| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Ich kann keine dateien herrunterladen.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
10.01.2014, 13:43
| #1 |
| |  Ich kann keine dateien herrunterladen. Hallo Trojaner-Profis, meine Vorgeschichte: Llegales W7 Home Premium, Avira Antir Free. und ich nutze keine Programme mit irgendwelchen Cracks ect...Nebenbei läuft Ubuntu auf einer anderen Partition einwandfrei... Das einzigste was ich im Nachhinein sehr bereue, ist dass ich auf movie4k ein Film angeguckt hab. Da ich in Südamerika mitten in der Pampa sitz, kann ich mir keine llegalen Filme kaufen. (Will das jetzt auch nicht rechtfertigen, das war das erste und letzte mal!) mein Problem: Ich kann nichts herrunterladen. Kein Update bei Antivir, kein Download bei Crome, Firefox, Explorer. meine Vermutung: Durch das Film gucken auf movie4k hab ich mir irgend etwas eingefangen. meine Bitte: Was soll ich tun? Ich hab keine Ahnung was ich machen kann bzw. wo ich anfangen soll. Gruß Samuel |
|
10.01.2014, 13:58
| #2 |
| /// the machine /// TB-Ausbilder    | Ich kann keine dateien herrunterladen. hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
10.01.2014, 14:15
| #3 |
| | Ich kann keine dateien herrunterladen. Ok vielen Dank schrauber!
__________________1. Da ich nichts herrunterladen kann, muss ich über einen zweiten PC die Datei herrunterladen und via USB stick auf mein PC kopieren. 2. Problem 2: Ich kann auch nichts von meinem USB Stick auf mein PC transferieren. Ich bekomme immer eine Fehlermeldung, dass die Datei beschädigt ist. Die Datei ist aber nicht beschädigt, das Problem, tritt nur bei mir auf. 3. Ich führ FRST vom USB stick aus: Ich bekomm auch eine Fehlermeldung, dass bei einer Zeile das Programm nicht ausgeführt werden konnte. eine FRST.txt Datei hab ich bekommen (Siehe Anhang). Weiß jetzt aber nicht ob das was nützt. Addition.txt Ausgabe nicht möglich. 4. Danke für deine Geduld und Hilfe! 5. Edit: Über ubuntu hab ich versucht das Programm FRST auf mein W7 verzeichnis zu kopieren. Erfolgreich. Dann nochmal versucht das Programm laufen zu lassen. Programm läuft zwei Sekunden dann die Fehlermeldung: AUTOIT ERROR (Line 8904 (File "C:\Useres\FRST64.exe"): Error: Object referenced outside a "With" statement.) Geändert von SamuelS (10.01.2014 um 14:31 Uhr) |
|
10.01.2014, 15:03
| #4 |
| | Ich kann keine dateien herrunterladen. Etwas neues probiert: Ich konnte OTL herrunterladen (schlag mich tot, warum das hier geht...) und konnte Scanns durchführen. Hatte folgende Anleitung durchgeführt: http://www.trojaner-board.de/85104-o...-oldtimer.html OTL.TXT Code:
ATTFilter OTL logfile created on: 10.01.2014 10:46:59 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\expert\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.16428) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,68 Gb Total Physical Memory | 1,96 Gb Available Physical Memory | 53,36% Memory free 7,36 Gb Paging File | 4,98 Gb Available in Paging File | 67,66% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 93,13 Gb Total Space | 35,60 Gb Free Space | 38,23% Space Free | Partition Type: NTFS Computer Name: SAMY | User Name: expert | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\expert\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Users\expert\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) PRC - C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.) PRC - C:\Program Files (x86)\Launch Manager\LMworker.exe (Dritek System Inc.) PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) PRC - C:\Programme\Acer\Acer Updater\UpdaterService.exe (Acer Group) PRC - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated) PRC - C:\Program Files (x86)\Salfeld\Kisi\kisiset.exe (Salfeld Computer) PRC - C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer) PRC - C:\Windows\tray\wintmr.exe (Salfeld Computer) PRC - C:\Windows\SysWOW64\cchservice.exe (Salfeld Computer) ========== Modules (No Company Name) ========== MOD - C:\Users\expert\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll () MOD - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll () MOD - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\pdf.dll () MOD - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\libglesv2.dll () MOD - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\libegl.dll () MOD - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ef0a534be135cd8f0d99d938d8b1814a\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\4eef5a3a4d0ed6d6fd882947a70df530\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\29f3ae8d313e62b4daed1107ccd29f9f\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d473c19e69818875b9c739cad8f386a5\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\a65a89dc687715adf46de23e717b842b\IAStorUtil.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll () MOD - C:\Users\expert\AppData\Roaming\Dropbox\bin\libcef.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Xml.resources\2.0.0.0_de_b77a5c561934e089\System.Xml.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Program Files (x86)\NVIDIA Corporation\coprocmanager\detoured.dll () MOD - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll () MOD - C:\Program Files (x86)\Launch Manager\CdDirIo.dll () ========== Services (SafeList) ========== SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) SRV - (DsiWMIService) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.) SRV - (ksupmgr) -- C:\Windows\SysWOW64\ksupmgr.exe (Salfeld Computer) SRV - (NTI IScheduleSvc) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.) SRV - (ePowerSvc) -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (Updater Service) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe (Acer Group) SRV - (GREGService) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG) DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (UBHelper) -- C:\Windows\SysNative\drivers\UBHelper.sys (NTI Corporation) DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation) DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation) DRV:64bit: - (NTIDrvr) -- C:\Windows\SysNative\drivers\NTIDrvr.sys (NTI Corporation) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronic Corp.) DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation) DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (xnacc) -- C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (SjtWinIo) -- C:\Windows\SysNative\drivers\SjtWinIo.sys (SpeedJet Technology INC.) DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848&CUI=UN35669912241827910&SSPV=TB_IESB25 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://acer.msn.com [binary data] IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3317892&octid=CT3317892&SearchSource=61&CUI=UN23155415872122811&UM=2&UP=SP4EE6B1E6-1F24-4C64-BFD1-A540C1533745 IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\..