| |
| |||||||
Log-Analyse und Auswertung: Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
24.12.2013, 17:51
| #1 |
| |  Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? Hallo liebes Forum  Als ich heute gegen 15:00 Uhr den Computer startete, erschien der BKA Virus. Sie forderten 100€ via paysafecard. Ich bin nach einer Anleitung von Chip vorgegangen. Erst habe ich den PC ausgemacht, indem ich 10 Sek. die Power Taste drückte, danach habe ich ihn im abgesicherten Modus gestartet. Man sollte laut Chip erstmal alle auf C: gespeicherten .exe Datein nach dem Änderungsdatum filtern und auffällige (sowas wie xutajg) löschen. Bei mir war aber nur eine Dropbox.exe mit einem Textdatei Logo heute um 15:42 geändert worden, also bei dem PC-Start mit dem BKA-Virus. Zuletzt war ich online von 10-13h heute morgen. Nach einem Neustart stellte ich fest, dass es nichts gebracht hat. So habe ich wieder rebootet, diesmal mit der Eingabeaufforderung. Ich habe den PC auf den 22.12.2013 zurückgesetzt und der Trojaner bzw. der Desktopblocker war verschwunden. Da ich aber gehört habe, dass der Trojaner Webcams, Mikrofone und verschlüsselte Daten wie z.B. Bankdaten abfängt, möchte ich gerne auf Nummer sicher gehen und euch mal um Rat fragen. Ich habe im Anhang die Logfiles von GMER, FRST und DEFOGGER angehängt. Danke schonmal für die Antwort Liebe Grüße und frohe Weihnachten Yannick Geändert von yannin (24.12.2013 um 18:32 Uhr) |
|
25.12.2013, 08:32
| #2 |
| /// the machine /// TB-Ausbilder    | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
25.12.2013, 12:00
| #3 |
| | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? Na klar
__________________ Sorry  defogger disable: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:34 on 24/12/2013 (yannick)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-12-2013
Ran by yannick (administrator) on YANNICK-PC on 24-12-2013 16:35:15
Running from C:\Users\yannick\Desktop
Microsoft® Windows Vista™ Home Basic Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\System32\ASGT.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Ralink Technology, Corp.) C:\Program Files\TP-LINK\TP-LINK Wireless Configuration Utility\Service\RaRegistry.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.1.3\ToolbarUpdater.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(LogMeIn Inc.) C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
() C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.1.3\loggingserver.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [vProt] - C:\Program Files\AVG SafeGuard toolbar\vprot.exe [2334384 2013-11-20] ()
HKLM\...\Run: [Nvtmru] - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [3806544 2013-11-29] (LogMeIn Inc.)
HKLM\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-24] (AVAST Software)
HKCU\...\Run: [RGSC] - C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20684656 2013-07-25] (Skype Technologies S.A.)
HKCU\...\Run: [ECFSTServ] - C:\Users\yannick\Desktop\lotsen\Easy Clearance 3\ECFSTServ.exe [1067520 2010-04-18] ()
HKCU\...\Run: [MP3 Skype Recorder] - C:\Program Files\MP3 Skype Recorder\MP3 Skype Recorder.exe [1975296 2011-11-17] (Alexander Nikiforov)
HKCU\...\Run: [DT Emphelungstool] - "C:\Users\yannick\AppData\Local\Deutsche Telekom\Empfehlungstool\DTEmpfehlungstool.exe" 2
HKCU\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [35768 2013-12-09] (Overwolf)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
Startup: C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\yannick\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wecker für Windows 6.lnk
ShortcutTarget: Wecker für Windows 6.lnk -> C:\Program Files\Wecker6\Wecker.exe (Christoph Bünger Software)
==================== Internet (Whitelisted) ====================
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://mysearch.avg.com/search?cid={881AAD1F-10BF-49C4-AEA4-DDBA0016B66A}&mid=6d1b4bb91e7f47d3a16b196354bdc977-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ge/finishurl=hxxp://toolbar.avg.com/p-install?lang=ge&ds=ht011&coid=avgtbdisht&pr=sa&d=2013-10-26 17:08:45&v=17.0.0.12&pid=safeguard&sg=0&sap=dsp&q={searchTerms}
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG SafeGuard toolbar\17.1.3.1\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG SafeGuard toolbar\17.1.3.1\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\MP3 Skype Recorder\Skype4COM.dll (Skype Technologies)
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\17.1.3\ViProtocol.dll (AVG Secure Search)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\yannick\AppData\Roaming\Mozilla\Firefox\Profiles\b4cu94sg.default
FF Homepage: www.google.de
FF Keyword.URL: hxxp://www.google.de/search?q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\17.1.3\\npsitesafety.dll (AVG Technologies)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nullsoft.com/winampDetector;version=1 - C:\Program Files\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\yannick\AppData\Roaming\Mozilla\Firefox\Profiles\b4cu94sg.default\searchplugins\safeguard-secure-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Hilfe Assistent - C:\Users\yannick\AppData\Roaming\Mozilla\Firefox\Profiles\b4cu94sg.default\Extensions\{}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\17.1.3.1
FF Extension: AVG SafeGuard toolbar - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\17.1.3.1
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
========================== Services (Whitelisted) =================
R2 ASGT; C:\Windows\System32\ASGT.exe [55296 2012-01-17] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-24] (AVAST Software)
R2 Hamachi2Svc; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [1664336 2013-11-29] (LogMeIn Inc.)
R2 LMIGuardianSvc; C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe [375056 2013-10-11] (LogMeIn, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [96184 2013-12-09] (Overwolf)
R2 RalinkRegistryWriter; C:\Program Files\TP-LINK\TP-LINK Wireless Configuration Utility\Service\RaRegistry.exe [375872 2011-12-26] (Ralink Technology, Corp.)
R2 vToolbarUpdater17.1.3; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.1.3\ToolbarUpdater.exe [1643696 2013-11-20] (AVG Secure Search)
==================== Drivers (Whitelisted) ====================
R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
S3 AIDA64Driver; C:\Program Files\FinalWire\AIDA64 Extreme Edition\kerneld.x32 [28824 2011-08-18] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2013-12-24] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [54832 2013-12-24] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49944 2013-12-24] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [775952 2013-12-24] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [410528 2013-12-24] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57672 2013-12-24] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [180248 2013-12-24] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-20] (AVG Technologies)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
R3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [1093472 2012-02-14] (Ralink Technology Corp.)
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
R4 IOMap; \??\C:\Windows\system32\drivers\IOMap.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-24 16:35 - 2013-12-24 16:35 - 00013606 _____ C:\Users\yannick\Desktop\FRST.txt
2013-12-24 16:35 - 2013-12-24 16:35 - 00000000 ____D C:\FRST
2013-12-24 16:34 - 2013-12-24 16:34 - 00377856 _____ C:\Users\yannick\Desktop\gmer_2.1.19163.exe
2013-12-24 16:34 - 2013-12-24 16:34 - 00000476 _____ C:\Users\yannick\Desktop\defogger_disable.log
2013-12-24 16:33 - 2013-12-24 16:33 - 01061581 _____ (Farbar) C:\Users\yannick\Desktop\FRST.exe
2013-12-24 16:33 - 2013-12-24 16:33 - 00050477 _____ C:\Users\yannick\Desktop\Defogger.exe
2013-12-24 16:29 - 2013-12-24 16:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\AVAST Software
2013-12-24 16:28 - 2013-12-24 16:28 - 00775952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00270240 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-24 16:28 - 2013-12-24 16:28 - 00180248 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00057672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00054832 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00049944 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-24 16:28 - 2013-12-24 16:28 - 00001879 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-12-24 16:27 - 2013-12-24 16:27 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-24 16:25 - 2013-12-24 16:25 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-24 16:19 - 2013-12-24 16:21 - 91412976 _____ (AVAST Software) C:\Users\yannick\Desktop\avast_free_antivirus_setup.exe
2013-12-24 13:34 - 2013-12-24 16:09 - 95025368 ____T C:\ProgramData\9rjr0jwv.fee
2013-12-24 13:34 - 2013-12-24 16:09 - 00000000 _____ C:\ProgramData\9rjr0jwv.odd
2013-12-24 13:34 - 2013-12-24 13:34 - 00217576 _____ (Microsoft Corporation) C:\ProgramData\vwj0rjr9.jss
2013-12-23 15:31 - 2013-12-23 15:31 - 00000000 ____D C:\Users\yannick\Desktop\FlusiFix-2006 V5.0
2013-12-23 11:53 - 2013-12-23 11:54 - 00000000 ____D C:\Users\yannick\Desktop\b737soundpack
2013-12-22 21:25 - 2013-12-22 21:25 - 00000000 ____D C:\Program Files\WinPcap
2013-12-22 21:24 - 2013-12-22 21:29 - 00000000 ____D C:\Users\yannick\Documents\Freemake
2013-12-22 21:24 - 2013-12-22 21:25 - 00000000 ____D C:\ProgramData\Freemake
2013-12-22 21:24 - 2013-12-22 21:24 - 00000000 ____D C:\Program Files\Freemake
2013-12-22 20:05 - 2013-12-23 15:14 - 00000000 ____D C:\Users\yannick\Desktop\WOAI
2013-12-22 20:05 - 2013-12-22 20:08 - 02256077 _____ C:\Users\yannick\Desktop\AIFP2209.zip
2013-12-22 14:20 - 2013-12-22 14:20 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
2013-12-22 14:16 - 2013-12-22 14:16 - 00000000 ____D C:\Program Files\Audio Recorder Pro
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Program Files\IrfanView
2013-12-20 18:29 - 2013-12-20 18:30 - 08835307 _____ C:\Users\yannick\Desktop\Charts.zip
2013-12-20 16:56 - 2013-12-20 17:00 - 08861741 _____ C:\Users\yannick\Desktop\openvfr_terrain_ch_20.zip
2013-12-20 16:56 - 2013-12-20 16:56 - 00048674 _____ C:\Users\yannick\Desktop\openvfr_poi_ch_20.zip
2013-12-20 16:15 - 2013-12-20 16:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-20 15:52 - 2013-12-20 15:52 - 00513272 _____ C:\Users\yannick\Documents\fairtrade hausarbeit.odt
2013-12-20 15:49 - 2013-12-20 15:49 - 01920054 _____ C:\Users\yannick\Desktop\fairtrade.bmp
2013-12-20 15:44 - 2013-12-20 15:44 - 00000872 _____ C:\Users\yannick\AppData\Local\recently-used.xbel
2013-12-18 19:20 - 2013-12-18 20:33 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IvAi
2013-12-18 19:19 - 2013-12-18 19:19 - 00000849 _____ C:\Users\yannick\Desktop\IvAi - IVAO Interface.lnk
2013-12-12 13:08 - 2013-12-12 13:08 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-12-09 21:58 - 2013-12-09 21:58 - 00416248 _____ C:\Users\yannick\österreicher.wav
2013-12-09 12:16 - 2013-12-09 12:16 - 00048590 _____ C:\Users\yannick\mitschnitt SL.aup
2013-12-09 12:16 - 2013-12-09 12:16 - 00000000 ____D C:\Users\yannick\mitschnitt SL_data
2013-12-06 16:31 - 2013-12-21 08:53 - 00000931 _____ C:\Users\yannick\Desktop\Dropbox.lnk
2013-12-06 16:29 - 2013-12-21 08:53 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-06 16:29 - 2013-12-06 16:30 - 00000000 ____D C:\Program Files\Dropbox
2013-12-06 16:26 - 2013-12-24 15:44 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Dropbox
2013-12-05 22:03 - 2013-12-05 22:12 - 00000000 ____D C:\Users\yannick\Desktop\ILS SIM V4
2013-12-03 18:06 - 2013-12-03 18:06 - 00001106 _____ C:\Users\Public\Desktop\Hannover RP .lnk
2013-12-03 16:09 - 2013-12-03 16:09 - 00000000 ____D C:\Program Files\LogMeIn Hamachi
2013-11-29 20:21 - 2013-12-09 19:30 - 00003238 _____ C:\Users\yannick\Desktop\sonsim.ini
2013-11-29 20:21 - 2011-11-27 15:33 - 03584512 _____ (Kaweb.de) C:\Users\yannick\Desktop\sonsim.exe
2013-11-24 12:09 - 2013-11-24 12:09 - 00001146 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2013-11-24 12:06 - 2013-11-24 12:06 - 00000000 ____D C:\Program Files\AGEIA Technologies
2013-11-24 12:05 - 2013-11-24 12:05 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\Startmenü
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\Netzwerkumgebung
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\Druckumgebung
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Eigene Musik
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Eigene Bilder
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Verlauf
2013-11-24 12:05 - 2013-03-30 10:15 - 00000000 ____D C:\Users\UpdatusUser\AppData\Roaming\Macromedia
2013-11-24 12:05 - 2013-03-05 09:22 - 00000000 ___RD C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-24 12:05 - 2013-03-05 09:22 - 00000000 ___RD C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-24 12:02 - 2013-11-14 12:57 - 22951200 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv32.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 17560352 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 15862272 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2um.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 10446112 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2013-11-24 12:02 - 2013-11-14 12:57 - 09663656 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 09619872 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 02947872 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 02747680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 02697248 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 01049888 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco3233182.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 00893728 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco3233182.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco32.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 00161056 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda32v.sys
2013-11-24 12:02 - 2013-11-14 12:57 - 00028448 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap32.dll
2013-11-24 12:02 - 2013-11-14 12:57 - 00018439 _____ C:\Windows\system32\nvinfo.pb
2013-11-24 11:59 - 2013-11-24 11:59 - 00000000 ____D C:\Users\yannick\{7dd9c515-55cd-44f3-8b02-25f45979a8b1}
2013-11-24 11:56 - 2013-11-24 11:56 - 00000000 ____D C:\Users\yannick\{70c4a7a7-89ab-485b-90f8-2b6c343002d5}
2013-11-24 11:54 - 2013-11-24 11:54 - 00000000 ____D C:\NVIDIA
2013-11-24 11:08 - 2013-11-24 11:24 - 199358496 _____ (NVIDIA Corporation) C:\Users\yannick\Downloads\331.82-desktop-win8-win7-winvista-32bit-international-whql.exe
==================== One Month Modified Files and Folders =======
2013-12-24 16:35 - 2013-12-24 16:35 - 00013606 _____ C:\Users\yannick\Desktop\FRST.txt
