\Users\Petra\Desktop\JRT.txt
2013-09-29 18:01 - 2013-09-29 18:01 - 00047395 _____ C:\Users\Petra\Desktop\FRST2.txt
2013-09-29 17:58 - 2013-09-29 17:59 - 01953880 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2013-09-29 17:48 - 2013-09-29 17:48 - 01030305 _____ (Thisisu) C:\Users\Petra\Desktop\JRT.exe
2013-09-29 17:48 - 2013-09-29 17:48 - 00000000 ____D C:\Windows\ERUNT
2013-09-29 17:43 - 2013-09-29 17:43 - 00008599 _____ C:\Users\Petra\Desktop\AdwCleaner[S1].txt
2013-09-29 17:41 - 2013-09-29 17:41 - 00010925 _____ C:\Users\Petra\Desktop\AdwCleaner[R1].txt
2013-09-29 17:39 - 2013-09-29 17:39 - 01042066 _____ C:\Users\Petra\Desktop\adwcleaner.exe
2013-09-29 17:18 - 2013-09-29 17:18 - 00040658 _____ C:\Users\Petra\Desktop\AdwCleaner[S0].txt
2013-09-28 20:39 - 2013-09-28 20:39 - 00715038 _____ C:\Windows\unins000.exe
2013-09-28 20:39 - 2011-05-30 15:42 - 00255488 _____ C:\Windows\system32\xvidvfw.dll
2013-09-28 20:39 - 2011-05-30 15:42 - 00240640 _____ C:\Windows\SysWOW64\xvidvfw.dll
2013-09-28 20:39 - 2011-05-23 11:52 - 00153088 _____ C:\Windows\SysWOW64\xvid.ax
2013-09-28 20:39 - 2011-05-23 09:49 - 00173568 _____ C:\Windows\system32\xvid.ax
2013-09-28 20:39 - 2011-05-23 09:46 - 00645632 _____ C:\Windows\SysWOW64\xvidcore.dll
2013-09-28 20:39 - 2011-05-23 09:45 - 00696832 _____ C:\Windows\system32\xvidcore.dll
2013-09-28 20:26 - 2013-09-28 20:36 - 00001266 _____ C:\Users\Public\Desktop\Image Converter.lnk
2013-09-28 20:26 - 2013-09-28 20:26 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-28 20:13 - 2013-09-29 20:25 - 00000000 ____D C:\AdwCleaner
2013-09-28 19:49 - 2013-09-28 20:20 - 00001848 _____ C:\Users\Petra\Desktop\Search.lnk
2013-09-28 19:49 - 2013-09-28 19:49 - 00000000 ____D C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B
2013-09-28 19:48 - 2013-09-28 19:48 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-28 19:40 - 2013-09-28 20:41 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-27 18:38 - 2013-09-27 18:38 - 00030820 _____ C:\Users\Petra\Desktop\combofix.txt
2013-09-27 18:37 - 2013-09-27 18:37 - 00030820 _____ C:\Users\Petra\Desktop\scan.txt
2013-09-27 18:29 - 2013-09-27 18:29 - 00030820 _____ C:\ComboFix.txt
2013-09-27 18:21 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-27 18:21 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-27 18:21 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-27 18:21 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-27 18:17 - 2013-09-27 18:29 - 00000000 ____D C:\Qoobox
2013-09-27 18:17 - 2013-09-27 18:27 - 00000000 ____D C:\Windows\erdnt
2013-09-27 18:16 - 2013-09-27 18:16 - 05129766 ____R (Swearware) C:\Users\Petra\Desktop\ComboFix.exe
2013-09-27 17:54 - 2013-09-27 17:54 - 00003121 _____ C:\Users\Petra\Desktop\gmer.txt
2013-09-27 17:26 - 2013-09-27 17:26 - 00024091 _____ C:\Users\Petra\Desktop\Addition.txt
2013-09-27 17:25 - 2013-09-27 17:25 - 00000000 ____D C:\FRST
2013-09-27 17:24 - 2013-09-27 17:24 - 00000504 _____ C:\Users\Petra\Desktop\defogger_disable.log
2013-09-27 17:24 - 2013-09-27 17:24 - 00000020 _____ C:\Users\Petra\defogger_reenable
2013-09-27 17:20 - 2013-09-27 17:20 - 00377856 _____ C:\Users\Petra\Desktop\gmer_2.1.19163.exe
2013-09-27 17:17 - 2013-09-27 17:17 - 00050477 _____ C:\Users\Petra\Desktop\Defogger.exe
2013-09-27 16:55 - 2013-09-29 18:43 - 00000000 ____D C:\Users\Petra\Desktop\studiveitsarah
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-26 15:18 - 2013-09-27 09:18 - 00000092 _____ C:\Users\Petra\AppData\Roaming\WB.CFG
2013-09-26 15:18 - 2013-09-27 09:18 - 00000005 _____ C:\Users\Petra\AppData\Roaming\WBPU-TTL.DAT
2013-09-26 14:55 - 2013-09-26 14:55 - 00004096 ____H C:\Users\Petra\AppData\Local\keyfile3.drm
2013-09-26 14:15 - 2013-09-26 14:15 - 00000000 ____D C:\Program Files\DivX
2013-09-26 14:14 - 2013-09-26 14:14 - 00000000 ____D C:\User Data