\URLSearchHook: {422f7661-9403-4da4-b4ef-cc3e268817b5} - No CLSID value found IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search?q={searchTerms} IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://acer.msn.com [binary data] IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&CUI=UN23155415872122811&UM=2&ctid=CT3317892 IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search?q={searchTerms} IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus IE - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..CT2625848.browser.search.defaultthis.engineName: true FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledAddons: EFGLQA%4078ETGYN-0W7FN789T87.COM:1.01 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\expert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\expert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [2013.01.12 13:05:25 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.12.13 08:08:38 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.12.13 08:08:38 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.04.29 14:25:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\expert\AppData\Roaming\mozilla\Extensions [2011.04.29 14:25:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\expert\AppData\Roaming\mozilla\Extensions\home2@tomtom.com [2013.12.26 15:48:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\expert\AppData\Roaming\mozilla\Firefox\Profiles\7o5nj0mn.default\extensions [2013.12.13 07:46:34 | 000,000,000 | ---D | M] (DVDVideoSoftTB DE) -- C:\Users\expert\AppData\Roaming\mozilla\Firefox\Profiles\7o5nj0mn.default\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} [2013.12.10 01:22:40 | 000,000,000 | ---D | M] (RadioTotal1) -- C:\Users\expert\AppData\Roaming\mozilla\Firefox\Profiles\7o5nj0mn.default\extensions\{422f7661-9403-4da4-b4ef-cc3e268817b5} [2013.11.19 13:23:53 | 000,000,000 | ---D | M] (vis) -- C:\Users\expert\AppData\Roaming\mozilla\Firefox\Profiles\7o5nj0mn.default\extensions\EFGLQA@78ETGYN-0W7FN789T87.COM [2013.04.17 14:50:46 | 000,201,930 | ---- | M] () (No name found) -- C:\Users\expert\AppData\Roaming\mozilla\firefox\profiles\7o5nj0mn.default\extensions\hdvc@hdvc.com.xpi [2013.10.14 20:03:55 | 000,915,554 | ---- | M] () (No name found) -- C:\Users\expert\AppData\Roaming\mozilla\firefox\profiles\7o5nj0mn.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.11.16 15:37:35 | 000,000,999 | ---- | M] () -- C:\Users\expert\AppData\Roaming\mozilla\firefox\profiles\7o5nj0mn.default\searchplugins\conduit.xml [2013.12.13 08:08:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions [2013.12.13 08:08:46 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}, CHR - homepage: hxxp://search.conduit.com/?ctid=CT3317892&SearchSource=48&CUI=UN19313457502096918&UM=2 CHR - plugin: Shockwave Flash (Enabled) = C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\gcswf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\pdf.dll CHR - plugin: Chrome NaCl (Enabled) = C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\gears.dll CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.131.2_0\McChPlg.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Windows Live? Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Google Update (Enabled) = C:\Users\expert\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Google Wallet = C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\ O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\..\Toolbar\WebBrowser: (no name) - {41564952-412D-5637-00A7-7A786E7484D7} - No CLSID value found. O3 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found. O3 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\..\Toolbar\WebBrowser: (no name) - {41564952-412D-5637-00A7-7A786E7484D7} - No CLSID value found. O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated) O4:64bit: - HKLM..\Run: [ETDWare] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe File not found O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) O4 - HKLM..\Run: [ChicoSys] C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer) O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe" File not found O4 - HKU\.DEFAULT..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer) O4 - HKU\S-1-5-18..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000..\Run: [ares] "C:\Program Files (x86)\Ares\Ares.exe" -h File not found O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000..\Run: [BackgroundContainer] "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\expert\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun File not found O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer) O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000..\Run: [SearchProtect] C:\Users\UpdatusUser\AppData\Roaming\SearchProtect\bin\cltmng.exe File not found O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000..\Run: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" File not found O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002..\Run: [ares] "C:\Program Files (x86)\Ares\Ares.exe" -h File not found O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer) O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002..\Run: [TBHostSupport] C:\Users\expert\AppData\Local\TBHostSupport\TBHostSupport.dll (Conduit Ltd.) O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002..\Run: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" File not found O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000..