2013-12-24 16:35 - 2013-12-24 16:35 - 00000000 ____D C:\FRST
2013-12-24 16:34 - 2013-12-24 16:34 - 00377856 _____ C:\Users\yannick\Desktop\gmer_2.1.19163.exe
2013-12-24 16:34 - 2013-12-24 16:34 - 00000476 _____ C:\Users\yannick\Desktop\defogger_disable.log
2013-12-24 16:33 - 2013-12-24 16:33 - 01061581 _____ (Farbar) C:\Users\yannick\Desktop\FRST.exe
2013-12-24 16:33 - 2013-12-24 16:33 - 00050477 _____ C:\Users\yannick\Desktop\Defogger.exe
2013-12-24 16:32 - 2013-10-31 18:20 - 00001100 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-24 16:29 - 2013-12-24 16:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\AVAST Software
2013-12-24 16:28 - 2013-12-24 16:28 - 00775952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00270240 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-24 16:28 - 2013-12-24 16:28 - 00180248 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00057672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00054832 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00049944 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-24 16:28 - 2013-12-24 16:28 - 00001879 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-12-24 16:27 - 2013-12-24 16:27 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-24 16:25 - 2013-12-24 16:25 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-24 16:24 - 2013-03-01 13:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-24 16:21 - 2013-12-24 16:19 - 91412976 _____ (AVAST Software) C:\Users\yannick\Desktop\avast_free_antivirus_setup.exe
2013-12-24 16:19 - 2006-11-02 13:49 - 01471040 _____ C:\Windows\WindowsUpdate.log
2013-12-24 16:17 - 2013-07-09 14:49 - 00000000 ____D C:\Users\yannick\AppData\Local\LogMeIn Hamachi
2013-12-24 16:16 - 2013-10-31 18:20 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-24 16:16 - 2013-10-26 16:07 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2
2013-12-24 16:16 - 2006-11-02 13:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-24 16:16 - 2006-11-02 13:45 - 00003776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-24 16:16 - 2006-11-02 13:45 - 00003776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-24 16:15 - 2006-11-02 11:22 - 35127296 _____ C:\Windows\system32\config\software_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 25427968 _____ C:\Windows\system32\config\components_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 16252928 _____ C:\Windows\system32\config\system_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-12-24 16:14 - 2013-10-26 16:08 - 00000000 ____D C:\Program Files\Common Files\AVG Secure Search
2013-12-24 16:14 - 2013-10-26 16:07 - 00000000 ____D C:\Program Files\HyperCam 2
2013-12-24 16:14 - 2013-09-22 12:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-12-24 16:14 - 2013-07-22 16:50 - 00000000 ____D C:\Fraps
2013-12-24 16:14 - 2013-04-10 10:54 - 00000000 ____D C:\Program Files\FS Recorder for FSX
2013-12-24 16:14 - 2013-04-08 13:59 - 00000000 ____D C:\ProgramData\Licenses
2013-12-24 16:14 - 2013-04-06 13:28 - 00000000 ____D C:\Users\yannick\AppData\Roaming\vlc
2013-12-24 16:14 - 2013-03-31 15:35 - 00000000 ____D C:\Users\yannick\AppData\Roaming\teamspeak2
2013-12-24 16:14 - 2013-03-11 13:00 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Audacity
2013-12-24 16:14 - 2013-02-28 14:18 - 00000000 ____D C:\Users\yannick\AppData\Roaming\TP-LINK
2013-12-24 16:14 - 2013-02-22 08:46 - 00000000 ____D C:\Users\yannick
2013-12-24 16:14 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\spool
2013-12-24 16:14 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-12-24 16:14 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\registration
2013-12-24 16:09 - 2013-12-24 13:34 - 95025368 ____T C:\ProgramData\9rjr0jwv.fee
2013-12-24 16:09 - 2013-12-24 13:34 - 00000000 _____ C:\ProgramData\9rjr0jwv.odd
2013-12-24 15:45 - 2013-09-12 19:36 - 00000000 ____D C:\Users\yannick\AppData\Local\Overwolf
2013-12-24 15:45 - 2013-02-22 08:46 - 00001356 _____ C:\Users\yannick\AppData\Local\d3d9caps.dat
2013-12-24 15:44 - 2013-12-06 16:26 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Dropbox
2013-12-24 15:44 - 2013-11-16 13:24 - 00000552 _____ C:\Users\yannick\AppData\Local\d3d8caps.dat
2013-12-24 13:34 - 2013-12-24 13:34 - 00217576 _____ (Microsoft Corporation) C:\ProgramData\vwj0rjr9.jss
2013-12-24 13:22 - 2013-10-17 17:26 - 00000000 ____D C:\Users\yannick\AppData\Local\Purplizer
2013-12-24 12:04 - 2013-05-17 18:59 - 00000000 ____D C:\Users\yannick\AppData\Local\SecondLife
2013-12-24 12:04 - 2013-02-28 14:35 - 00000000 ____D C:\Users\yannick\AppData\Roaming\TS3Client
2013-12-23 15:31 - 2013-12-23 15:31 - 00000000 ____D C:\Users\yannick\Desktop\FlusiFix-2006 V5.0
2013-12-23 15:14 - 2013-12-22 20:05 - 00000000 ____D C:\Users\yannick\Desktop\WOAI
2013-12-23 14:58 - 2013-05-17 18:59 - 00000000 ____D C:\Program Files\SecondLifeViewer
2013-12-23 11:54 - 2013-12-23 11:53 - 00000000 ____D C:\Users\yannick\Desktop\b737soundpack
2013-12-23 09:58 - 2013-04-11 10:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Skype
2013-12-23 09:56 - 2013-03-05 09:26 - 00091102 _____ C:\Windows\PFRO.log
2013-12-22 21:29 - 2013-12-22 21:24 - 00000000 ____D C:\Users\yannick\Documents\Freemake
2013-12-22 21:25 - 2013-12-22 21:25 - 00000000 ____D C:\Program Files\WinPcap
2013-12-22 21:25 - 2013-12-22 21:24 - 00000000 ____D C:\ProgramData\Freemake
2013-12-22 21:24 - 2013-12-22 21:24 - 00000000 ____D C:\Program Files\Freemake
2013-12-22 20:08 - 2013-12-22 20:05 - 02256077 _____ C:\Users\yannick\Desktop\AIFP2209.zip
2013-12-22 19:52 - 2013-08-24 07:41 - 00000000 ____D C:\Users\yannick\AppData\Local\World_of_AI
2013-12-22 15:10 - 2013-02-22 10:54 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-12-22 14:20 - 2013-12-22 14:20 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
2013-12-22 14:16 - 2013-12-22 14:16 - 00000000 ____D C:\Program Files\Audio Recorder Pro
2013-12-21 19:51 - 2006-11-02 11:33 - 01630066 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Program Files\IrfanView
2013-12-21 13:20 - 2013-11-09 23:27 - 00000000 ____D C:\Users\yannick\.gimp-2.8
2013-12-21 13:18 - 2013-07-02 19:59 - 00000000 ____D C:\Users\yannick\AppData\Local\Paint.NET
2013-12-21 11:24 - 2013-10-26 16:08 - 00000000 ____D C:\ProgramData\AVG SafeGuard toolbar
2013-12-21 08:53 - 2013-12-06 16:31 - 00000931 _____ C:\Users\yannick\Desktop\Dropbox.lnk
2013-12-21 08:53 - 2013-12-06 16:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-21 08:49 - 2013-02-28 14:21 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-21 00:43 - 2006-11-02 13:58 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-20 18:30 - 2013-12-20 18:29 - 08835307 _____ C:\Users\yannick\Desktop\Charts.zip
2013-12-20 17:00 - 2013-12-20 16:56 - 08861741 _____ C:\Users\yannick\Desktop\openvfr_terrain_ch_20.zip
2013-12-20 16:56 - 2013-12-20 16:56 - 00048674 _____ C:\Users\yannick\Desktop\openvfr_poi_ch_20.zip
2013-12-20 16:15 - 2013-12-20 16:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-20 15:52 - 2013-12-20 15:52 - 00513272 _____ C:\Users\yannick\Documents\fairtrade hausarbeit.odt
2013-12-20 15:49 - 2013-12-20 15:49 - 01920054 _____ C:\Users\yannick\Desktop\fairtrade.bmp
2013-12-20 15:44 - 2013-12-20 15:44 - 00000872 _____ C:\Users\yannick\AppData\Local\recently-used.xbel
2013-12-18 20:33 - 2013-12-18 19:20 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IvAi
2013-12-18 19:19 - 2013-12-18 19:19 - 00000849 _____ C:\Users\yannick\Desktop\IvAi - IVAO Interface.lnk
2013-12-18 19:19 - 2013-04-11 09:17 - 00000000 ____D C:\Program Files\IVAO
2013-12-15 16:30 - 2013-09-22 12:19 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-12-12 13:08 - 2013-12-12 13:08 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-12-12 13:08 - 2013-09-12 19:37 - 00000000 ____D C:\Program Files\Overwolf
2013-12-11 18:24 - 2013-03-01 13:32 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-11 18:24 - 2013-03-01 13:32 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-12-10 07:44 - 2013-11-07 17:34 - 00000956 _____ C:\Users\Public\Desktop\Second Life Viewer.lnk
2013-12-09 21:58 - 2013-12-09 21:58 - 00416248 _____ C:\Users\yannick\österreicher.wav
2013-12-09 21:34 - 2013-03-11 12:58 - 00000000 ____D C:\Converted Audio Files
2013-12-09 19:30 - 2013-11-29 20:21 - 00003238 _____ C:\Users\yannick\Desktop\sonsim.ini
2013-12-09 12:16 - 2013-12-09 12:16 - 00048590 _____ C:\Users\yannick\mitschnitt SL.aup
2013-12-09 12:16 - 2013-12-09 12:16 - 00000000 ____D C:\Users\yannick\mitschnitt SL_data
2013-12-06 16:30 - 2013-12-06 16:29 - 00000000 ____D C:\Program Files\Dropbox
2013-12-05 22:12 - 2013-12-05 22:03 - 00000000 ____D C:\Users\yannick\Desktop\ILS SIM V4
2013-12-05 21:38 - 2013-10-31 18:31 - 00001969 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-03 18:06 - 2013-12-03 18:06 - 00001106 _____ C:\Users\Public\Desktop\Hannover RP .lnk
2013-12-03 18:06 - 2013-05-31 20:19 - 00000000 ____D C:\Program Files\KY-Programming
2013-12-03 16:09 - 2013-12-03 16:09 - 00000000 ____D C:\Program Files\LogMeIn Hamachi
2013-11-28 17:00 - 2013-10-28 19:06 - 00000000 ____D C:\Users\yannick\Documents\Nicole
2013-11-24 12:10 - 2013-02-22 11:41 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-24 12:09 - 2013-11-24 12:09 - 00001146 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2013-11-24 12:07 - 2013-02-22 11:40 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-11-24 12:07 - 2013-02-22 11:38 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-11-24 12:07 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-11-24 12:06 - 2013-11-24 12:06 - 00000000 ____D C:\Program Files\AGEIA Technologies
2013-11-24 12:05 - 2013-11-24 12:05 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\Startmenü
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\Netzwerkumgebung
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\Druckumgebung
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Eigene Musik
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Eigene Bilder
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-24 12:05 - 2013-11-24 12:05 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Verlauf
2013-11-24 12:00 - 2013-03-28 14:29 - 00000000 ____D C:\Program Files\Kalypso
2013-11-24 11:59 - 2013-11-24 11:59 - 00000000 ____D C:\Users\yannick\{7dd9c515-55cd-44f3-8b02-25f45979a8b1}
2013-11-24 11:56 - 2013-11-24 11:56 - 00000000 ____D C:\Users\yannick\{70c4a7a7-89ab-485b-90f8-2b6c343002d5}
2013-11-24 11:54 - 2013-11-24 11:54 - 00000000 ____D C:\NVIDIA
2013-11-24 11:24 - 2013-11-24 11:08 - 199358496 _____ (NVIDIA Corporation) C:\Users\yannick\Downloads\331.82-desktop-win8-win7-winvista-32bit-international-whql.exe
Some content of TEMP:
====================
C:\Users\yannick\AppData\Local\Temp\dateinj01.dll
C:\Users\yannick\AppData\Local\Temp\drm_dialogs.dll
C:\Users\yannick\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\yannick\AppData\Local\Temp\nvSCPAPISvr.exe
C:\Users\yannick\AppData\Local\Temp\nvStInst.exe
C:\Users\yannick\AppData\Local\Temp\oi_{A7694A18-8806-4456-95C0-F42841C7263C}.exe
C:\Users\yannick\AppData\Local\Temp\RegSvr32User.exe
C:\Users\yannick\AppData\Local\Temp\SkypeSetup.exe
C:\Users\yannick\AppData\Local\Temp\Tsu03428DD4.dll
C:\Users\yannick\AppData\Local\Temp\_isA8CE.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-24 16:23
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-12-2013
Ran by yannick at 2013-12-24 16:35:53
Running from C:\Users\yannick\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
µTorrent (Version: 3.3.0.29342)
3D Lights Redux Configuration For ICE AI Traffic FSX (Version: 2.01.0002)
3D-Fahrschule Demo (Version: )
AbiWord 2.4.6 (remove only) (Version: 2.4.6)
Acoustica MP3 To Wave Converter PLUS (Version: 2.5)
Adobe AIR (Version: 3.6.0.6090)
Adobe Flash Player 11 Plugin (Version: 11.9.900.170)
Adobe Reader X (10.1.4) - Deutsch (Version: 10.1.4)
Advanced Control Center 2.0
AIDA64 Extreme Edition v1.85 (Version: 1.85)
Airbus Series Vol.1 Deluxe (FSX)
Airport Simulator 2013 Demo Version 1.0 (Version: 1.0)
American Samoa Rescue
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
ArtMoney SE v7.40.5 (Version: 7.40.5)
ASUS GPU Tweak (Version: 2.2.8.1)
ATC4Real Fort Lauderdale (Version: 1.5.5)
Audacity 2.0.3 (Version: 2.0.3)
avast! Free Antivirus (Version: 9.0.2011)
AVG SafeGuard toolbar (Version: 17.1.3.1)
Blender (Version: 2.69)
Boeing 767-300 Condor NEW
Bonjour (Version: 3.0.0.10)
Bonn Hbf DEMO
BS2012 Studio Fahrplaneditor (Version: 1.0.9.0)
Bus- & Cable Car-Simulator
Bus-Simulator 2012
CD Recovery Toolbox Free 1.1
Cheat Engine 6.3
ConTEXT v0.98.6
Convert AVI to MP4 1.3
CPU-Control
Dropbox (HKCU Version: 2.4.10)
Easy Clearance 3 Version 3 (Version: 3)
EditVoicepack (Version: 3.1.0)
EditVoicepack X (Version: 4.0.7)
ElsterFormular (Version: 14.1.20130301)
Emergency4 (Version: 1.03.001)
ERS Berlin (Version: 1.2.0.0)
Euro Truck Simulator 2 (Version: 1.5.2)
EuroScope 3.1d (Version: 3.1.4)
Feuer- und Notfallsimulation Wegberg Version 6.0 (Version: 6.0)
FFMVATracker (HKCU Version: 1.0.0.52)
Firestorm-Release (remove only) (Version: 4.4.2.34167)
FlightBeam San Francisco International FSX 2.0.1
Florian Meisterbastler
Flughafen-Feuerwehr-Simulator 2013 Demoversion 1.0
FMS Sound Update v2
FollowMe 2 Dev 5 (Version: 2.0.20)
Fraps
Free YouTube Download version 3.2.2.426 (Version: 3.2.2.426)
FS Recorder 2.1 for FSX (Version: 2.1.0.0)
FSacars (Version: 4.0)
FSCloud version 2.x alpha (Version: 2.x alpha)
FSX - Airbus A319-100 Air Berlin NC
FSX - Airbus A319-100 Air Berlin OC
FSX - Airbus A319-100 Basepack v2
FSX - Airbus A319-100 British Airways
FSX GA-Traffic (Version: 1.0.1)
FSX Mission Editor (Version: 1.0.3537)
FSX Scenery ISTANBUL ATATURK AIRPORT (LTBA)
Funkspiel Naturns Version 1.0.1.2 (Version: 1.0.1.2)
Funkspiel Rettlingen
Gameforge Live 1.8.0 "Legend" (Version: 1.8.0)
Garmin USB Drivers (Version: 2.3.1.0)
Garmin VoiceStudio v2.40 (Version: 2.40.0.0)
GA-Tools
GA-Tools (C:\Program Files\GA-Tools\)
GIMP 2.8.8 (Version: 2.8.8)
GoldWave v5.68 (Version: 5.68)
Google Chrome (Version: 31.0.1650.63)
Google Update Helper (Version: 1.3.22.3)
GPS, FMS und Lights für die EC135 - FS2004
Grand Theft Auto IV (Version: 1.0.0011.131)
Grand Theft Auto IV (Version: 1.0.0013.131)
Grand Theft Auto IV (Version: 1.00.0000)
GTA IV - 100% Savegame File (Vista) 1.0
Hannover RP
Harry Potter und die Heiligtümer des Todes(TM) - Teil 2 Demo (Version: 1.0.0.0)
Helipack X v2
HP Officejet 6500 E710a-f - Grundlegende Software für das Gerät (Version: 22.50.231.0)
HP Officejet 6500 E710a-f Hilfe (Version: 140.0.2.2)
HP Product Detection (Version: 11.15.0005)
HyperCam 2 (Version: 2.28.01)
ICE AI Traffic Para FSX (Version: 2.01.0003)
IrfanView (remove only) (Version: 4.37)
iTunes (Version: 11.0.4.4)
IvAc v1.2.4 (b225)
IvAi v1.0.0 b150