2013-09-26 14:08 - 2013-10-01 10:17 - 00003122 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-09-26 14:08 - 2013-09-26 14:16 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:08 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2013-09-26 14:07 - 2013-10-01 10:22 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-26 14:07 - 2013-10-01 10:22 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-26 14:07 - 2013-10-01 10:20 - 00003680 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-26 14:07 - 2013-10-01 10:19 - 00003932 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-26 14:07 - 2013-10-01 10:19 - 00003110 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-09-26 14:07 - 2013-09-28 20:39 - 00004879 _____ C:\Windows\unins000.dat
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\ProgramData\DivX
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-26 14:07 - 2013-09-28 20:39 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:07 - 2012-02-26 16:47 - 00079360 _____ C:\Windows\SysWOW64\ff_vfw.dll
2013-09-26 14:07 - 2012-01-09 20:45 - 00178688 _____ C:\Windows\SysWOW64\unrar.dll
2013-09-26 14:07 - 2011-12-07 19:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll
2013-09-26 14:07 - 2011-12-07 19:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\lagarith.dll
2013-09-26 14:06 - 2013-10-01 12:33 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-26 14:02 - 2013-09-26 14:02 - 00000635 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-26 14:01 - 2013-09-26 14:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\NwDocx
2013-09-26 14:01 - 2013-09-26 14:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Docx2Rtf
2013-09-25 17:47 - 2013-09-25 17:47 - 00001084 _____ C:\Musik - Verknüpfung.lnk
2013-09-23 13:55 - 2013-09-27 16:56 - 00000000 ____D C:\Users\Petra\Desktop\Bachelorordner
2013-09-23 10:20 - 2013-09-23 10:28 - 00000000 ____D C:\Users\Petra\Documents\Fax
2013-09-19 19:00 - 2013-09-29 19:22 - 00000418 _____ C:\Windows\SysWOW64\AppLog.log
2013-09-19 17:01 - 2013-09-19 17:01 - 00001103 _____ C:\Users\Petra\Desktop\Screenshot Captor.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Windows\SysWOW64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Users\Petra\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\Documents\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\ProgramData\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-09-18 22:08 - 2013-09-18 22:08 - 00094208 _____ (DivX, Inc.) C:\Windows\SysWOW64\dpl100.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-16 00:57 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-16 00:57 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-16 00:57 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-16 00:57 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-16 00:57 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-16 00:57 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-16 00:57 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-16 00:57 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-16 00:57 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-14 12:28 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-14 12:28 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-14 12:28 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-14 12:28 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-14 12:28 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-14 12:28 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-14 12:28 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-14 12:28 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-14 12:28 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-14 12:28 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-14 12:28 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-14 12:28 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-14 12:28 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-14 12:28 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-14 12:28 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-14 12:28 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-14 12:28 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-02 09:18 - 2013-09-02 09:18 - 214423597 _____ C:\Windows\MEMORY.DMP