\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe () O4 - Startup: C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\expert\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0 O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0 O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0 O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0 O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00 [binary data] O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 1 O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0 O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0 O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0 O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00 [binary data] O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\expert\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8 - Extra context menu item: Free YouTube Download - C:\Users\expert\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-2975014363-2867879005-296608908-1000\..Trusted Domains: samsungsetup.com ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2975014363-2867879005-296608908-1002\..Trusted Domains: samsungsetup.com ([www] http in Trusted sites) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{642E1165-4006-45F7-9F91-80091D8243E9}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{56a17cdd-4cef-11e1-946b-18f46a89c2c4}\Shell - "" = AutoRun O33 - MountPoints2\{56a17cdd-4cef-11e1-946b-18f46a89c2c4}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{56a17d02-4cef-11e1-946b-18f46a89c2c4}\Shell - "" = AutoRun O33 - MountPoints2\{56a17d02-4cef-11e1-946b-18f46a89c2c4}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{5ca9815b-0f0f-11e1-9761-1c75083ca7c1}\Shell - "" = AutoRun O33 - MountPoints2\{5ca9815b-0f0f-11e1-9761-1c75083ca7c1}\Shell\AutoRun\command - "" = F:\seite1.exe O33 - MountPoints2\{7571851a-53d9-11e1-bfed-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{7571851a-53d9-11e1-bfed-806e6f6e6963}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{7a991875-4f7d-11e2-93d8-18f46a89c2c4}\Shell - "" = AutoRun O33 - MountPoints2\{7a991875-4f7d-11e2-93d8-18f46a89c2c4}\Shell\AutoRun\command - "" = E:\Windows\Install.exe O33 - MountPoints2\{7a99188c-4f7d-11e2-93d8-18f46a89c2c4}\Shell - "" = AutoRun O33 - MountPoints2\{7a99188c-4f7d-11e2-93d8-18f46a89c2c4}\Shell\AutoRun\command - "" = E:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2014.01.10 10:27:21 | 000,000,000 | ---D | C] -- C:\FRST [2013.12.25 16:46:26 | 000,000,000 | ---D | C] -- C:\Users\expert\AppData\Local\SmartFTP [2013.12.25 14:43:52 | 000,000,000 | ---D | C] -- C:\Users\expert\AppData\Roaming\SmartFTP [2013.12.25 14:43:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartFTP Client [2013.12.25 14:43:39 | 000,000,000 | ---D | C] -- C:\Program Files\SmartFTP Client [2013.12.25 14:42:57 | 000,000,000 | ---D | C] -- C:\Users\expert\AppData\Local\SmartFTP Client 5.0 Setup [2013.12.21 16:04:04 | 000,000,000 | ---D | C] -- C:\Users\expert\AppData\Local\WhiteListing [2013.12.21 16:04:04 | 000,000,000 | ---D | C] -- C:\Users\expert\AppData\Local\TBHostSupport [2013.12.16 19:20:35 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll [2013.12.16 19:20:34 | 000,574,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.12.16 19:20:34 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.12.16 19:20:34 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013.12.16 19:20:34 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2013.12.16 19:20:34 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013.12.16 19:20:33 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll [2013.12.16 19:20:33 | 000,708,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll [2013.12.16 19:20:33 | 000,553,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll [2013.12.16 19:20:33 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe [2013.12.16 19:20:33 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013.12.16 19:20:33 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll [2013.12.16 19:20:32 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll [2013.12.16 19:20:31 | 001,995,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2013.12.16 19:20:31 | 001,928,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2013.12.16 19:20:29 | 005,769,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.12.14 12:46:20 | 000,028,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEUDINIT.EXE [2013.12.14 12:42:27 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe [2013.12.14 12:42:27 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll [2013.12.14 12:42:20 | 000,645,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jsIntl.dll [2013.12.14 12:42:20 | 000,235,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll [2013.12.14 12:42:20 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.12.14 12:42:19 | 001,051,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll [2013.12.14 12:42:19 | 000,616,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat [2013.12.14 12:42:19 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec [2013.12.14 12:42:19 | 000,233,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2013.12.14 12:42:19 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll [2013.12.14 12:42:19 | 000,151,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe [2013.12.14 12:42:19 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe [2013.12.14 12:42:19 | 000,083,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll [2013.12.14 12:42:19 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2013.12.14 12:42:19 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll [2013.12.14 12:42:19 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx [2013.12.14 12:42:19 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.12.14 12:42:19 | 000,034,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll [2013.12.14 12:42:19 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.12.14 12:42:19 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll [2013.12.14 12:42:18 | 000,610,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.12.14 12:42:18 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll [2013.12.14 12:42:18 | 000,116,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2013.12.14 12:42:18 