IvAp v2.0.2 (build 2773)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Just Flight - FS Insider C152 (Version: 1.00.000)
Just Flight Rescue Pilot Demo (Version: 1.00.0000)
LandingTrainer (HKCU Version: 1.0.0.7)
Leitstelle (Version: 1.2.1)
LogMeIn Hamachi (Version: 2.2.0.109)
Loksim3D (Version: 2.8.2)
London Control Demo (Version: 1.0)
McAfee Security Scan Plus (Version: 3.8.130.10)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft Flight Simulator X (Version: 10.0.61355.0)
Microsoft Flight Simulator X Service Pack 1 (Version: 10.0.61355.0)
Microsoft Flight Simulator X Service Pack 2 (Version: 10.0.61472.0)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (Version: 3.5.50.0)
Microsoft Silverlight (Version: 4.1.10329.0)
Microsoft Speech SDK 5.1 (Version: 5.1.4324.0)
Microsoft Speech SDK 5.1 Language Pack (Version: 5.1)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Movavi Screen Capture 4 (Version: 4.3.3)
Mozilla Firefox 26.0 (x86 de) (Version: 26.0)
Mozilla Maintenance Service (Version: 26.0)
MP3 Skype Recorder (Version: 3.1.3)
MP4 To MP3 Converter V3.0.4
MSXML 4.0 SP2 Parser und SDK (Version: 4.20.9818.0)
Notepad++ (Version: 6.4.1)
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82)
NVIDIA GeForce Experience 1.7.1 (Version: 1.7.1)
NVIDIA Grafiktreiber 331.82 (Version: 331.82)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4)
NVIDIA Install Application (Version: 2.1002.140.952)
NVIDIA LED Visualizer 1.0 (Version: 1.0)
NVIDIA PhysX (Version: 9.13.0725)
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725)
NVIDIA Systemsteuerung 331.82 (Version: 331.82)
NVIDIA Update 9.3.21 (Version: 9.3.21)
NVIDIA Update Components (Version: 9.3.21)
Open Clouds (Version: 1.14.0)
OpenAL
OpenOffice.org 3.4.1 (Version: 3.41.9593)
Overwolf (Version: 0.47.284)
Paint.NET v3.5.11 (Version: 3.61.0)
Passenger Simulation 1.0 (Version: 1.0)
Police
POSKY Boeing 777-200 Pack FSX & P3D (Version: 1)
ProtectDisc Driver, Version 11 (Version: 11.0.0.14)
ProTrain Perfect 2
ProTrain Perfect 2 - Addon 9 Ersatzaufgabe - (Version: 1.31)
ProTrain Perfect 2 - Addon9 Hamburg - Berlin - (Version: 1.0)
ProTrain Perfect 2 - Aufgabenfix - (Version: 1.0.1)
QuickTime (Version: 7.74.80.86)
Real Atc Mission AZ269
Real Atc Mission AZ296
Roadkil's Unstoppable Copier Version 5.2
screenPusher 1.3
SecondLifeViewer (remove only)
Seychelles Photo Real Scenery Pack FSX & P3D (Version: 1)
Shotcut
SHOUTcast Source DSP Plug-in v2 (Version: 2.3.2)
Skype™ 6.7 (Version: 6.7.102)
SpaceShuttleMission2007 DEMO v1.31
SpeedFan (remove only)
Super Nova Simulatie
SWAT 4 Single Player Demo (Version: 1.10.29930)
TCP-Server 1.0
TeamSpeak 2 RC2 (Version: 2.0.32.60)
TeamSpeak 3 Client (Version: 3.0.13.1)
TeamViewer 8 (Version: 8.0.17396)
Tower! 2011 (Version: 1.00.0000)
TP-LINK TL-WN727N Driver (Version: 1.2.1)
TP-LINK Wireless Configuration Utility (Version: 1.2.1)
UK2000 Heathrow Xtreme Free FSX (Version: 2.11)
VAFS5 (Version: 5.1.1.18)
vasFMC 2.1
VATroute 0.0.1.021 (Version: 0.0.1.021)
vBus
VirtualBus A6C RC3.1
VirtualDJ Home FREE (Version: 7.4)
VLC media player 2.0.5 (Version: 2.0.5)
VoxATC X (Version: 6.20)
War Thunder Launcher 1.0.1.199
Wecker für Windows 6.5 (Version: 6.5)
Winamp (Version: 5.65 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (Version: 04/19/2012 2.3.1.0)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Winterberg Configurator Version WEM Confi 8.8 (Version: WEM Confi 8.8)
woh Pilot Center
WOH737X
XAcars for Microsoft Flightsimulator (Version: 2.5)
Zusi 3.0.4 (Demo) (Version: 3)
==================== Restore Points =========================
22-12-2013 13:40:44 No23 Recorder wird installiert
22-12-2013 14:11:30 Gerätetreiber-Paketinstallation: Realtek Semiconductor Corp. Audio-, Video- und Gamecontroller
24-12-2013 15:26:49 avast! antivirus system restore point
==================== Hosts content: ==========================
2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0BBBF207-7967-4B96-A22F-E05B79036ED6} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {18DFD9FC-082E-4E9B-8285-5F21D2B4EDAE} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1F5C22D2-AA7F-4F00-8558-C4D682DD07E7} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-12-24] (AVAST Software)
Task: {2D2DEC4F-74BB-4FB5-9626-21B3A60365F1} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {5916F864-469C-4391-8604-E4EA141A2699} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\System32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {6662F6BE-AA60-47AC-B57A-B8C20A6C3F88} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-10-31] (Google Inc.)
Task: {66B118AF-0895-4BFF-9234-4FBF93A29DCB} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {7F519886-55D4-4587-B177-595D983B8AB7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {893C622C-1E5F-4B30-A5D5-D066CD6778AA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-10-31] (Google Inc.)
Task: {8B0E6FAB-F43A-4988-AF0A-A21646C212F0} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {9ED703A9-5FFD-40D5-895A-4385EE1509DE} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\System32\RacAgent.exe [2008-01-18] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-06-18 16:24 - 2012-06-18 16:24 - 00260096 _____ () C:\Program Files\Notepad++\NppShell_05.dll
2013-12-20 16:15 - 2013-12-20 16:15 - 03559024 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-12-11 18:24 - 2013-12-11 18:24 - 16242056 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll
2013-12-24 16:27 - 2013-12-24 16:28 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:74603393
AlternateDataStreams: C:\Users\yannick\Documents\009 Sound System - Dreamscape (Long Edit).mp3:TOC.WMV
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
==================== Faulty Device Manager Devices =============
Name: Realtek RTL8168/8111-Familie-PCI-E-Gigabit-Ethernet-NIC (NDIS 6.0)
Description: Realtek RTL8168/8111-Familie-PCI-E-Gigabit-Ethernet-NIC (NDIS 6.0)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8169
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/24/2013 04:26:48 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {75d6bc37-0371-49d3-8c05-3ed198c51f88}
Error: (12/24/2013 03:55:09 PM) (Source: EventSystem) (User: )
Description: d:\rtm\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
Error: (12/24/2013 03:45:08 PM) (Source: Perflib) (User: )
Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib) (User: )
Description: PolicyAgent
Error: (12/24/2013 03:45:08 PM) (Source: Perflib) (User: )
Description: OpenIPSecPerformanceDataC:\Windows\System32\ipsecsvc.dllPolicyAgent4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib) (User: )
Description: MSDTCC:\Windows\system32\msdtcuiu.DLL4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib) (User: )
Description: LsaC:\Windows\system32\Secur32.dll4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib) (User: )
Description: ESENTC:\Windows\system32\esentprf.dll4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
System errors:
=============
Error: (12/24/2013 04:35:32 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: 2147942522
Error: (12/24/2013 04:35:02 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: 2147942522
Error: (12/24/2013 04:34:32 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: 2147942522
Error: (12/24/2013 04:34:02 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: 2147942522
Error: (12/24/2013 04:33:32 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: 2147942522
Error: (12/24/2013 04:33:02 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: 2147942522
Error: (12/24/2013 04:32:32 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: 2147942522
Error: (12/24/2013 04:32:02 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: 2147942522
Error: (12/24/2013 04:31:32 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: 2147942522
Error: (12/24/2013 04:31:02 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: 2147942522
Microsoft Office Sessions:
=========================
Error: (12/24/2013 04:26:48 PM) (Source: VSS)(User: )
Description: 0x80070005
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {75d6bc37-0371-49d3-8c05-3ed198c51f88}
Error: (12/24/2013 03:55:09 PM) (Source: EventSystem)(User: )
Description: d:\rtm\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
Error: (12/24/2013 03:45:08 PM) (Source: Perflib)(User: )
Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib)(User: )
Description: PolicyAgent
Error: (12/24/2013 03:45:08 PM) (Source: Perflib)(User: )
Description: OpenIPSecPerformanceDataC:\Windows\System32\ipsecsvc.dllPolicyAgent4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib)(User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib)(User: )
Description: MSDTCC:\Windows\system32\msdtcuiu.DLL4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib)(User: )
Description: LsaC:\Windows\system32\Secur32.dll4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib)(User: )
Description: ESENTC:\Windows\system32\esentprf.dll4
Error: (12/24/2013 03:45:08 PM) (Source: Perflib)(User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
CodeIntegrity Errors:
===================================
Date: 2013-12-24 16:35:24.109
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 16:35:24.075
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 16:35:24.056
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 16:35:24.037
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 16:35:24.012
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 16:35:23.992
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 16:35:23.974
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 16:35:23.954
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-12 19:01:52.469
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPI.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-12 19:01:52.437
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPI.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 53%
Total physical RAM: 2046.5 MB
Available physical RAM: 952 MB
Total Pagefile: 4335.03 MB
Available Pagefile: 3225.15 MB
Total Virtual: 2047.88 MB
Available Virtual: 1896.52 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:117.42 GB) (Free:7.32 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Daten) (Fixed) (Total:180.66 GB) (Free:83.86 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: A23B9D59)
Partition 1: (Not Active) - (Size=181 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=117 GB) - (Type=07 NTFS)
==================== End Of Log ============================
GMER: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-24 17:43:11
Windows 6.0.6001 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdePort2 SAMSUNG_HD321KJ rev.CP100-12 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\yannick\AppData\Local\Temp\pfrirfog.sys
---- System - GMER 2.1 ----
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwAddBootEntry [0xA02DCAD0]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwAssignProcessToJobObject [0xA02DD5AE]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateEvent [0xA02E95E0]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateEventPair [0xA02E962C]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateIoCompletion [0xA02E97C6]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateMutant [0xA02E954E]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateSection [0xA02E9670]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateSemaphore [0xA02E9596]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateThread [0xA02DDAE4]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateTimer [0xA02E9780]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwDebugActiveProcess [0xA02DE39C]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwDeleteBootEntry [0xA02DCB36]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwDuplicateObject [0xA02E1B32]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwLoadDriver [0xA02DC71E]
SSDT \SystemRoot\System32\Drivers\btickpyh.SYS ZwMapViewOfSection [0xA021E466]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwModifyBootEntry [0xA02DCB9C]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwNotifyChangeKey [0xA02E1F28]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwNotifyChangeMultipleKeys [0xA02DEE2C]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenEvent [0xA02E960A]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenEventPair [0xA02E964E]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenIoCompletion [0xA02E97EA]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenMutant [0xA02E9574]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenProcess [0xA02E142C]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenSection [0xA02E96FE]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenSemaphore [0xA02E95BE]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenThread [0xA02E1814]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenTimer [0xA02E97A4]
SSDT \SystemRoot\System32\Drivers\btickpyh.SYS ZwProtectVirtualMemory [0xA021E20A]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwQueryObject [0xA02DECF8]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwQueueApcThread [0xA02DE84E]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSetBootEntryOrder [0xA02DCC02]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSetBootOptions [0xA02DCC68]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSetContextThread [0xA02DE216]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSetSystemInformation [0xA02DC7B8]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSetSystemPowerState [0xA02DC98E]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwShutdownSystem [0xA02DC91C]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSuspendProcess [0xA02DE566]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSuspendThread [0xA02DE6C8]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSystemDebugControl [0xA02DCA16]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwTerminateProcess [0xA02DE054]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwTerminateThread [0xA02DE1F6]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwVdmControl [0xA02DCCCE]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwWriteVirtualMemory [0xA02DD60A]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateThreadEx [0xA02DDD00]
---- Kernel code sections - GMER 2.1 ----
.text ntoskrnl.exe!KeInsertQueue + 2FD 81C7E8B4 4 Bytes [D0, CA, 2D, A0]
.text ntoskrnl.exe!KeInsertQueue + 381 81C7E938 4 Bytes [AE, D5, 2D, A0]
.text ntoskrnl.exe!KeInsertQueue + 3C1 81C7E978 8 Bytes [E0, 95, 2E, A0, 2C, 96, 2E, ...] {LOOPNZ 0xffffff97; MOV AL, [CS:0xa02e962c]}
.text ntoskrnl.exe!KeInsertQueue + 3CD 81C7E984 4 Bytes [C6, 97, 2E, A0]
.text ntoskrnl.exe!KeInsertQueue + 3E5 81C7E99C 4 Bytes [4E, 95, 2E, A0]
.text ...