2013-09-02 09:18 - 2013-09-02 09:18 - 00290728 _____ C:\Windows\Minidump\090213-9609-01.dmp
2013-09-02 09:18 - 2013-09-02 09:18 - 00000000 ____D C:\Windows\Minidump
==================== One Month Modified Files and Folders =======
2013-10-02 19:45 - 2011-04-12 09:43 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-10-02 19:45 - 2011-04-12 09:43 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-10-02 19:45 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-02 19:44 - 2013-05-18 23:37 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Skype
2013-10-02 19:42 - 2013-05-18 21:41 - 01775161 _____ C:\Windows\WindowsUpdate.log
2013-10-02 19:42 - 2009-07-14 06:51 - 00038601 _____ C:\Windows\setupact.log
2013-10-02 19:41 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-02 08:21 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-02 08:21 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-01 21:39 - 2010-11-21 05:47 - 00031694 _____ C:\Windows\PFRO.log
2013-10-01 12:33 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-10-01 10:32 - 2013-10-01 10:32 - 00000000 ____D C:\Windows\system32\appmgmt
2013-10-01 10:22 - 2013-09-26 14:07 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-10-01 10:22 - 2013-09-26 14:07 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-10-01 10:22 - 2013-05-21 15:22 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-01 10:22 - 2013-05-21 15:22 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-01 10:22 - 2013-05-18 23:44 - 00000380 _____ C:\Windows\Tasks\QIPdater 2012.job
2013-10-01 10:22 - 2013-05-18 22:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-01 10:20 - 2013-09-26 14:07 - 00003680 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-10-01 10:20 - 2013-05-18 22:16 - 00003928 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8FB5B23C-B447-421A-B575-2FEED7F03542}
2013-10-01 10:19 - 2013-09-26 14:07 - 00003932 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-10-01 10:19 - 2013-09-26 14:07 - 00003110 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-10-01 10:19 - 2013-05-21 15:22 - 00004116 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-01 10:19 - 2013-05-21 15:22 - 00003864 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-01 10:19 - 2013-05-18 23:44 - 00002760 _____ C:\Windows\System32\Tasks\QIPdater 2012
2013-10-01 10:17 - 2013-09-26 14:08 - 00003122 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-10-01 10:16 - 2013-05-18 22:20 - 00003824 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-01 10:15 - 2013-05-18 23:48 - 00003062 _____ C:\Windows\System32\Tasks\{CFDF8F84-BB1D-4F19-97C1-A3B29961EF78}
2013-10-01 10:06 - 2013-05-18 21:57 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-30 17:31 - 2013-09-30 17:31 - 00048338 _____ C:\Users\Petra\Desktop\FRST3.txt
2013-09-29 20:26 - 2013-09-29 20:26 - 00001104 _____ C:\Users\Petra\Desktop\AdwCleaner[S2].txt
2013-09-29 20:25 - 2013-09-28 20:13 - 00000000 ____D C:\AdwCleaner
2013-09-29 19:22 - 2013-09-19 19:00 - 00000418 _____ C:\Windows\SysWOW64\AppLog.log
2013-09-29 18:43 - 2013-09-27 16:55 - 00000000 ____D C:\Users\Petra\Desktop\studiveitsarah
2013-09-29 18:24 - 2013-09-29 18:24 - 00000625 _____ C:\Users\Petra\Desktop\JRT2.txt
2013-09-29 18:23 - 2013-09-29 18:23 - 00000625 _____ C:\Users\Petra\Desktop\JRT.txt
2013-09-29 18:01 - 2013-09-29 18:01 - 00047395 _____ C:\Users\Petra\Desktop\FRST2.txt