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2013.12.14 12:42:18 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll [2013.12.14 12:42:18 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll [2013.12.14 12:42:18 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll [2013.12.14 12:42:18 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll [2013.12.14 12:42:18 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2013.12.14 12:42:17 | 000,942,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jsIntl.dll [2013.12.14 12:42:17 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll [2013.12.14 12:42:17 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013.12.14 12:42:17 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.12.14 12:42:17 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe [2013.12.14 12:42:17 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll [2013.12.14 12:42:16 | 000,616,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat [2013.12.14 12:42:16 | 000,453,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll [2013.12.14 12:42:16 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec [2013.12.14 12:42:16 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll [2013.12.14 12:42:16 | 000,235,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2013.12.14 12:42:16 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll [2013.12.14 12:42:16 | 000,131,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll [2013.12.14 12:42:16 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.12.14 12:42:16 | 000,090,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe [2013.12.14 12:42:16 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll [2013.12.14 12:42:16 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx [2013.12.14 12:42:16 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll [2013.12.14 12:42:16 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll [2013.12.14 12:42:16 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2013.12.14 12:42:15 | 001,228,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll [2013.12.14 12:42:15 | 000,774,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.12.14 12:42:15 | 000,626,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.12.14 12:42:15 | 000,548,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2013.12.14 12:42:15 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe [2013.12.14 12:42:15 | 000,147,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll [2013.12.14 12:42:15 | 000,143,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe [2013.12.14 12:42:15 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2013.12.14 12:42:15 | 000,101,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll [2013.12.14 12:42:15 | 000,084,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2013.12.14 12:42:15 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll [2013.12.14 12:42:15 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll [2013.12.14 12:42:15 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll [2013.12.14 12:42:15 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll [2013.12.14 12:42:15 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe [2013.12.13 08:08:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.12.13 07:41:34 | 012,625,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmploc.DLL [2013.12.13 07:41:33 | 012,625,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL [2013.12.13 07:41:33 | 011,410,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll [2013.12.13 07:41:32 | 014,631,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmp.dll [2013.12.12 14:20:05 | 000,335,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msieftp.dll [2013.12.12 14:20:05 | 000,301,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msieftp.dll [2013.12.12 14:14:50 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll [2013.12.12 14:14:50 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll [2013.12.12 14:14:17 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll [2013.12.12 14:14:06 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\portcls.sys [2013.12.12 14:14:06 | 000,116,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\drmk.sys [2013.12.12 14:13:56 | 000,202,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\scrrun.dll [2013.12.12 14:13:56 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\scrrun.dll [2013.12.12 14:13:56 | 000,156,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cscript.exe [2013.12.12 14:13:56 | 000,150,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wshom.ocx [2013.12.12 14:13:56 | 000,126,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cscript.exe [2013.12.12 14:13:56 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wshom.ocx ========== Files - Modified Within 30 Days ========== [2014.01.10 10:33:36 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2014.01.10 10:33:36 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2014.01.10 10:32:53 | 000,003,151 | ---- | M] () -- C:\NET.INI [2014.01.10 10:32:37 | 000,000,121 | ---- | M] () -- C:\Windows\SysWow64\SWCTL.DLL [2014.01.10 10:25:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2014.01.10 10:25:31 | 2962,255,872 | -HS- | M] () -- C:\hiberfil.sys [2014.01.10 09:58:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2014.01.10 09:24:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2975014363-2867879005-296608908-1002UA.job [2014.01.02 12:47:32 | 000,011,270 | ---- | M] () -- C:\Windows\SysWow64\cchservice.err [2014.01.01 20:02:12 | 000,159,740 | ---- | M] () -- C:\Users\expert\Desktop\norwegen-lofoten-flakstad-strand.jpg [2014.01.01 19:58:11 | 000,058,979 | ---- | M] () -- C:\Users\expert\Desktop\norwegen-lofoten-luftaufnahme.jpg [2013.12.31 09:22:16 | 000,037,653 | ---- | M] () -- C:\Users\expert\Desktop\18-Andere-Partnerprogramme.pdf [2013.12.25 14:43:41 | 000,002,659 | ---- | M] () -- C:\Users\Public\Desktop\SmartFTP Client.lnk [2013.12.25 14:39:48 | 000,001,718 | ---- | M] () -- C:\Users\expert\Desktop\ftp-uploader.lnk [2013.12.19 08:41:58 | 000,131,576 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys [2013.12.19 08:41:58 | 000,108,440 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys [2013.12.19 08:41:58 | 000,084,720 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avnetflt.sys [2013.12.19 08:37:55 | 000,000,542 | ---- | M] () -- C:\Windows\wininit.ini [2013.12.19 08:37:46 | 000,001,050 | ---- | M] () -- C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2013.12.19 08:37:38 | 000,001,020 | ---- | M] () -- C:\Users\expert\Desktop\Dropbox.lnk [2013.12.14 12:42:27 | 000,940,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe [2013.12.14 12:42:27 | 000,194,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll [2013.12.14 12:42:20 | 000,645,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jsIntl.dll [2013.12.14 12:42:20 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll [2013.12.14 12:42:20 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.12.14 12:42:19 | 001,051,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll [2013.12.14 12:42:19 | 000,616,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat [2013.12.14 12:42:19 | 000,337,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec [2013.12.14 12:42:19 | 000,233,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2013.12.14 12:42:19 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll [2013.12.14 12:42:19 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe [2013.12.14 12:42:19 | 000,139,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe [2013.12.14 12:42:19 | 000,083,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll [2013.12.14 12:42:19 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2013.12.14 12:42:19 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll [2013.12.14 12:42:19 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx [2013.12.14 12:42:19 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.12.14 12:42:19 | 000,034,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll [2013.12.14 12:42:19 | 000,032,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.12.14 12:42:19 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll [2013.12.14 12:42:19 | 000,016,284 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf [2013.12.14 12:42:18 | 000,610,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.12.14 12:42:18 | 000,127,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll [2013.12.14 12:42:18 | 000,116,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2013.12.14 12:42:18 | 000,112,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2013.12.14 12:42:18 | 000,111,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll [2013.12.14 12:42:18 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll [2013.12.14 12:42:18 | 000,056,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll [2013.12.14 12:42:18 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll [2013.12.14 12:42:18 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2013.12.14 12:42:17 | 000,942,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jsIntl.dll [2013.12.14 12:42:17 | 000,247,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll [2013.12.14 12:42:17 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013.12.14 12:42:17 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.12.14 12:42:17 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe [2013.12.14 12:42:17 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll [2013.12.14 12:42:16 | 000,616,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat [2013.12.14 12:42:16 | 000,453,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll [2013.12.14 12:42:16 | 000,413,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec [2013.12.14 12:42:16 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll [2013.12.14 12:42:16 | 000,235,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2013.12.14 12:42:16 | 000,195,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll [2013.12.14 12:42:16 | 000,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll [2013.12.14 12:42:16 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.12.14 12:42:16 | 000,090,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe [2013.12.14 12:42:16 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll [2013.12.14 12:42:16 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx [2013.12.14 12:42:16 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll [2013.12.14 12:42:16 | 000,040,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll [2013.12.14 12:42:16 | 000,016,284 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf [2013.12.14 12:42:16 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2013.12.14 12:42:15 | 001,228,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll [2013.12.14 12:42:15 | 000,774,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.12.14 12:42:15 | 000,626,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.12.14 12:42:15 | 000,548,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2013.12.14 12:42:15 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe [2013.12.14 12:42:15 | 000,147,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll [2013.12.14 12:42:15 | 000,143,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe [2013.12.14 12:42:15 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2013.12.14 12:42:15 | 000,101,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll [2013.12.14 12:42:15 | 000,084,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2013.12.14 12:42:15 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll [2013.12.14 12:42:15 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll [2013.12.14 12:42:15 | 000,048,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll [2013.12.14 12:42:15 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll [2013.12.14 12:42:15 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe [2013.12.13 09:54:37 | 000,344,120 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.12.13 07:59:59 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.12.13 07:59:59 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl ========== Files Created - No Company Name ========== [2014.01.01 20:02:11 | 000,159,740 | ---- | C] () -- C:\Users\expert\Desktop\norwegen-lofoten-flakstad-strand.jpg [2014.01.01 19:58:10 | 000,058,979 | ---- | C] () -- C:\Users\expert\Desktop\norwegen-lofoten-luftaufnahme.jpg [2013.12.31 09:22:19 | 000,037,653 | ---- | C] () -- C:\Users\expert\Desktop\18-Andere-Partnerprogramme.pdf [2013.12.25 14:43:41 | 000,002,659 | ---- | C] () -- C:\Users\Public\Desktop\SmartFTP Client.lnk [2013.12.14 12:42:19 | 000,016,284 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf [2013.12.14 12:42:16 | 000,016,284 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf [2013.12.06 14:38:30 | 000,000,542 | ---- | C] () -- C:\Windows\wininit.ini [2012.06.24 16:20:37 | 000,001,329 | ---- | C] () -- C:\Windows\cdplayer.ini [2010.08.30 10:12:22 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.07.26 03:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.07.26 02:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2011.06.11 10:44:14 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\2K Sports [2012.07.21 12:39:03 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\Canneverbe Limited [2011.11.15 03:25:37 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\DAEMON Tools Lite [2014.01.10 10:26:09 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\Dropbox [2013.01.12 13:05:39 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\DVDVideoSoft [2013.01.12 13:05:31 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\DVDVideoSoftIEHelpers [2011.06.01 05:14:07 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\Leadertech [2013.03.20 13:52:21 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\LibreOffice [2013.02.06 15:49:31 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\MusicNet [2013.02.06 16:21:11 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\Shareaza [2013.04.12 13:31:02 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\Systemberatung Schommer [2011.04.29 14:25:20 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\TomTom [2013.11.16 16:40:26 | 000,000,000 | ---D | M] -- C:\Users\expert\AppData\Roaming\Windows Net Data ========== Purity Check ========== ========== Files - Unicode (All) ========== [2013.11.20 15:54:06 | 105,397,131 | ---- | M] ()(C:\Windows\SysWow64\???]) -- C:\Windows\SysWow64\깆쭩] [2013.11.20 09:55:28 | 105,397,131 | ---- | C] ()(C:\Windows\SysWow64\???]) -- C:\Windows\SysWow64\깆쭩] [2013.11.16 15:11:55 | 104,637,397 | ---- | M] ()(C:\Windows\SysWow64\???^) -- C:\Windows\SysWow64\鷿贜^ [2013.11.16 15:11:55 | 104,637,397 | ---- | C] ()(C:\Windows\SysWow64\???^) -- C:\Windows\SysWow64\鷿贜^ [2013.11.02 11:23:00 | 104,620,600 | ---- | M] ()(C:\Windows\SysWow64\???F) -- C:\Windows\SysWow64\䪄䚘F [2013.11.02 11:23:00 | 104,620,600 | ---- | C] ()(C:\Windows\SysWow64\???F) -- C:\Windows\SysWow64\䪄䚘F [2013.10.17 13:31:08 | 101,544,623 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\醎Ÿ [2013.10.17 13:31:08 | 101,544,623 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\醎Ÿ ========== Alternate Data Streams ========== @Alternate Data Stream - 16 bytes -> C:\Users\expert\Downloads:Shareaza.GUID @Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:CDFF58FE < End of report > Code:
ATTFilter OTL Extras logfile created on: 10.01.2014 10:46:59 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\expert\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,68 Gb Total Physical Memory | 1,96 Gb Available Physical Memory | 53,36% Memory free
7,36 Gb Paging File | 4,98 Gb Available in Paging File | 67,66% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 93,13 Gb Total Space | 35,60 Gb Free Space | 38,23% Space Free | Partition Type: NTFS
Computer Name: SAMY | User Name: expert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03771912-1CC2-410C-9CD8-9DFB85C512CF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{1FF1D2C4-7988-426A-80A3-9CEF399121EF}" = lport=138 | protocol=17 | dir=in | app=system |
"{2B4183A2-7110-4EA7-920C-EC13C9BCAB93}" = lport=43239 | protocol=6 | dir=in | name=emule |
"{2C2C44BE-5656-4512-B543-11EF1EBB7A80}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{383D2C2E-5106-4BED-92D0-9F900323D3CF}" = lport=137 | protocol=17 | dir=in | app=system |
"{4A3EF2DF-0BD5-48E0-B954-C5D6FB4552EF}" = rport=445 | protocol=6 | dir=out | app=system |
"{6F3A8E4B-F899-47B5-89BA-6BB25CEADC1A}" = lport=37822 | protocol=17 | dir=in | name=emule |
"{6FD6EA82-30F9-4FB0-B888-20B7B3D2DD29}" = rport=139 | protocol=6 | dir=out | app=system |
"{74F1FCC3-E05C-42C4-A678-20F385E20289}" = rport=137 | protocol=17 | dir=out | app=system |
"{8410B360-3212-41AE-8D5E-71B4209EFBBD}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{9B969EF6-910F-485D-A124-60E1B3E0E92F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{A40608E6-2091-414D-A2CC-5EBC6650235E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A8350C79-EFFD-4674-93F6-ADE1391E79BF}" = lport=445 | protocol=6 | dir=in | app=system |
"{AD180F2A-0FAD-4585-9C21-E7B4EE2D675D}" = rport=138 | protocol=17 | dir=out | app=system |
"{B505DAA5-A634-4B60-85F8-5769BE4DD859}" = rport=10243 | protocol=6 | dir=out | app=system |
"{BD95AA40-63C1-4A92-B686-5601ADABA709}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C0950134-022A-4FA5-87BA-324B7211C6A8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C77D48DB-C1D6-40AA-830F-F469CDEFB02F}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CEA32E71-EF13-49A3-AC9E-5FF4CFFB4B72}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CF1DE2B8-D128-4819-946C-665B3501E240}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D541313E-27AD-436A-A533-71BAC2D996AB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D782754B-6E2E-4064-BFBC-CEFB8320BCDC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DC83431C-78C6-4F97-A287-85FAE15574C2}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DFD0C302-4DFC-4D16-A3C7-BB580C888F93}" = rport=43239 | protocol=6 | dir=out | name=emule |
"{E0C84206-A545-4760-9117-6F22A9BCF315}" = lport=10243 | protocol=6 | dir=in | app=system |
"{E78BEC1E-253F-4936-9F8E-0664532F46BB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{E7F7CE37-236C-4F8D-B13B-7FFC101A45DC}" = lport=139 | protocol=6 | dir=in | app=system |
"{F6380657-B8B7-44FD-B242-A35F660E9D51}" = rport=37822 | protocol=17 | dir=out | name=emule |
"{FC6BFFE1-720F-40C2-9284-36F9F1CB6C07}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0151B7CE-6342-4880-B69A-CE7DD0304190}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd9\powerdvd9.exe |