PAGE ntoskrnl.exe!ZwReplyWaitReceivePortEx + 110 81DFE103 4 Bytes CALL A02DF513 \??\C:\Windows\system32\drivers\aswSnx.sys
PAGE ntoskrnl.exe!ZwAlpcSendWaitReceivePort + 121 81E2B9AF 4 Bytes CALL A02DF529 \??\C:\Windows\system32\drivers\aswSnx.sys
.vmp2 C:\Windows\system32\drivers\acedrv11.sys entry point in ".vmp2" section [0xA00F469D]
? C:\Windows\system32\drivers\IOMap.sys Das System kann die angegebene Datei nicht finden. !
? System32\Drivers\btickpyh.SYS Das System kann den angegebenen Pfad nicht finden. !
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Windows Sidebar\sidebar.exe[1480] kernel32.dll!GetBinaryTypeW + 70 76051AE8 1 Byte [62]
.text C:\Program Files\Windows Sidebar\sidebar.exe[3516] kernel32.dll!GetBinaryTypeW + 70 76051AE8 1 Byte [62]
.text C:\Users\yannick\Desktop\gmer_2.1.19163.exe[3636] kernel32.dll!GetBinaryTypeW + 70 76051AE8 1 Byte [62]
.text C:\Program Files\AVAST Software\Avast\avastUi.exe[4752] kernel32.dll!GetBinaryTypeW + 70 76051AE8 1 Byte [62]
.text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[5188] kernel32.dll!GetBinaryTypeW + 70 76051AE8 1 Byte [62]
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\tdx \Device\Tcp aswRdr.sys
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.sys
AttachedDevice \Driver\tdx \Device\Udp aswTdi.sys
---- Processes - GMER 2.1 ----
Process (*** hidden *** ) [4] 8545ED90
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Fax - HP Officejet 6500 E710a-f@ChangeID 49859
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Fax - HP Officejet 6500 E710a-f@Attributes 1536
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP Officejet 6500 E710a-f@ChangeID 52109
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP Officejet 6500 E710a-f@Attributes 3584
---- EOF - GMER 2.1 ----
LG Yannick |
|
26.12.2013, 13:12
| #4 | |
| /// the machine /// TB-Ausbilder | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? hi, Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.12.2013, 14:33
| #5 |
| | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? Hallo Schrauber Danke für die Antwort Bei deinem Link, ging die .exe nicht...es war laut meinem fehleranfälligen PC keine Win32 Anwendung...habe sie dann von bleepingcomputer.com heruntergeladen...hoffe das ist auch ok. Installiert und ausgeführt. Hier der Log: Code:
ATTFilter ComboFix 13-12-26.01 - yannick 26.12.2013 14:18:52.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.49.1031.18.2046.859 [GMT 1:00]
ausgeführt von:: c:\users\yannick\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\WinPCap
c:\program files\WinPCap\LICENSE
c:\programdata\vwj0rjr9.jss
c:\users\yannick\Desktop\Setup.exe
c:\windows\ST6UNST.000
c:\windows\system32\frapsvid.dll
c:\windows\system32\zip32.dll
D:\install.exe
D:\setup.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-11-26 bis 2013-12-26 ))))))))))))))))))))))))))))))
.
.
2013-12-26 13:28 . 2013-12-26 13:28 -------- d-----w- c:\users\yannick\AppData\Local\temp
2013-12-26 13:28 . 2013-12-26 13:28 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-12-26 13:28 . 2013-12-26 13:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-12-26 11:08 . 2013-12-26 11:11 -------- d-----w- c:\program files\Steam
2013-12-26 10:23 . 2013-12-26 10:23 8782 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2013-12-26 10:23 . 2013-12-26 10:23 7271 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2013-12-26 10:23 . 2013-12-26 10:23 23327 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2013-12-24 15:35 . 2013-12-24 15:35 -------- d-----w- C:\FRST
2013-12-24 15:29 . 2013-12-24 15:29 -------- d-----w- c:\users\yannick\AppData\Roaming\AVAST Software
2013-12-24 15:28 . 2013-12-24 15:28 57672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-12-24 15:28 . 2013-12-24 15:28 180248 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-12-24 15:28 . 2013-12-24 15:28 775952 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-12-24 15:28 . 2013-12-24 15:28 410528 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-12-24 15:28 . 2013-12-24 15:28 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-12-24 15:28 . 2013-12-24 15:28 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-12-24 15:28 . 2013-12-24 15:28 54832 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-12-24 15:28 . 2013-12-24 15:28 270240 ----a-w- c:\windows\system32\aswBoot.exe
2013-12-24 15:28 . 2013-12-24 15:28 43152 ----a-w- c:\windows\avastSS.scr
2013-12-24 15:27 . 2013-12-24 15:27 -------- d-----w- c:\program files\AVAST Software
2013-12-24 15:25 . 2013-12-24 15:25 -------- d-----w- c:\programdata\AVAST Software
2013-12-22 20:24 . 2013-12-22 20:25 -------- d-----w- c:\programdata\Freemake
2013-12-22 20:24 . 2013-12-22 20:24 -------- d-----w- c:\program files\Freemake
2013-12-22 14:10 . 2013-12-22 14:12 -------- d--h--w- c:\program files\Temp
2013-12-22 13:16 . 2013-12-22 13:16 -------- d-----w- c:\program files\Audio Recorder Pro
2013-12-21 12:36 . 2013-12-21 12:36 -------- d-----w- c:\users\yannick\AppData\Roaming\IrfanView
2013-12-21 12:36 . 2013-12-21 12:36 -------- d-----w- c:\program files\IrfanView
2013-12-18 18:20 . 2013-12-18 19:33 -------- d-----w- c:\users\yannick\AppData\Roaming\IvAi
2013-12-12 12:08 . 2013-12-12 12:08 -------- d-----w- c:\program files\Common Files\Overwolf
2013-12-09 11:16 . 2013-12-09 11:16 -------- d-----w- c:\users\yannick\mitschnitt SL_data
2013-12-06 15:29 . 2013-12-06 15:30 -------- d-----w- c:\program files\Dropbox
2013-12-06 15:26 . 2013-12-26 10:25 -------- d-----w- c:\users\yannick\AppData\Roaming\Dropbox
2013-12-03 15:09 . 2013-12-03 15:09 -------- d-----w- c:\program files\LogMeIn Hamachi
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-11 17:24 . 2013-03-01 12:32 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-12-11 17:24 . 2013-03-01 12:32 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-11-20 19:27 . 2013-10-26 15:08 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-11-14 11:57 . 2013-11-24 11:02 892704 ----a-w- c:\windows\system32\nvhdagenco32.dll
2013-11-14 11:57 . 2013-11-24 11:02 28448 ----a-w- c:\windows\system32\nvhdap32.dll
2013-11-14 11:57 . 2013-11-24 11:02 161056 ----a-w- c:\windows\system32\drivers\nvhda32v.sys
2013-11-14 11:57 . 2013-11-24 11:02 15862272 ----a-w- c:\windows\system32\nvwgf2um.dll
2013-11-14 11:57 . 2013-02-22 10:40 53024 ----a-w- c:\windows\system32\OpenCL.dll
2013-11-14 11:57 . 2013-11-24 11:02 9619872 ----a-w- c:\windows\system32\nvopencl.dll
2013-11-14 11:57 . 2013-11-24 11:02 22951200 ----a-w- c:\windows\system32\nvoglv32.dll
2013-11-14 11:57 . 2013-11-24 11:02 10446112 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-11-14 11:57 . 2013-11-24 11:02 893728 ----a-w- c:\windows\system32\nvdispgenco3233182.dll
2013-11-14 11:57 . 2013-11-24 11:02 2947872 ----a-w- c:\windows\system32\nvcuvid.dll
2013-11-14 11:57 . 2013-11-24 11:02 1049888 ----a-w- c:\windows\system32\nvdispco3233182.dll
2013-11-14 11:57 . 2013-02-22 10:39 15218504 ----a-w- c:\windows\system32\nvd3dum.dll
2013-11-14 11:57 . 2013-11-24 11:02 9663656 ----a-w- c:\windows\system32\nvcuda.dll
2013-11-14 11:57 . 2013-11-24 11:02 2747680 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-11-14 11:57 . 2013-11-24 11:02 2697248 ----a-w- c:\windows\system32\nvapi.dll
2013-11-14 11:57 . 2013-11-24 11:02 17560352 ----a-w- c:\windows\system32\nvcompiler.dll
2013-11-11 14:26 . 2013-02-22 10:41 4321056 ----a-w- c:\windows\system32\nvcpl.dll
2013-11-11 14:26 . 2013-02-22 10:41 3036960 ----a-w- c:\windows\system32\nvsvc.dll
2013-11-11 14:26 . 2013-02-22 10:41 664352 ----a-w- c:\windows\system32\nvvsvc.exe
2013-11-11 14:26 . 2013-02-22 10:41 62752 ----a-w- c:\windows\system32\nvshext.dll
2013-11-11 14:26 . 2013-02-22 10:41 2555168 ----a-w- c:\windows\system32\nvsvcr.dll
2013-11-11 14:26 . 2013-02-22 10:41 209184 ----a-w- c:\windows\system32\nvmctray.dll
.
Ganz liebe Grüße und ein schönes Rest-Weihnachtsfest Yannick |
|
27.12.2013, 10:39
| #6 |
| /// the machine /// TB-Ausbilder | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? |
|
27.12.2013, 15:00
| #7 |
| | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? Hey Vielen Dank Hier die Logs: Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.12.27.03 Windows Vista Service Pack 1 x86 NTFS Internet Explorer 7.0.6001.18000 yannick :: YANNICK-PC [Administrator] 27.12.2013 13:12:43 mbam-log-2013-12-27 (13-12-43).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 248600 Laufzeit: 10 Minute(n), 31 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 2 C:\Users\yannick\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\yannick\AppData\Roaming\OpenCandy\AEC4F41D4B484C5BA5FC11E81146C9D0 (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 1 C:\Users\yannick\AppData\Roaming\OpenCandy\AEC4F41D4B484C5BA5FC11E81146C9D0\Trial-14.0.1000.89_de-DE_1004733_DE-2.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) ADW Cleaner: Code:
ATTFilter # AdwCleaner v3.016 - Bericht erstellt am 27/12/2013 um 14:28:27
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 1 (32 bits)
# Benutzername : yannick - YANNICK-PC
# Gestartet von : C:\Users\yannick\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
[!] Ordner Gelöscht : C:\Users\yannick\AppData\Local\AVG SafeGuard toolbar
Ordner Gelöscht : C:\Users\yannick\AppData\LocalLow\AVG SafeGuard toolbar
Ordner Gelöscht : C:\Users\yannick\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Datei Gelöscht : C:\Users\yannick\AppData\Roaming\Mozilla\Firefox\Profiles\b4cu94sg.default\searchplugins\safeguard-secure-search.xml
Datei Gelöscht : C:\Program Files\Mozilla Firefox\browser\searchplugins\safeguard-secure-search.xml
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\AVG SafeGuard toolbar
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\Software\AVG SafeGuard toolbar
Schlüssel Gelöscht : HKLM\Software\AVG Security Toolbar
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG SafeGuard toolbar
***** [ Browser ] *****
-\\ Internet Explorer v7.0.6001.18000
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\yannick\AppData\Roaming\Mozilla\Firefox\Profiles\b4cu94sg.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [5810 octets] - [27/12/2013 14:24:12]
AdwCleaner[R1].txt - [5665 octets] - [27/12/2013 14:27:44]
AdwCleaner[S0].txt - [636 octets] - [27/12/2013 14:24:46]
AdwCleaner[S1].txt - [5594 octets] - [27/12/2013 14:28:27]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [5654 octets] ##########
JRT: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows Vista (TM) Home Basic x86
Ran by yannick on 27.12.2013 at 14:53:41,86
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin"
~~~ FireFox
Emptied folder: C:\Users\yannick\AppData\Roaming\mozilla\firefox\profiles\b4cu94sg.default\minidumps [390 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.12.2013 at 14:56:09,07
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Und noch der neue FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-12-2013
Ran by yannick (administrator) on YANNICK-PC on 27-12-2013 14:59:31
Running from C:\Users\yannick\Desktop
Microsoft® Windows Vista™ Home Basic Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\System32\ASGT.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Ralink Technology, Corp.) C:\Program Files\TP-LINK\TP-LINK Wireless Configuration Utility\Service\RaRegistry.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(LogMeIn Inc.) C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [Nvtmru] - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [3806544 2013-11-29] (LogMeIn Inc.)