2013-09-29 17:59 - 2013-09-29 17:58 - 01953880 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2013-09-29 17:48 - 2013-09-29 17:48 - 01030305 _____ (Thisisu) C:\Users\Petra\Desktop\JRT.exe
2013-09-29 17:48 - 2013-09-29 17:48 - 00000000 ____D C:\Windows\ERUNT
2013-09-29 17:43 - 2013-09-29 17:43 - 00008599 _____ C:\Users\Petra\Desktop\AdwCleaner[S1].txt
2013-09-29 17:41 - 2013-09-29 17:41 - 00010925 _____ C:\Users\Petra\Desktop\AdwCleaner[R1].txt
2013-09-29 17:41 - 2013-05-18 22:06 - 00000792 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-29 17:41 - 2013-05-18 21:42 - 00000995 _____ C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-29 17:39 - 2013-09-29 17:39 - 01042066 _____ C:\Users\Petra\Desktop\adwcleaner.exe
2013-09-29 17:18 - 2013-09-29 17:18 - 00040658 _____ C:\Users\Petra\Desktop\AdwCleaner[S0].txt
2013-09-28 20:41 - 2013-09-28 19:40 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-28 20:41 - 2013-05-18 22:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-28 20:39 - 2013-09-28 20:39 - 00715038 _____ C:\Windows\unins000.exe
2013-09-28 20:39 - 2013-09-26 14:07 - 00004879 _____ C:\Windows\unins000.dat
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\DivX
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-28 20:39 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-28 20:36 - 2013-09-28 20:26 - 00001266 _____ C:\Users\Public\Desktop\Image Converter.lnk
2013-09-28 20:29 - 2013-05-18 21:42 - 00000000 ____D C:\Users\Petra
2013-09-28 20:26 - 2013-09-28 20:26 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-28 20:20 - 2013-09-28 19:49 - 00001848 _____ C:\Users\Petra\Desktop\Search.lnk
2013-09-28 20:14 - 2013-05-18 22:23 - 00000000 ____D C:\Users\Petra\Desktop\Programme
2013-09-28 20:14 - 2013-05-18 21:42 - 00000000 ___RD C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-28 19:55 - 2013-05-18 23:50 - 00000000 ____D C:\Users\Petra\AppData\Roaming\TS3Client
2013-09-28 19:55 - 2013-05-18 23:37 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-09-28 19:49 - 2013-09-28 19:49 - 00000000 ____D C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B
2013-09-28 19:48 - 2013-09-28 19:48 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-27 18:38 - 2013-09-27 18:38 - 00030820 _____ C:\Users\Petra\Desktop\combofix.txt
2013-09-27 18:37 - 2013-09-27 18:37 - 00030820 _____ C:\Users\Petra\Desktop\scan.txt
2013-09-27 18:29 - 2013-09-27 18:29 - 00030820 _____ C:\ComboFix.txt
2013-09-27 18:29 - 2013-09-27 18:17 - 00000000 ____D C:\Qoobox
2013-09-27 18:29 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-27 18:27 - 2013-09-27 18:17 - 00000000 ____D C:\Windows\erdnt
2013-09-27 18:25 - 2009-07-14 04:34 - 60030976 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 14680064 _____ C:\Windows\system32\config\SYSTEM.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\DEFAULT.bak
2013-09-27 18:25 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-27 18:16 - 2013-09-27 18:16 - 05129766 ____R (Swearware) C:\Users\Petra\Desktop\ComboFix.exe
2013-09-27 17:54 - 2013-09-27 17:54 - 00003121 _____ C:\Users\Petra\Desktop\gmer.txt
2013-09-27 17:26 - 2013-09-27 17:26 - 00024091 _____ C:\Users\Petra\Desktop\Addition.txt
2013-09-27 17:25 - 2013-09-27 17:25 - 00000000 ____D C:\FRST
2013-09-27 17:24 - 2013-09-27 17:24 - 00000504 _____ C:\Users\Petra\Desktop\defogger_disable.log
2013-09-27 17:24 - 2013-09-27 17:24 - 00000020 _____ C:\Users\Petra\defogger_reenable
2013-09-27 17:20 - 2013-09-27 17:20 - 00377856 _____ C:\Users\Petra\Desktop\gmer_2.1.19163.exe
2013-09-27 17:17 - 2013-09-27 17:17 - 00050477 _____ C:\Users\Petra\Desktop\Defogger.exe
2013-09-27 16:56 - 2013-09-23 13:55 - 00000000 ____D C:\Users\Petra\Desktop\Bachelorordner
2013-09-27 09:18 - 2013-09-26 15:18 - 00000092 _____ C:\Users\Petra\AppData\Roaming\WB.CFG
2013-09-27 09:18 - 2013-09-26 15:18 - 00000005 _____ C:\Users\Petra\AppData\Roaming\WBPU-TTL.DAT