"{13B0C232-B400-4B95-91A7-E0304EB38F89}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{186FF053-A8CB-42EF-9FF0-99CB6D29E752}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{1B78BFFD-1B46-4330-834A-95C6D5F27AEB}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{218B797B-F024-4A7B-B1C6-5595F7C63FA8}" = protocol=6 | dir=in | app=c:\program files\ftp-uploader\ftpuploader.exe |
"{25825579-C689-426B-831E-B04F7210B8FC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2A7EE9B6-7840-4E8A-AFD0-7A713298642C}" = protocol=6 | dir=in | app=c:\program files (x86)\frostwire 5\frostwire.exe |
"{2EFD25E6-33AD-4A18-B102-98527F922544}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3670AFAF-FF81-49C1-B4C5-4C3CD2E03577}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4F7D8D7A-C2DD-4D8E-B174-6AC41927A07E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{597F4138-181B-4339-B6A1-5232E45D6193}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{6389F2F7-D817-4915-95C4-7BDCA6355A9F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{71444733-72EC-4DCE-B1B4-7071234CE25D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{73575484-E6D3-44C5-B05F-DF67AE668BC3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7AA03DE5-B287-47C4-B767-FAE6E120FB67}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{8B50C9FD-A2BC-4AF4-B323-F53EC09EB0E1}" = protocol=17 | dir=in | app=c:\program files (x86)\bearshare applications\bearshare\bearshare.exe |
"{8E014478-B922-48D2-98F0-1E485FA27152}" = protocol=6 | dir=out | app=system |
"{93D61768-D115-4A8E-8167-D397F4EA9159}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{958F3FB0-E07A-4B83-B165-A556DEC09DFB}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{A177A982-990A-4EDC-9C5D-2E23E16FA9BE}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A1B5DC39-EA62-4A05-8067-17F94C07CEB6}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{A66C75F8-FC2C-44C6-91E3-522D8E5D950A}" = protocol=17 | dir=in | app=c:\program files (x86)\frostwire 5\frostwire.exe |
"{A873D360-E7F7-4DF9-8359-C4AD54846FEB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AE67C587-A79F-45D8-9795-6C4E557C8D5D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B37E00BF-C2DF-4264-9D8F-4DCA0DB7153D}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B7309CEF-F6EA-4A41-B9BB-BF0F6C2FE96B}" = protocol=17 | dir=in | app=c:\program files (x86)\2k sports\nba 2k11\nba2k11.exe |
"{BA6D1562-EAAC-48BA-95A0-B93087C41B9E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{C13D38CB-4109-46B6-AE7F-F205CDDEDDD4}" = protocol=17 | dir=in | app=c:\program files (x86)\nvidia corporation\nvidia updatus\daemonu.exe |
"{C209C004-8363-47EA-87C7-F9E3012DF16C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C2BB0178-FC0C-411F-A885-379C823FF2A3}" = dir=in | app=c:\program files\smartftp client\smartftp.exe |
"{C6BA3A4C-C4A1-469D-8017-E4FA2D15E449}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D3E3704B-73AA-48AC-BFBC-82770ADE973F}" = protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\nvidia updatus\daemonu.exe |
"{DA57AA84-01BA-4234-986F-07BF1971857C}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{DDC1E822-674E-4560-A739-382EE662CA3A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EE7B4833-A9B7-420C-BDDA-1EF271962CC1}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F49CB5AA-E2AA-4A34-944E-B35CFF989978}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{F8B35293-DBEA-4449-99C1-245806D499EF}" = protocol=17 | dir=in | app=c:\program files\ftp-uploader\ftpuploader.exe |
"{F9A446DB-7A71-4859-864B-8CEF6D4066D3}" = protocol=6 | dir=in | app=c:\program files (x86)\2k sports\nba 2k11\nba2k11.exe |
"{FDEDE902-0E0F-409C-BF2C-2EAAEA6B1D3D}" = protocol=6 | dir=in | app=c:\program files (x86)\bearshare applications\bearshare\bearshare.exe |
"TCP Query User{04E67D8F-0DC4-4277-A4B9-F7CD9954A2AC}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe |
"TCP Query User{0D61148B-B3B3-4100-A5E6-23EA71FC3D89}C:\users\expert\desktop\timetoplay\warhammer\w40k.exe" = protocol=6 | dir=in | app=c:\users\expert\desktop\timetoplay\warhammer\w40k.exe |
"TCP Query User{392A42C1-2B73-4969-A28B-6A7E0714956B}C:\program files (x86)\bearshare applications\bearshare\bearshare.exe" = protocol=6 | dir=in | app=c:\program files (x86)\bearshare applications\bearshare\bearshare.exe |
"TCP Query User{5AEA6AFB-A31F-4B2B-B9D3-8FA1733DF67F}C:\program files (x86)\firefly studios\stronghold crusader\stronghold_crusader_extreme.exe" = protocol=6 | dir=in | app=c:\program files (x86)\firefly studios\stronghold crusader\stronghold_crusader_extreme.exe |
"TCP Query User{6A1D8D35-DBF2-485A-ABC3-51E15E025E38}C:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe |
"TCP Query User{81A96245-6937-4020-BE7B-B3ABA7416967}C:\users\expert\desktop\starcraft an matt_fest (matt_fest) an peter_schranz (balder7-3)\starcraft.exe" = protocol=6 | dir=in | app=c:\users\expert\desktop\starcraft an matt_fest (matt_fest) an peter_schranz (balder7-3)\starcraft.exe |
"TCP Query User{89F0755C-11CF-4C3B-9CA5-C1D8D6345716}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"TCP Query User{8FDA7598-BF0A-4154-92AA-7FE62C86A34E}C:\program files (x86)\arena wars reloaded\arenawarsreloadedfull.exe" = protocol=6 | dir=in | app=c:\program files (x86)\arena wars reloaded\arenawarsreloadedfull.exe |
"TCP Query User{98E9D35A-827C-417D-9808-CCCC3F01F5C3}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe |
"TCP Query User{9A694484-C54B-4BFA-93DD-0DC4B4AFE4E8}C:\program files (x86)\2k sports\nba 2k11\nba2k11.exe" = protocol=6 | dir=in | app=c:\program files (x86)\2k sports\nba 2k11\nba2k11.exe |
"TCP Query User{A8633D8F-AED8-4DD8-9968-4C04581F7155}C:\program files (x86)\microsoft games\age of mythology\aom.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\age of mythology\aom.exe |
"TCP Query User{ABFC1DB4-11D6-4DDF-B5B0-F7C399D89129}C:\program files (x86)\microsoft games\age of empires ii\empires2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\age of empires ii\empires2.exe |
"TCP Query User{AE08EAF3-E2CF-4384-BF05-1E241FEACFEB}C:\program files (x86)\ares\ares.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ares\ares.exe |