HKLM\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-24] (AVAST Software)
HKCU\...\Run: [RGSC] - C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20684656 2013-07-25] (Skype Technologies S.A.)
HKCU\...\Run: [ECFSTServ] - C:\Users\yannick\Desktop\lotsen\Easy Clearance 3\ECFSTServ.exe [1067520 2010-04-18] ()
HKCU\...\Run: [MP3 Skype Recorder] - C:\Program Files\MP3 Skype Recorder\MP3 Skype Recorder.exe [1975296 2011-11-17] (Alexander Nikiforov)
HKCU\...\Run: [DT Emphelungstool] - "C:\Users\yannick\AppData\Local\Deutsche Telekom\Empfehlungstool\DTEmpfehlungstool.exe" 2
HKCU\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [35768 2013-12-09] (Overwolf)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
Startup: C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\yannick\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wecker für Windows 6.lnk
ShortcutTarget: Wecker für Windows 6.lnk -> C:\Program Files\Wecker6\Wecker.exe (Christoph Bünger Software)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\MP3 Skype Recorder\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
FireFox:
========
FF ProfilePath: C:\Users\yannick\AppData\Roaming\Mozilla\Firefox\Profiles\b4cu94sg.default
FF Homepage: www.google.de
FF Keyword.URL: hxxp://www.google.de/search?q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nullsoft.com/winampDetector;version=1 - C:\Program Files\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Hilfe Assistent - C:\Users\yannick\AppData\Roaming\Mozilla\Firefox\Profiles\b4cu94sg.default\Extensions\{}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
========================== Services (Whitelisted) =================
R2 ASGT; C:\Windows\System32\ASGT.exe [55296 2012-01-17] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-24] (AVAST Software)
R2 Hamachi2Svc; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [1664336 2013-11-29] (LogMeIn Inc.)
R2 LMIGuardianSvc; C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe [375056 2013-10-11] (LogMeIn, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [96184 2013-12-09] (Overwolf)
R2 RalinkRegistryWriter; C:\Program Files\TP-LINK\TP-LINK Wireless Configuration Utility\Service\RaRegistry.exe [375872 2011-12-26] (Ralink Technology, Corp.)
==================== Drivers (Whitelisted) ====================
R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
S3 AIDA64Driver; C:\Program Files\FinalWire\AIDA64 Extreme Edition\kerneld.x32 [28824 2011-08-18] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2013-12-24] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [54832 2013-12-24] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49944 2013-12-24] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [775952 2013-12-24] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [410528 2013-12-24] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57672 2013-12-24] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [180248 2013-12-24] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-20] (AVG Technologies)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
R3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-12-27] (Malwarebytes Corporation)
R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [1093472 2012-02-14] (Ralink Technology Corp.)
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-18] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\yannick\AppData\Local\Temp\catchme.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
R4 IOMap; \??\C:\Windows\system32\drivers\IOMap.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-27 14:59 - 2013-12-27 14:59 - 00011411 _____ C:\Users\yannick\Desktop\FRST.txt
2013-12-27 14:58 - 2013-12-27 14:58 - 00000000 ____D C:\Users\yannick\Desktop\FRST-OlderVersion
2013-12-27 14:56 - 2013-12-27 14:56 - 00001155 _____ C:\Users\yannick\Desktop\JRT.txt
2013-12-27 14:53 - 2013-12-27 14:53 - 00000000 ____D C:\Windows\ERUNT
2013-12-27 14:52 - 2013-12-27 14:52 - 00005734 _____ C:\Users\yannick\Desktop\AdwCleaner[S1].txt
2013-12-27 14:24 - 2013-12-27 14:38 - 00000000 ____D C:\AdwCleaner
2013-12-27 14:19 - 2013-12-27 14:19 - 00001468 _____ C:\Users\yannick\Desktop\123.txt
2013-12-27 13:10 - 2013-12-27 13:35 - 00002175 _____ C:\Users\yannick\Desktop\Stadtbahn Simulator Düsseldorf.lnk
2013-12-27 13:10 - 2013-12-27 13:12 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2013-12-27 13:10 - 2013-12-27 13:10 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-27 13:10 - 2013-12-27 13:10 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Malwarebytes
2013-12-27 13:09 - 2013-12-27 13:10 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stadtbahn Simulator Düsseldorf
2013-12-27 13:09 - 2013-12-27 13:10 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-27 13:09 - 2013-12-27 13:09 - 01233962 _____ C:\Users\yannick\Desktop\adwcleaner.exe
2013-12-27 13:09 - 2013-12-27 13:09 - 01034531 _____ (Thisisu) C:\Users\yannick\Desktop\JRT.exe
2013-12-27 13:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-27 13:07 - 2013-12-27 13:09 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\yannick\Desktop\mbam-setup-1.75.0.1300.exe
2013-12-27 08:20 - 2013-12-27 08:20 - 00000827 _____ C:\Users\Public\Desktop\AESHelp for FSX.lnk
2013-12-26 17:16 - 2013-12-26 17:16 - 00155248 _____ C:\Windows\Minidump\Mini122613-01.dmp
2013-12-26 14:32 - 2013-12-26 14:32 - 00014964 _____ C:\ComboFix.txt
2013-12-26 14:15 - 2013-12-26 14:32 - 00000000 ____D C:\Qoobox
2013-12-26 14:15 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-26 14:15 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-26 14:15 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-26 14:15 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-26 14:15 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-26 14:15 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-26 14:15 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-26 14:15 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-26 14:14 - 2013-12-26 14:30 - 00000000 ____D C:\Windows\erdnt
2013-12-26 14:14 - 2013-12-26 14:14 - 05158590 ____R (Swearware) C:\Users\yannick\Desktop\ComboFix.exe
2013-12-26 12:08 - 2013-12-26 12:11 - 00000000 ____D C:\Program Files\Steam
2013-12-26 12:08 - 2013-12-26 12:08 - 01133552 _____ C:\Users\yannick\Desktop\SteamSetup.exe
2013-12-26 12:08 - 2013-12-26 12:08 - 00000766 _____ C:\Users\Public\Desktop\Steam.lnk
2013-12-24 16:35 - 2013-12-27 14:58 - 00000000 ____D C:\FRST
2013-12-24 16:34 - 2013-12-24 16:34 - 00377856 _____ C:\Users\yannick\Desktop\gmer_2.1.19163.exe
2013-12-24 16:33 - 2013-12-27 14:58 - 01063503 _____ (Farbar) C:\Users\yannick\Desktop\FRST.exe
2013-12-24 16:33 - 2013-12-24 16:33 - 00050477 _____ C:\Users\yannick\Desktop\Defogger.exe
2013-12-24 16:29 - 2013-12-24 16:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\AVAST Software
2013-12-24 16:28 - 2013-12-24 16:28 - 00775952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00270240 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-24 16:28 - 2013-12-24 16:28 - 00180248 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00057672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00054832 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00049944 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-24 16:28 - 2013-12-24 16:28 - 00001879 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-12-24 16:27 - 2013-12-24 16:27 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-24 16:25 - 2013-12-24 16:25 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-24 16:19 - 2013-12-24 16:21 - 91412976 _____ (AVAST Software) C:\Users\yannick\Desktop\avast_free_antivirus_setup.exe
2013-12-24 13:34 - 2013-12-24 16:09 - 95025368 ____T C:\ProgramData\9rjr0jwv.fee
2013-12-24 13:34 - 2013-12-24 16:09 - 00000000 _____ C:\ProgramData\9rjr0jwv.odd
2013-12-23 15:31 - 2013-12-23 15:31 - 00000000 ____D C:\Users\yannick\Desktop\FlusiFix-2006 V5.0
2013-12-23 11:53 - 2013-12-23 11:54 - 00000000 ____D C:\Users\yannick\Desktop\b737soundpack
2013-12-22 21:24 - 2013-12-22 21:29 - 00000000 ____D C:\Users\yannick\Documents\Freemake
2013-12-22 21:24 - 2013-12-22 21:25 - 00000000 ____D C:\ProgramData\Freemake
2013-12-22 21:24 - 2013-12-22 21:24 - 00000000 ____D C:\Program Files\Freemake
2013-12-22 20:05 - 2013-12-23 15:14 - 00000000 ____D C:\Users\yannick\Desktop\WOAI
2013-12-22 20:05 - 2013-12-22 20:08 - 02256077 _____ C:\Users\yannick\Desktop\AIFP2209.zip
2013-12-22 14:20 - 2013-12-22 14:20 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
2013-12-22 14:16 - 2013-12-22 14:16 - 00000000 ____D C:\Program Files\Audio Recorder Pro
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Program Files\IrfanView
2013-12-20 18:29 - 2013-12-20 18:30 - 08835307 _____ C:\Users\yannick\Desktop\Charts.zip
2013-12-20 16:56 - 2013-12-20 17:00 - 08861741 _____ C:\Users\yannick\Desktop\openvfr_terrain_ch_20.zip
2013-12-20 16:56 - 2013-12-20 16:56 - 00048674 _____ C:\Users\yannick\Desktop\openvfr_poi_ch_20.zip
2013-12-20 16:15 - 2013-12-20 16:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-20 15:52 - 2013-12-20 15:52 - 00513272 _____ C:\Users\yannick\Documents\fairtrade hausarbeit.odt
2013-12-20 15:49 - 2013-12-20 15:49 - 01920054 _____ C:\Users\yannick\Desktop\fairtrade.bmp
2013-12-20 15:44 - 2013-12-20 15:44 - 00000872 _____ C:\Users\yannick\AppData\Local\recently-used.xbel
2013-12-18 19:20 - 2013-12-18 20:33 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IvAi
2013-12-18 19:19 - 2013-12-18 19:19 - 00000849 _____ C:\Users\yannick\Desktop\IvAi - IVAO Interface.lnk
2013-12-12 13:08 - 2013-12-12 13:08 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-12-09 21:58 - 2013-12-09 21:58 - 00416248 _____ C:\Users\yannick\österreicher.wav
2013-12-09 12:16 - 2013-12-09 12:16 - 00048590 _____ C:\Users\yannick\mitschnitt SL.aup
2013-12-09 12:16 - 2013-12-09 12:16 - 00000000 ____D C:\Users\yannick\mitschnitt SL_data
2013-12-06 16:31 - 2013-12-21 08:53 - 00000931 _____ C:\Users\yannick\Desktop\Dropbox.lnk
2013-12-06 16:29 - 2013-12-21 08:53 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-06 16:29 - 2013-12-06 16:30 - 00000000 ____D C:\Program Files\Dropbox
2013-12-06 16:26 - 2013-12-27 14:45 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Dropbox
2013-12-05 22:03 - 2013-12-05 22:12 - 00000000 ____D C:\Users\yannick\Desktop\ILS SIM V4
2013-12-03 18:06 - 2013-12-03 18:06 - 00001106 _____ C:\Users\Public\Desktop\Hannover RP .lnk
2013-12-03 16:09 - 2013-12-03 16:09 - 00000000 ____D C:\Program Files\LogMeIn Hamachi
2013-11-29 20:21 - 2013-12-09 19:30 - 00003238 _____ C:\Users\yannick\Desktop\sonsim.ini
2013-11-29 20:21 - 2011-11-27 15:33 - 03584512 _____ (Kaweb.de) C:\Users\yannick\Desktop\sonsim.exe
==================== One Month Modified Files and Folders =======
2013-12-27 14:59 - 2013-12-27 14:59 - 00011411 _____ C:\Users\yannick\Desktop\FRST.txt
2013-12-27 14:58 - 2013-12-27 14:58 - 00000000 ____D C:\Users\yannick\Desktop\FRST-OlderVersion
2013-12-27 14:58 - 2013-12-24 16:35 - 00000000 ____D C:\FRST
2013-12-27 14:58 - 2013-12-24 16:33 - 01063503 _____ (Farbar) C:\Users\yannick\Desktop\FRST.exe
2013-12-27 14:56 - 2013-12-27 14:56 - 00001155 _____ C:\Users\yannick\Desktop\JRT.txt
2013-12-27 14:53 - 2013-12-27 14:53 - 00000000 ____D C:\Windows\ERUNT
2013-12-27 14:52 - 2013-12-27 14:52 - 00005734 _____ C:\Users\yannick\Desktop\AdwCleaner[S1].txt
2013-12-27 14:46 - 2006-11-02 13:49 - 01800740 _____ C:\Windows\WindowsUpdate.log
2013-12-27 14:45 - 2013-12-06 16:26 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Dropbox
2013-12-27 14:45 - 2013-10-17 17:26 - 00000000 ____D C:\Users\yannick\AppData\Local\Purplizer
2013-12-27 14:45 - 2013-09-12 19:36 - 00000000 ____D C:\Users\yannick\AppData\Local\Overwolf
2013-12-27 14:44 - 2013-07-09 14:49 - 00000000 ____D C:\Users\yannick\AppData\Local\LogMeIn Hamachi
2013-12-27 14:43 - 2013-10-31 18:20 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-27 14:43 - 2006-11-02 13:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-27 14:43 - 2006-11-02 13:45 - 00003776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-27 14:43 - 2006-11-02 13:45 - 00003776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-27 14:41 - 2006-11-02 13:58 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-27 14:38 - 2013-12-27 14:24 - 00000000 ____D C:\AdwCleaner
2013-12-27 14:32 - 2013-10-31 18:20 - 00001100 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-27 14:24 - 2013-03-01 13:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-27 14:21 - 2013-03-05 09:26 - 00093088 _____ C:\Windows\PFRO.log
2013-12-27 14:19 - 2013-12-27 14:19 - 00001468 _____ C:\Users\yannick\Desktop\123.txt