2013-09-27 08:37 - 2009-07-14 06:45 - 00307312 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-26 14:55 - 2013-09-26 14:55 - 00004096 ____H C:\Users\Petra\AppData\Local\keyfile3.drm
2013-09-26 14:28 - 2013-05-18 22:02 - 00065552 _____ C:\Users\Petra\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-26 14:16 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:16 - 2013-05-18 23:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-09-26 14:16 - 2013-05-18 22:06 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-26 14:15 - 2013-09-26 14:15 - 00000000 ____D C:\Program Files\DivX
2013-09-26 14:14 - 2013-09-26 14:14 - 00000000 ____D C:\User Data
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:03 - 2013-09-26 14:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\NwDocx
2013-09-26 14:03 - 2013-09-26 14:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Docx2Rtf
2013-09-26 14:02 - 2013-09-26 14:02 - 00000635 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-26 14:02 - 2013-05-21 15:22 - 00000000 ____D C:\Users\Petra\AppData\Local\Google
2013-09-26 09:20 - 2013-05-20 12:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-26 09:20 - 2013-05-18 23:37 - 00000000 ____D C:\ProgramData\Skype
2013-09-25 17:47 - 2013-09-25 17:47 - 00001084 _____ C:\Musik - Verknüpfung.lnk
2013-09-23 10:28 - 2013-09-23 10:20 - 00000000 ____D C:\Users\Petra\Documents\Fax
2013-09-23 10:20 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-22 18:38 - 2013-05-18 22:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-22 18:38 - 2013-05-18 22:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-19 17:01 - 2013-09-19 17:01 - 00001103 _____ C:\Users\Petra\Desktop\Screenshot Captor.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Windows\SysWOW64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Users\Petra\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\Documents\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\ProgramData\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-09-18 22:08 - 2013-09-18 22:08 - 00094208 _____ (DivX, Inc.) C:\Windows\SysWOW64\dpl100.dll
2013-09-15 03:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-15 03:23 - 2013-05-18 21:42 - 00000000 ___RD C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-15 03:06 - 2013-08-14 18:52 - 00000000 ____D C:\Windows\system32\MRT
2013-09-15 03:05 - 2013-05-18 22:27 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-03 14:10 - 2013-08-04 11:52 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-09-02 09:18 - 2013-09-02 09:18 - 214423597 _____ C:\Windows\MEMORY.DMP
2013-09-02 09:18 - 2013-09-02 09:18 - 00290728 _____ C:\Windows\Minidump\090213-9609-01.dmp
2013-09-02 09:18 - 2013-09-02 09:18 - 00000000 ____D C:\Windows\Minidump
Some content of TEMP:
====================
C:\Users\Petra\AppData\Local\Temp\ICReinstall_ZipExtractorSetup(1).exe
C:\Users\Petra\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-22 18:53
==================== End Of Log ============================
|
|
04.10.2013, 01:55
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen Logfiles von dem Fix und ESET und Co`?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen |
| advanced system protector, bitguard, bonanzadeals, farbar, farbar recovery scan tool, minidump, newtab, plug-in, pup.bprotector, pup.optional.babsolution.a, pup.optional.babylon.a, pup.optional.bitguard.a, pup.optional.bprotector.a, pup.optional.browsefox.a, pup.optional.browserdefender.a, pup.optional.bundleinstaller.a, pup.optional.datamngr.a, pup.optional.delta, pup.optional.delta.a, pup.optional.digitalsite.a, pup.optional.dprotect.a, pup.optional.elex, pup.optional.elex.a, pup.optional.esafe.a, pup.optional.iminent, pup.optional.iminent.a, pup.optional.installcore.a, pup.optional.performersoft.a, pup.optional.qvo6.a, pup.optional.softonic, regclean, richtlinie, sprotection |
Linear-Darstellung