2013-12-27 13:35 - 2013-12-27 13:10 - 00002175 _____ C:\Users\yannick\Desktop\Stadtbahn Simulator Düsseldorf.lnk
2013-12-27 13:12 - 2013-12-27 13:10 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2013-12-27 13:10 - 2013-12-27 13:10 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-27 13:10 - 2013-12-27 13:10 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Malwarebytes
2013-12-27 13:10 - 2013-12-27 13:09 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stadtbahn Simulator Düsseldorf
2013-12-27 13:10 - 2013-12-27 13:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-27 13:09 - 2013-12-27 13:09 - 01233962 _____ C:\Users\yannick\Desktop\adwcleaner.exe
2013-12-27 13:09 - 2013-12-27 13:09 - 01034531 _____ (Thisisu) C:\Users\yannick\Desktop\JRT.exe
2013-12-27 13:09 - 2013-12-27 13:07 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\yannick\Desktop\mbam-setup-1.75.0.1300.exe
2013-12-27 09:45 - 2013-04-11 10:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Skype
2013-12-27 08:20 - 2013-12-27 08:20 - 00000827 _____ C:\Users\Public\Desktop\AESHelp for FSX.lnk
2013-12-26 21:07 - 2013-05-17 18:59 - 00000000 ____D C:\Users\yannick\AppData\Local\SecondLife
2013-12-26 21:07 - 2013-02-28 14:35 - 00000000 ____D C:\Users\yannick\AppData\Roaming\TS3Client
2013-12-26 17:16 - 2013-12-26 17:16 - 00155248 _____ C:\Windows\Minidump\Mini122613-01.dmp
2013-12-26 17:16 - 2013-04-30 20:08 - 192129844 _____ C:\Windows\MEMORY.DMP
2013-12-26 17:16 - 2013-04-30 20:08 - 00000000 ____D C:\Windows\Minidump
2013-12-26 15:29 - 2013-05-17 18:59 - 00000000 ____D C:\Program Files\SecondLifeViewer
2013-12-26 14:32 - 2013-12-26 14:32 - 00014964 _____ C:\ComboFix.txt
2013-12-26 14:32 - 2013-12-26 14:15 - 00000000 ____D C:\Qoobox
2013-12-26 14:32 - 2013-04-09 20:12 - 00000000 ____D C:\Users\yannick\AppData\Local\Apps\2.0
2013-12-26 14:32 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Default
2013-12-26 14:32 - 2006-11-02 12:18 - 00000000 ___RD C:\Users\Public
2013-12-26 14:30 - 2013-12-26 14:14 - 00000000 ____D C:\Windows\erdnt
2013-12-26 14:28 - 2006-11-02 11:23 - 00000231 _____ C:\Windows\system.ini
2013-12-26 14:14 - 2013-12-26 14:14 - 05158590 ____R (Swearware) C:\Users\yannick\Desktop\ComboFix.exe
2013-12-26 12:11 - 2013-12-26 12:08 - 00000000 ____D C:\Program Files\Steam
2013-12-26 12:08 - 2013-12-26 12:08 - 01133552 _____ C:\Users\yannick\Desktop\SteamSetup.exe
2013-12-26 12:08 - 2013-12-26 12:08 - 00000766 _____ C:\Users\Public\Desktop\Steam.lnk
2013-12-24 16:34 - 2013-12-24 16:34 - 00377856 _____ C:\Users\yannick\Desktop\gmer_2.1.19163.exe
2013-12-24 16:33 - 2013-12-24 16:33 - 00050477 _____ C:\Users\yannick\Desktop\Defogger.exe
2013-12-24 16:29 - 2013-12-24 16:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\AVAST Software
2013-12-24 16:28 - 2013-12-24 16:28 - 00775952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00270240 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-24 16:28 - 2013-12-24 16:28 - 00180248 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00057672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00054832 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00049944 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-24 16:28 - 2013-12-24 16:28 - 00001879 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-12-24 16:27 - 2013-12-24 16:27 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-24 16:25 - 2013-12-24 16:25 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-24 16:21 - 2013-12-24 16:19 - 91412976 _____ (AVAST Software) C:\Users\yannick\Desktop\avast_free_antivirus_setup.exe
2013-12-24 16:16 - 2013-10-26 16:07 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2
2013-12-24 16:15 - 2006-11-02 11:22 - 35127296 _____ C:\Windows\system32\config\software_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 25427968 _____ C:\Windows\system32\config\components_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 16252928 _____ C:\Windows\system32\config\system_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-12-24 16:14 - 2013-10-26 16:07 - 00000000 ____D C:\Program Files\HyperCam 2
2013-12-24 16:14 - 2013-09-22 12:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-12-24 16:14 - 2013-07-22 16:50 - 00000000 ____D C:\Fraps
2013-12-24 16:14 - 2013-04-10 10:54 - 00000000 ____D C:\Program Files\FS Recorder for FSX
2013-12-24 16:14 - 2013-04-08 13:59 - 00000000 ____D C:\ProgramData\Licenses
2013-12-24 16:14 - 2013-04-06 13:28 - 00000000 ____D C:\Users\yannick\AppData\Roaming\vlc
2013-12-24 16:14 - 2013-03-31 15:35 - 00000000 ____D C:\Users\yannick\AppData\Roaming\teamspeak2
2013-12-24 16:14 - 2013-03-11 13:00 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Audacity
2013-12-24 16:14 - 2013-02-28 14:18 - 00000000 ____D C:\Users\yannick\AppData\Roaming\TP-LINK
2013-12-24 16:14 - 2013-02-22 08:46 - 00000000 ____D C:\Users\yannick
2013-12-24 16:14 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\spool
2013-12-24 16:14 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-12-24 16:14 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\registration
2013-12-24 16:09 - 2013-12-24 13:34 - 95025368 ____T C:\ProgramData\9rjr0jwv.fee
2013-12-24 16:09 - 2013-12-24 13:34 - 00000000 _____ C:\ProgramData\9rjr0jwv.odd
2013-12-24 15:45 - 2013-02-22 08:46 - 00001356 _____ C:\Users\yannick\AppData\Local\d3d9caps.dat
2013-12-24 15:44 - 2013-11-16 13:24 - 00000552 _____ C:\Users\yannick\AppData\Local\d3d8caps.dat
2013-12-23 15:31 - 2013-12-23 15:31 - 00000000 ____D C:\Users\yannick\Desktop\FlusiFix-2006 V5.0
2013-12-23 15:14 - 2013-12-22 20:05 - 00000000 ____D C:\Users\yannick\Desktop\WOAI
2013-12-23 11:54 - 2013-12-23 11:53 - 00000000 ____D C:\Users\yannick\Desktop\b737soundpack
2013-12-22 21:29 - 2013-12-22 21:24 - 00000000 ____D C:\Users\yannick\Documents\Freemake
2013-12-22 21:25 - 2013-12-22 21:24 - 00000000 ____D C:\ProgramData\Freemake
2013-12-22 21:24 - 2013-12-22 21:24 - 00000000 ____D C:\Program Files\Freemake
2013-12-22 20:08 - 2013-12-22 20:05 - 02256077 _____ C:\Users\yannick\Desktop\AIFP2209.zip
2013-12-22 19:52 - 2013-08-24 07:41 - 00000000 ____D C:\Users\yannick\AppData\Local\World_of_AI
2013-12-22 15:10 - 2013-02-22 10:54 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-12-22 14:20 - 2013-12-22 14:20 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
2013-12-22 14:16 - 2013-12-22 14:16 - 00000000 ____D C:\Program Files\Audio Recorder Pro
2013-12-21 19:51 - 2006-11-02 11:33 - 01630066 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Program Files\IrfanView
2013-12-21 13:20 - 2013-11-09 23:27 - 00000000 ____D C:\Users\yannick\.gimp-2.8
2013-12-21 13:18 - 2013-07-02 19:59 - 00000000 ____D C:\Users\yannick\AppData\Local\Paint.NET
2013-12-21 08:53 - 2013-12-06 16:31 - 00000931 _____ C:\Users\yannick\Desktop\Dropbox.lnk
2013-12-21 08:53 - 2013-12-06 16:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-21 08:49 - 2013-02-28 14:21 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-20 18:30 - 2013-12-20 18:29 - 08835307 _____ C:\Users\yannick\Desktop\Charts.zip
2013-12-20 17:00 - 2013-12-20 16:56 - 08861741 _____ C:\Users\yannick\Desktop\openvfr_terrain_ch_20.zip
2013-12-20 16:56 - 2013-12-20 16:56 - 00048674 _____ C:\Users\yannick\Desktop\openvfr_poi_ch_20.zip
2013-12-20 16:15 - 2013-12-20 16:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-20 15:52 - 2013-12-20 15:52 - 00513272 _____ C:\Users\yannick\Documents\fairtrade hausarbeit.odt
2013-12-20 15:49 - 2013-12-20 15:49 - 01920054 _____ C:\Users\yannick\Desktop\fairtrade.bmp
2013-12-20 15:44 - 2013-12-20 15:44 - 00000872 _____ C:\Users\yannick\AppData\Local\recently-used.xbel
2013-12-18 20:33 - 2013-12-18 19:20 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IvAi
2013-12-18 19:19 - 2013-12-18 19:19 - 00000849 _____ C:\Users\yannick\Desktop\IvAi - IVAO Interface.lnk
2013-12-18 19:19 - 2013-04-11 09:17 - 00000000 ____D C:\Program Files\IVAO
2013-12-15 16:30 - 2013-09-22 12:19 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-12-12 13:08 - 2013-12-12 13:08 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-12-12 13:08 - 2013-09-12 19:37 - 00000000 ____D C:\Program Files\Overwolf
2013-12-11 18:24 - 2013-03-01 13:32 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-11 18:24 - 2013-03-01 13:32 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-12-10 07:44 - 2013-11-07 17:34 - 00000956 _____ C:\Users\Public\Desktop\Second Life Viewer.lnk
2013-12-09 21:58 - 2013-12-09 21:58 - 00416248 _____ C:\Users\yannick\österreicher.wav
2013-12-09 21:34 - 2013-03-11 12:58 - 00000000 ____D C:\Converted Audio Files
2013-12-09 19:30 - 2013-11-29 20:21 - 00003238 _____ C:\Users\yannick\Desktop\sonsim.ini
2013-12-09 12:16 - 2013-12-09 12:16 - 00048590 _____ C:\Users\yannick\mitschnitt SL.aup
2013-12-09 12:16 - 2013-12-09 12:16 - 00000000 ____D C:\Users\yannick\mitschnitt SL_data
2013-12-06 16:30 - 2013-12-06 16:29 - 00000000 ____D C:\Program Files\Dropbox
2013-12-05 22:12 - 2013-12-05 22:03 - 00000000 ____D C:\Users\yannick\Desktop\ILS SIM V4
2013-12-05 21:38 - 2013-10-31 18:31 - 00001969 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-03 18:06 - 2013-12-03 18:06 - 00001106 _____ C:\Users\Public\Desktop\Hannover RP .lnk
2013-12-03 18:06 - 2013-05-31 20:19 - 00000000 ____D C:\Program Files\KY-Programming
2013-12-03 16:09 - 2013-12-03 16:09 - 00000000 ____D C:\Program Files\LogMeIn Hamachi
2013-11-28 17:00 - 2013-10-28 19:06 - 00000000 ____D C:\Users\yannick\Documents\Nicole
Some content of TEMP:
====================
C:\Users\yannick\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-27 14:49
==================== End Of Log ============================
Ganz liebe Grüße Yannick |
|
28.12.2013, 12:44
| #8 |
| /// the machine /// TB-Ausbilder | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher?ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.12.2013, 19:54
| #9 |
| | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? Hey Nö keine im Moment  Der Log vom ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=dc98455ee730e644977437b8a713c599
# engine=16430
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-28 06:04:06
# local_time=2013-12-28 07:04:06 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=774 16777213 71 76 358541 358577 0 0
# compatibility_mode=5892 16776574 100 95 25785943 225786618 0 0
# scanned=560167
# found=3
# cleaned=0
# scan_time=12738
sh=739977DC1F356D59DEFCB3A6919DCAF696EEA843 ft=1 fh=15f857a6134cdfb8 vn="Variante von Win32/Kryptik.BRTZ Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\ProgramData\vwj0rjr9.jss.vir"
sh=CF5FF332AF377A3EAADB58638D98DF4903026CE0 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\yannick\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\3d7df596-7c591a5b"
sh=91414FC78D9E91CC9F1AAA7C2B8C8D9D53D1BC75 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\yannick\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\37cb34f0-16514c5a"
Code:
ATTFilter Results of screen317's Security Check version 0.99.77 Windows Vista Service Pack 1 x86 (UAC is enabled) Out of date service pack!! Internet Explorer 7 Out of date! ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Antivirus out of date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 CCleaner Java 7 Update 25 Java version out of Date! Adobe Flash Player 11.9.900.170 Adobe Reader 10.1.4 Adobe Reader out of Date! Mozilla Firefox (26.0) Google Chrome 31.0.1650.57 Google Chrome 31.0.1650.63 ````````Process Check: objlist.exe by Laurent```````` AVAST Software Avast AvastSvc.exe AVAST Software Avast AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-12-2013 01
Ran by yannick (administrator) on YANNICK-PC on 28-12-2013 19:55:38
Running from C:\Users\yannick\Desktop
Microsoft® Windows Vista™ Home Basic Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\System32\ASGT.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Ralink Technology, Corp.) C:\Program Files\TP-LINK\TP-LINK Wireless Configuration Utility\Service\RaRegistry.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(LogMeIn Inc.) C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(TeamSpeak Systems GmbH) C:\Program Files\TeamSpeak 3 Client\ts3client_win32.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [Nvtmru] - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [3806544 2013-11-29] (LogMeIn Inc.)
HKLM\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-24] (AVAST Software)
HKLM\...\RunOnce: [20131224] - C:\Program Files\AVAST Software\Avast\setup\emupdate\de4c72ed-c88d-4763-9037-d0e06bd927a2.exe /check [181136 2013-12-28] (AVAST Software)
HKCU\...\Run: [RGSC] - C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20684656 2013-07-25] (Skype Technologies S.A.)
HKCU\...\Run: [ECFSTServ] - C:\Users\yannick\Desktop\lotsen\Easy Clearance 3\ECFSTServ.exe [1067520 2010-04-18] ()
HKCU\...\Run: [MP3 Skype Recorder] - C:\Program Files\MP3 Skype Recorder\MP3 Skype Recorder.exe [1975296 2011-11-17] (Alexander Nikiforov)
HKCU\...\Run: [DT Emphelungstool] - "C:\Users\yannick\AppData\Local\Deutsche Telekom\Empfehlungstool\DTEmpfehlungstool.exe" 2
HKCU\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [35768 2013-12-09] (Overwolf)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
Startup: C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\yannick\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wecker für Windows 6.lnk
ShortcutTarget: Wecker für Windows 6.lnk -> C:\Program Files\Wecker6\Wecker.exe (Christoph Bünger Software)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\MP3 Skype Recorder\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\yannick\AppData\Roaming\Mozilla\Firefox\Profiles\b4cu94sg.default
FF Homepage: www.google.de
FF Keyword.URL: hxxp://www.google.de/search?q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nullsoft.com/winampDetector;version=1 - C:\Program Files\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Hilfe Assistent - C:\Users\yannick\AppData\Roaming\Mozilla\Firefox\Profiles\b4cu94sg.default\Extensions\{}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
CHR Extension: (Google Docs) - C:\Users\yannick\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\yannick\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\yannick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\yannick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (avast! Online Security) - C:\Users\yannick\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\9.0.2011.70_0
CHR Extension: (Google Wallet) - C:\Users\yannick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\yannick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx
========================== Services (Whitelisted) =================
R2 ASGT; C:\Windows\System32\ASGT.exe [55296 2012-01-17] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-24] (AVAST Software)
R2 Hamachi2Svc; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [1664336 2013-11-29] (LogMeIn Inc.)
R2 LMIGuardianSvc; C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe [375056 2013-10-11] (LogMeIn, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [96184 2013-12-09] (Overwolf)
R2 RalinkRegistryWriter; C:\Program Files\TP-LINK\TP-LINK Wireless Configuration Utility\Service\RaRegistry.exe [375872 2011-12-26] (Ralink Technology, Corp.)
==================== Drivers (Whitelisted) ====================
R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
S3 AIDA64Driver; C:\Program Files\FinalWire\AIDA64 Extreme Edition\kerneld.x32 [28824 2011-08-18] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2013-12-24] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [54832 2013-12-24] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49944 2013-12-24] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [775952 2013-12-24] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [410528 2013-12-24] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57672 2013-12-24] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [180248 2013-12-24] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-20] (AVG Technologies)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
R3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-12-27] (Malwarebytes Corporation)
R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [1093472 2012-02-14] (Ralink Technology Corp.)
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-18] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\yannick\AppData\Local\Temp\catchme.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
R4 IOMap; \??\C:\Windows\system32\drivers\IOMap.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-28 19:55 - 2013-12-28 19:55 - 00012962 _____ C:\Users\yannick\Desktop\FRST.txt
2013-12-28 19:55 - 2013-12-28 19:55 - 00000000 ____D C:\Users\yannick\Desktop\FRST-OlderVersion
2013-12-28 15:27 - 2013-12-28 15:27 - 00891200 _____ C:\Users\yannick\Desktop\SecurityCheck.exe
2013-12-28 15:24 - 2013-12-28 15:25 - 02347384 _____ (ESET) C:\Users\yannick\Desktop\esetsmartinstaller_deu.exe
2013-12-28 12:15 - 2013-12-28 12:15 - 00000852 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-12-28 12:15 - 2013-12-28 12:15 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-28 12:15 - 2013-12-28 12:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-27 22:24 - 2013-12-28 19:25 - 00016092 _____ C:\Users\yannick\Desktop\Buch.odt
2013-12-27 22:11 - 2013-12-27 22:11 - 02461001 _____ C:\Users\yannick\Documents\buch.wma
2013-12-27 21:19 - 2013-12-27 21:19 - 00000000 _____ C:\Windows\setuperr.log
2013-12-27 21:19 - 2013-12-27 21:19 - 00000000 _____ C:\Windows\setupact.log
2013-12-27 20:10 - 2013-12-27 20:10 - 00000810 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-12-27 20:10 - 2013-12-27 20:10 - 00000000 ____D C:\Program Files\CCleaner
2013-12-27 20:09 - 2013-12-27 20:09 - 03571656 _____ (Piriform Ltd) C:\Users\yannick\Desktop\ccsetup409_slim.exe
2013-12-27 19:26 - 2013-12-27 19:26 - 00000141 _____ C:\Users\yannick\Desktop\sich.txt
2013-12-27 19:04 - 2013-12-27 19:04 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SunSkyJet Sceneries
2013-12-27 16:39 - 2013-12-27 16:39 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Just Flight
2013-12-27 14:56 - 2013-12-27 14:56 - 00001155 _____ C:\Users\yannick\Desktop\JRT.txt
2013-12-27 14:53 - 2013-12-27 14:53 - 00000000 ____D C:\Windows\ERUNT
2013-12-27 14:52 - 2013-12-27 14:52 - 00005734 _____ C:\Users\yannick\Desktop\AdwCleaner[S1].txt
2013-12-27 14:24 - 2013-12-27 14:38 - 00000000 ____D C:\AdwCleaner
2013-12-27 14:19 - 2013-12-27 14:19 - 00001468 _____ C:\Users\yannick\Desktop\123.txt
2013-12-27 13:10 - 2013-12-28 15:36 - 00002175 _____ C:\Users\yannick\Desktop\Stadtbahn Simulator Düsseldorf.lnk
2013-12-27 13:10 - 2013-12-27 13:12 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2013-12-27 13:10 - 2013-12-27 13:10 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-27 13:10 - 2013-12-27 13:10 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Malwarebytes
2013-12-27 13:09 - 2013-12-27 13:10 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stadtbahn Simulator Düsseldorf
2013-12-27 13:09 - 2013-12-27 13:10 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-27 13:09 - 2013-12-27 13:09 - 01233962 _____ C:\Users\yannick\Desktop\adwcleaner.exe
2013-12-27 13:09 - 2013-12-27 13:09 - 01034531 _____ (Thisisu) C:\Users\yannick\Desktop\JRT.exe
2013-12-27 13:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-27 13:07 - 2013-12-27 13:09 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\yannick\Desktop\mbam-setup-1.75.0.1300.exe
2013-12-27 08:20 - 2013-12-27 08:20 - 00000827 _____ C:\Users\Public\Desktop\AESHelp for FSX.lnk
2013-12-26 14:32 - 2013-12-26 14:32 - 00014964 _____ C:\ComboFix.txt
2013-12-26 14:15 - 2013-12-26 14:32 - 00000000 ____D C:\Qoobox
2013-12-26 14:15 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-26 14:15 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-26 14:15 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-26 14:15 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-26 14:15 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-26 14:15 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-26 14:15 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-26 14:15 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-26 14:14 - 2013-12-26 14:30 - 00000000 ____D C:\Windows\erdnt
2013-12-26 14:14 - 2013-12-26 14:14 - 05158590 ____R (Swearware) C:\Users\yannick\Desktop\ComboFix.exe
2013-12-26 12:08 - 2013-12-26 12:11 - 00000000 ____D C:\Program Files\Steam
2013-12-26 12:08 - 2013-12-26 12:08 - 01133552 _____ C:\Users\yannick\Desktop\SteamSetup.exe
2013-12-26 12:08 - 2013-12-26 12:08 - 00000766 _____ C:\Users\Public\Desktop\Steam.lnk
2013-12-24 16:35 - 2013-12-28 19:55 - 00000000 ____D C:\FRST
2013-12-24 16:34 - 2013-12-24 16:34 - 00377856 _____ C:\Users\yannick\Desktop\gmer_2.1.19163.exe
2013-12-24 16:33 - 2013-12-28 19:55 - 01064037 _____ (Farbar) C:\Users\yannick\Desktop\FRST.exe
2013-12-24 16:33 - 2013-12-24 16:33 - 00050477 _____ C:\Users\yannick\Desktop\Defogger.exe
2013-12-24 16:29 - 2013-12-24 16:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\AVAST Software
2013-12-24 16:28 - 2013-12-24 16:28 - 00775952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00270240 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-24 16:28 - 2013-12-24 16:28 - 00180248 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00057672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00054832 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00049944 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-24 16:28 - 2013-12-24 16:28 - 00001879 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-12-24 16:27 - 2013-12-24 16:27 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-24 16:25 - 2013-12-24 16:25 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-24 16:19 - 2013-12-24 16:21 - 91412976 _____ (AVAST Software) C:\Users\yannick\Desktop\avast_free_antivirus_setup.exe
2013-12-24 13:34 - 2013-12-24 16:09 - 95025368 ____T C:\ProgramData\9rjr0jwv.fee
2013-12-24 13:34 - 2013-12-24 16:09 - 00000000 _____ C:\ProgramData\9rjr0jwv.odd
2013-12-23 15:31 - 2013-12-23 15:31 - 00000000 ____D C:\Users\yannick\Desktop\FlusiFix-2006 V5.0
2013-12-23 11:53 - 2013-12-23 11:54 - 00000000 ____D C:\Users\yannick\Desktop\b737soundpack
2013-12-22 21:24 - 2013-12-22 21:29 - 00000000 ____D C:\Users\yannick\Documents\Freemake
2013-12-22 21:24 - 2013-12-22 21:25 - 00000000 ____D C:\ProgramData\Freemake
2013-12-22 21:24 - 2013-12-22 21:24 - 00000000 ____D C:\Program Files\Freemake
2013-12-22 20:05 - 2013-12-23 15:14 - 00000000 ____D C:\Users\yannick\Desktop\WOAI
2013-12-22 20:05 - 2013-12-22 20:08 - 02256077 _____ C:\Users\yannick\Desktop\AIFP2209.zip
2013-12-22 14:20 - 2013-12-22 14:20 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
2013-12-22 14:16 - 2013-12-22 14:16 - 00000000 ____D C:\Program Files\Audio Recorder Pro
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Program Files\IrfanView
2013-12-20 18:29 - 2013-12-20 18:30 - 08835307 _____ C:\Users\yannick\Desktop\Charts.zip
2013-12-20 16:56 - 2013-12-20 17:00 - 08861741 _____ C:\Users\yannick\Desktop\openvfr_terrain_ch_20.zip
2013-12-20 16:56 - 2013-12-20 16:56 - 00048674 _____ C:\Users\yannick\Desktop\openvfr_poi_ch_20.zip
2013-12-20 15:52 - 2013-12-20 15:52 - 00513272 _____ C:\Users\yannick\Documents\fairtrade hausarbeit.odt
2013-12-20 15:49 - 2013-12-20 15:49 - 01920054 _____ C:\Users\yannick\Desktop\fairtrade.bmp
2013-12-20 15:44 - 2013-12-20 15:44 - 00000872 _____ C:\Users\yannick\AppData\Local\recently-used.xbel
2013-12-18 19:20 - 2013-12-18 20:33 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IvAi
2013-12-18 19:19 - 2013-12-18 19:19 - 00000849 _____ C:\Users\yannick\Desktop\IvAi - IVAO Interface.lnk
2013-12-12 13:08 - 2013-12-12 13:08 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-12-09 21:58 - 2013-12-09 21:58 - 00416248 _____ C:\Users\yannick\österreicher.wav
2013-12-09 12:16 - 2013-12-09 12:16 - 00048590 _____ C:\Users\yannick\mitschnitt SL.aup
2013-12-09 12:16 - 2013-12-09 12:16 - 00000000 ____D C:\Users\yannick\mitschnitt SL_data
2013-12-06 16:31 - 2013-12-21 08:53 - 00000931 _____ C:\Users\yannick\Desktop\Dropbox.lnk
2013-12-06 16:29 - 2013-12-21 08:53 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-06 16:29 - 2013-12-06 16:30 - 00000000 ____D C:\Program Files\Dropbox
2013-12-06 16:26 - 2013-12-27 14:45 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Dropbox
2013-12-05 22:03 - 2013-12-05 22:12 - 00000000 ____D C:\Users\yannick\Desktop\ILS SIM V4
2013-12-03 18:06 - 2013-12-03 18:06 - 00001106 _____ C:\Users\Public\Desktop\Hannover RP .lnk
2013-12-03 16:09 - 2013-12-03 16:09 - 00000000 ____D C:\Program Files\LogMeIn Hamachi
2013-11-29 20:21 - 2013-12-09 19:30 - 00003238 _____ C:\Users\yannick\Desktop\sonsim.ini
2013-11-29 20:21 - 2011-11-27 15:33 - 03584512 _____ (Kaweb.de) C:\Users\yannick\Desktop\sonsim.exe
==================== One Month Modified Files and Folders =======
2013-12-28 19:55 - 2013-12-28 19:55 - 00012962 _____ C:\Users\yannick\Desktop\FRST.txt
2013-12-28 19:55 - 2013-12-28 19:55 - 00000000 ____D C:\Users\yannick\Desktop\FRST-OlderVersion
2013-12-28 19:55 - 2013-12-24 16:35 - 00000000 ____D C:\FRST
2013-12-28 19:55 - 2013-12-24 16:33 - 01064037 _____ (Farbar) C:\Users\yannick\Desktop\FRST.exe
2013-12-28 19:49 - 2013-04-11 10:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Skype
2013-12-28 19:32 - 2013-10-31 18:20 - 00001100 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-28 19:32 - 2013-02-28 14:35 - 00000000 ____D C:\Users\yannick\AppData\Roaming\TS3Client
2013-12-28 19:25 - 2013-12-27 22:24 - 00016092 _____ C:\Users\yannick\Desktop\Buch.odt
2013-12-28 19:25 - 2006-11-02 13:45 - 00003776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-28 19:25 - 2006-11-02 13:45 - 00003776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-28 19:24 - 2013-03-01 13:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-28 19:06 - 2006-11-02 13:49 - 01243318 _____ C:\Windows\WindowsUpdate.log
2013-12-28 18:11 - 2013-05-17 18:59 - 00000000 ____D C:\Users\yannick\AppData\Local\SecondLife
2013-12-28 15:36 - 2013-12-27 13:10 - 00002175 _____ C:\Users\yannick\Desktop\Stadtbahn Simulator Düsseldorf.lnk
2013-12-28 15:27 - 2013-12-28 15:27 - 00891200 _____ C:\Users\yannick\Desktop\SecurityCheck.exe
2013-12-28 15:25 - 2013-12-28 15:24 - 02347384 _____ (ESET) C:\Users\yannick\Desktop\esetsmartinstaller_deu.exe
2013-12-28 15:22 - 2013-05-17 18:59 - 00000000 ____D C:\Program Files\SecondLifeViewer
2013-12-28 12:15 - 2013-12-28 12:15 - 00000852 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-12-28 12:15 - 2013-12-28 12:15 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-28 12:15 - 2013-12-28 12:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-28 12:09 - 2013-07-09 14:49 - 00000000 ____D C:\Users\yannick\AppData\Local\LogMeIn Hamachi
2013-12-28 12:07 - 2013-10-31 18:20 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-28 12:07 - 2006-11-02 13:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-28 00:48 - 2006-11-02 13:58 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-28 00:44 - 2013-03-11 13:00 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Audacity
2013-12-28 00:10 - 2013-09-09 21:17 - 00000000 _____ C:\conversation.log
2013-12-27 23:31 - 2013-02-23 17:11 - 00009216 _____ C:\Users\yannick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-12-27 22:11 - 2013-12-27 22:11 - 02461001 _____ C:\Users\yannick\Documents\buch.wma
2013-12-27 21:19 - 2013-12-27 21:19 - 00000000 _____ C:\Windows\setuperr.log
2013-12-27 21:19 - 2013-12-27 21:19 - 00000000 _____ C:\Windows\setupact.log
2013-12-27 20:14 - 2013-07-27 16:57 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Winamp
2013-12-27 20:14 - 2013-03-18 17:27 - 00000000 ____D C:\Users\yannick\AppData\Roaming\uTorrent
2013-12-27 20:13 - 2013-04-30 20:08 - 00000000 ____D C:\Windows\Minidump
2013-12-27 20:13 - 2013-02-22 08:34 - 00000000 ____D C:\Windows\Panther
2013-12-27 20:10 - 2013-12-27 20:10 - 00000810 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-12-27 20:10 - 2013-12-27 20:10 - 00000000 ____D C:\Program Files\CCleaner
2013-12-27 20:09 - 2013-12-27 20:09 - 03571656 _____ (Piriform Ltd) C:\Users\yannick\Desktop\ccsetup409_slim.exe
2013-12-27 19:26 - 2013-12-27 19:26 - 00000141 _____ C:\Users\yannick\Desktop\sich.txt
2013-12-27 19:04 - 2013-12-27 19:04 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SunSkyJet Sceneries
2013-12-27 17:45 - 2013-10-16 09:05 - 00000000 ____D C:\Users\yannick\Documents\Flight Simulator X Files
2013-12-27 17:27 - 2013-02-22 10:54 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-12-27 16:39 - 2013-12-27 16:39 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Just Flight
2013-12-27 14:56 - 2013-12-27 14:56 - 00001155 _____ C:\Users\yannick\Desktop\JRT.txt
2013-12-27 14:53 - 2013-12-27 14:53 - 00000000 ____D C:\Windows\ERUNT
2013-12-27 14:52 - 2013-12-27 14:52 - 00005734 _____ C:\Users\yannick\Desktop\AdwCleaner[S1].txt
2013-12-27 14:45 - 2013-12-06 16:26 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Dropbox
2013-12-27 14:45 - 2013-10-17 17:26 - 00000000 ____D C:\Users\yannick\AppData\Local\Purplizer
2013-12-27 14:45 - 2013-09-12 19:36 - 00000000 ____D C:\Users\yannick\AppData\Local\Overwolf
2013-12-27 14:38 - 2013-12-27 14:24 - 00000000 ____D C:\AdwCleaner
2013-12-27 14:19 - 2013-12-27 14:19 - 00001468 _____ C:\Users\yannick\Desktop\123.txt
2013-12-27 13:12 - 2013-12-27 13:10 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2013-12-27 13:10 - 2013-12-27 13:10 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-27 13:10 - 2013-12-27 13:10 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Malwarebytes
2013-12-27 13:10 - 2013-12-27 13:09 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stadtbahn Simulator Düsseldorf
2013-12-27 13:10 - 2013-12-27 13:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-27 13:09 - 2013-12-27 13:09 - 01233962 _____ C:\Users\yannick\Desktop\adwcleaner.exe
2013-12-27 13:09 - 2013-12-27 13:09 - 01034531 _____ (Thisisu) C:\Users\yannick\Desktop\JRT.exe
2013-12-27 13:09 - 2013-12-27 13:07 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\yannick\Desktop\mbam-setup-1.75.0.1300.exe
2013-12-27 08:20 - 2013-12-27 08:20 - 00000827 _____ C:\Users\Public\Desktop\AESHelp for FSX.lnk
2013-12-26 14:32 - 2013-12-26 14:32 - 00014964 _____ C:\ComboFix.txt
2013-12-26 14:32 - 2013-12-26 14:15 - 00000000 ____D C:\Qoobox
2013-12-26 14:32 - 2013-04-09 20:12 - 00000000 ____D C:\Users\yannick\AppData\Local\Apps\2.0
2013-12-26 14:32 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Default
2013-12-26 14:32 - 2006-11-02 12:18 - 00000000 ___RD C:\Users\Public
2013-12-26 14:30 - 2013-12-26 14:14 - 00000000 ____D C:\Windows\erdnt
2013-12-26 14:28 - 2006-11-02 11:23 - 00000231 _____ C:\Windows\system.ini
2013-12-26 14:14 - 2013-12-26 14:14 - 05158590 ____R (Swearware) C:\Users\yannick\Desktop\ComboFix.exe
2013-12-26 12:11 - 2013-12-26 12:08 - 00000000 ____D C:\Program Files\Steam
2013-12-26 12:08 - 2013-12-26 12:08 - 01133552 _____ C:\Users\yannick\Desktop\SteamSetup.exe
2013-12-26 12:08 - 2013-12-26 12:08 - 00000766 _____ C:\Users\Public\Desktop\Steam.lnk
2013-12-24 16:34 - 2013-12-24 16:34 - 00377856 _____ C:\Users\yannick\Desktop\gmer_2.1.19163.exe
2013-12-24 16:33 - 2013-12-24 16:33 - 00050477 _____ C:\Users\yannick\Desktop\Defogger.exe
2013-12-24 16:29 - 2013-12-24 16:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\AVAST Software
2013-12-24 16:28 - 2013-12-24 16:28 - 00775952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00410528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00270240 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-24 16:28 - 2013-12-24 16:28 - 00180248 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00057672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00054832 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00049944 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-24 16:28 - 2013-12-24 16:28 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-24 16:28 - 2013-12-24 16:28 - 00001879 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-12-24 16:27 - 2013-12-24 16:27 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-24 16:25 - 2013-12-24 16:25 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-24 16:21 - 2013-12-24 16:19 - 91412976 _____ (AVAST Software) C:\Users\yannick\Desktop\avast_free_antivirus_setup.exe
2013-12-24 16:16 - 2013-10-26 16:07 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2
2013-12-24 16:15 - 2006-11-02 11:22 - 35127296 _____ C:\Windows\system32\config\software_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 25427968 _____ C:\Windows\system32\config\components_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 16252928 _____ C:\Windows\system32\config\system_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-12-24 16:15 - 2006-11-02 11:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-12-24 16:14 - 2013-10-26 16:07 - 00000000 ____D C:\Program Files\HyperCam 2
2013-12-24 16:14 - 2013-09-22 12:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-12-24 16:14 - 2013-07-22 16:50 - 00000000 ____D C:\Fraps
2013-12-24 16:14 - 2013-04-10 10:54 - 00000000 ____D C:\Program Files\FS Recorder for FSX
2013-12-24 16:14 - 2013-04-08 13:59 - 00000000 ____D C:\ProgramData\Licenses
2013-12-24 16:14 - 2013-04-06 13:28 - 00000000 ____D C:\Users\yannick\AppData\Roaming\vlc
2013-12-24 16:14 - 2013-03-31 15:35 - 00000000 ____D C:\Users\yannick\AppData\Roaming\teamspeak2
2013-12-24 16:14 - 2013-02-28 14:18 - 00000000 ____D C:\Users\yannick\AppData\Roaming\TP-LINK
2013-12-24 16:14 - 2013-02-22 08:46 - 00000000 ____D C:\Users\yannick
2013-12-24 16:14 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\spool
2013-12-24 16:14 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-12-24 16:14 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\registration
2013-12-24 16:09 - 2013-12-24 13:34 - 95025368 ____T C:\ProgramData\9rjr0jwv.fee
2013-12-24 16:09 - 2013-12-24 13:34 - 00000000 _____ C:\ProgramData\9rjr0jwv.odd
2013-12-24 15:45 - 2013-02-22 08:46 - 00001356 _____ C:\Users\yannick\AppData\Local\d3d9caps.dat
2013-12-24 15:44 - 2013-11-16 13:24 - 00000552 _____ C:\Users\yannick\AppData\Local\d3d8caps.dat
2013-12-23 15:31 - 2013-12-23 15:31 - 00000000 ____D C:\Users\yannick\Desktop\FlusiFix-2006 V5.0
2013-12-23 15:14 - 2013-12-22 20:05 - 00000000 ____D C:\Users\yannick\Desktop\WOAI
2013-12-23 11:54 - 2013-12-23 11:53 - 00000000 ____D C:\Users\yannick\Desktop\b737soundpack
2013-12-22 21:29 - 2013-12-22 21:24 - 00000000 ____D C:\Users\yannick\Documents\Freemake
2013-12-22 21:25 - 2013-12-22 21:24 - 00000000 ____D C:\ProgramData\Freemake
2013-12-22 21:24 - 2013-12-22 21:24 - 00000000 ____D C:\Program Files\Freemake
2013-12-22 20:08 - 2013-12-22 20:05 - 02256077 _____ C:\Users\yannick\Desktop\AIFP2209.zip
2013-12-22 19:52 - 2013-08-24 07:41 - 00000000 ____D C:\Users\yannick\AppData\Local\World_of_AI
2013-12-22 14:20 - 2013-12-22 14:20 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
2013-12-22 14:16 - 2013-12-22 14:16 - 00000000 ____D C:\Program Files\Audio Recorder Pro
2013-12-21 19:51 - 2006-11-02 11:33 - 01630066 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IrfanView
2013-12-21 13:36 - 2013-12-21 13:36 - 00000000 ____D C:\Program Files\IrfanView
2013-12-21 13:20 - 2013-11-09 23:27 - 00000000 ____D C:\Users\yannick\.gimp-2.8
2013-12-21 13:18 - 2013-07-02 19:59 - 00000000 ____D C:\Users\yannick\AppData\Local\Paint.NET
2013-12-21 08:53 - 2013-12-06 16:31 - 00000931 _____ C:\Users\yannick\Desktop\Dropbox.lnk
2013-12-21 08:53 - 2013-12-06 16:29 - 00000000 ____D C:\Users\yannick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-20 18:30 - 2013-12-20 18:29 - 08835307 _____ C:\Users\yannick\Desktop\Charts.zip
2013-12-20 17:00 - 2013-12-20 16:56 - 08861741 _____ C:\Users\yannick\Desktop\openvfr_terrain_ch_20.zip
2013-12-20 16:56 - 2013-12-20 16:56 - 00048674 _____ C:\Users\yannick\Desktop\openvfr_poi_ch_20.zip
2013-12-20 15:52 - 2013-12-20 15:52 - 00513272 _____ C:\Users\yannick\Documents\fairtrade hausarbeit.odt
2013-12-20 15:49 - 2013-12-20 15:49 - 01920054 _____ C:\Users\yannick\Desktop\fairtrade.bmp
2013-12-20 15:44 - 2013-12-20 15:44 - 00000872 _____ C:\Users\yannick\AppData\Local\recently-used.xbel
2013-12-18 20:33 - 2013-12-18 19:20 - 00000000 ____D C:\Users\yannick\AppData\Roaming\IvAi
2013-12-18 19:19 - 2013-12-18 19:19 - 00000849 _____ C:\Users\yannick\Desktop\IvAi - IVAO Interface.lnk
2013-12-18 19:19 - 2013-04-11 09:17 - 00000000 ____D C:\Program Files\IVAO
2013-12-15 16:30 - 2013-09-22 12:19 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-12-12 13:08 - 2013-12-12 13:08 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-12-12 13:08 - 2013-09-12 19:37 - 00000000 ____D C:\Program Files\Overwolf
2013-12-11 18:24 - 2013-03-01 13:32 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-11 18:24 - 2013-03-01 13:32 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-12-10 07:44 - 2013-11-07 17:34 - 00000956 _____ C:\Users\Public\Desktop\Second Life Viewer.lnk
2013-12-09 21:58 - 2013-12-09 21:58 - 00416248 _____ C:\Users\yannick\österreicher.wav
2013-12-09 21:34 - 2013-03-11 12:58 - 00000000 ____D C:\Converted Audio Files
2013-12-09 19:30 - 2013-11-29 20:21 - 00003238 _____ C:\Users\yannick\Desktop\sonsim.ini
2013-12-09 12:16 - 2013-12-09 12:16 - 00048590 _____ C:\Users\yannick\mitschnitt SL.aup
2013-12-09 12:16 - 2013-12-09 12:16 - 00000000 ____D C:\Users\yannick\mitschnitt SL_data
2013-12-06 16:30 - 2013-12-06 16:29 - 00000000 ____D C:\Program Files\Dropbox
2013-12-05 22:12 - 2013-12-05 22:03 - 00000000 ____D C:\Users\yannick\Desktop\ILS SIM V4
2013-12-05 21:38 - 2013-10-31 18:31 - 00001969 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-03 18:06 - 2013-12-03 18:06 - 00001106 _____ C:\Users\Public\Desktop\Hannover RP .lnk
2013-12-03 18:06 - 2013-05-31 20:19 - 00000000 ____D C:\Program Files\KY-Programming
2013-12-03 16:09 - 2013-12-03 16:09 - 00000000 ____D C:\Program Files\LogMeIn Hamachi
2013-11-28 17:00 - 2013-10-28 19:06 - 00000000 ____D C:\Users\yannick\Documents\Nicole
Some content of TEMP:
====================
C:\Users\yannick\AppData\Local\temp\Quarantine.exe
C:\Users\yannick\AppData\Local\temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-28 12:14
==================== End Of Log ============================
LG Yannick |
|
29.12.2013, 12:35
| #10 |
| /// the machine /// TB-Ausbilder | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? Java, Adobe und Windows updaten. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Fertig Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.01.2014, 20:15
| #11 |
| | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? Alles klar, vielen, vielen Dank für deine Hilfe LG Yannick |
|
06.01.2014, 16:39
| #12 |
| /// the machine /// TB-Ausbilder | Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows Vista: Ist der Computer nach dem BKA Trojaner nun wieder sicher? |
| abgesicherten, anhang, anleitung, chip, computer, datei, daten, filter, forum, frage, geändert, gmer, heute, logfiles, modus, neustart, nichts, online, power, schonmal, trojaner, vista, webcams, windows, windows vista |
Linear-Darstellung