"TCP Query User{F85F7370-1FFC-419F-9BCC-E503D77CC3D7}C:\windows\syswow64\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\dplaysvr.exe |
"TCP Query User{FA740FE3-99E6-463B-A3B3-199B57DC4EFF}C:\program files (x86)\warzone 2100-2.3.9\warzone2100.exe" = protocol=6 | dir=in | app=c:\program files (x86)\warzone 2100-2.3.9\warzone2100.exe |
"TCP Query User{FC4F149D-A6DE-4994-8B1E-E7CC367E3DF2}C:\program files (x86)\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files (x86)\emule\emule.exe |
"UDP Query User{08602B2A-CC72-43EA-B866-967418935669}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{25947023-D468-4CB6-86CE-A6BBBCF4E42D}C:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe |
"UDP Query User{261B6A7B-F1ED-494C-83E7-6AE683149A09}C:\windows\syswow64\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\dplaysvr.exe |
"UDP Query User{2ED614DE-82AD-45A7-963B-ADED9B7C472E}C:\program files (x86)\bearshare applications\bearshare\bearshare.exe" = protocol=17 | dir=in | app=c:\program files (x86)\bearshare applications\bearshare\bearshare.exe |
"UDP Query User{36B495E3-1BEB-4C07-B07E-8E29CD71ACEF}C:\program files (x86)\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files (x86)\emule\emule.exe |
"UDP Query User{378DFBEB-6089-47B2-90CA-ED3A1BAF90BE}C:\program files (x86)\microsoft games\age of mythology\aom.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\age of mythology\aom.exe |
"UDP Query User{47E54449-E87A-41B4-8EF7-CCA776939D6D}C:\program files (x86)\microsoft games\age of empires ii\empires2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\age of empires ii\empires2.exe |
"UDP Query User{5A6DBC50-C39A-4E3C-BF31-A38DA3547C12}C:\users\expert\desktop\timetoplay\warhammer\w40k.exe" = protocol=17 | dir=in | app=c:\users\expert\desktop\timetoplay\warhammer\w40k.exe |
"UDP Query User{5E8497BE-E3BD-4809-8463-3CA4D3623648}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe |
"UDP Query User{684C0018-CF29-4FFE-AEB5-0D3CFF668A81}C:\program files (x86)\ares\ares.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ares\ares.exe |
"UDP Query User{6E3ADDDC-7716-49A0-89E6-8DB2B2F33FAE}C:\program files (x86)\warzone 2100-2.3.9\warzone2100.exe" = protocol=17 | dir=in | app=c:\program files (x86)\warzone 2100-2.3.9\warzone2100.exe |
"UDP Query User{9819814F-E971-4BE9-967E-A4DC072E6713}C:\program files (x86)\firefly studios\stronghold crusader\stronghold_crusader_extreme.exe" = protocol=17 | dir=in | app=c:\program files (x86)\firefly studios\stronghold crusader\stronghold_crusader_extreme.exe |
"UDP Query User{9C0CB751-3DD1-4764-9FF2-A30C4F4F406F}C:\program files (x86)\arena wars reloaded\arenawarsreloadedfull.exe" = protocol=17 | dir=in | app=c:\program files (x86)\arena wars reloaded\arenawarsreloadedfull.exe |
"UDP Query User{A230A075-60F5-4567-AE1A-E434AA2F1CB3}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe |
"UDP Query User{AFCB2401-B15E-4B99-845C-BF10AD544575}C:\program files (x86)\2k sports\nba 2k11\nba2k11.exe" = protocol=17 | dir=in | app=c:\program files (x86)\2k sports\nba 2k11\nba2k11.exe |
"UDP Query User{DFEF5E60-B486-429C-8C13-8F4793351405}C:\users\expert\desktop\starcraft an matt_fest (matt_fest) an peter_schranz (balder7-3)\starcraft.exe" = protocol=17 | dir=in | app=c:\users\expert\desktop\starcraft an matt_fest (matt_fest) an peter_schranz (balder7-3)\starcraft.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{376E133F-EC4B-4C5F-A83B-F932E49FFDBA}" = SmartFTP Client
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Elantech" = ETDWare PS/2-x64 7.0.6.5_WHQL
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{11202615-E557-4ECF-9B86-F59C81E52909}" = FIFA 10
"{118071AB-6572-4FAD-A1FD-67264C994350}" = e-Sword
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{4EFBD242-1EAB-43B2-95DE-579CD5C56893}" = SEMA Holzbausoftware V10.4 (de)
"{501451DE-5808-4599-B544-8BD0915B6B24}_is1" = FreeRIP 3.80
"{51F026FA-5146-4232-A8BA-1364740BD053}" = Acer Crystal Eye webcam
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{604B2A5C-B1CE-45B2-ADCC-6B7C721AC3AC}" = LibreOffice 4.0.1.2
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65A5E87D-7A3F-4819-807D-B86990D5F369}" = inSSIDer
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{81DD0597-29EB-4FA0-8223-4F41362B2E72}" = NBA 2K11
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11505173}" = Airport Mania First Flight
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"1ClickDownload" = HDVidCodec
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"Avira AntiVir Desktop" = Avira Free Antivirus
"DVD Shrink DE_is1" = DVD Shrink 3.2 deutsch (DeCSS-frei)
"Free YouTube Download_is1" = Free YouTube Download version 3.1.42.1212
"ftp-uploader" = ftp-uploader
"Identity Card" = Identity Card
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9
"Internet Movil Tigo" = Internet Movil Tigo
"Kindersicherung_is1" = Kindersicherung 2010
"LManager" = Launch Manager
"Mozilla Firefox 26.0 (x86 de)" = Mozilla Firefox 26.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA.Updatus" = NVIDIA Updatus
"WinLiveSuite_Wave3" = Windows Live Essentials
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2975014363-2867879005-296608908-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CT2625848" = DVDVideoSoftTB DE Toolbar
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2975014363-2867879005-296608908-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 06.12.2013 16:33:56 | Computer Name = SAMY | Source = Microsoft-Windows-LoadPerf | ID = 3002
Description = Der Textzeichenfolgenwert zur Beschreibung des Leistungsindikators
in der Registrierung ist falsch formatiert. Die falsch formatierte Zeichenfolge
ist "??". Das erste DWORD im Datenbereich enthält den Indexwert für die falsch
formatierte Zeichenfolge, während das zweite und dritte DWORD im Datenbereich die
letzten gültigen Indexwerte enthalten.
Error - 07.12.2013 10:27:19 | Computer Name = SAMY | Source = Microsoft-Windows-LoadPerf | ID = 3002
Description = Der Textzeichenfolgenwert zur Beschreibung des Leistungsindikators
in der Registrierung ist falsch formatiert. Die falsch formatierte Zeichenfolge
ist "??". Das erste DWORD im Datenbereich enthält den Indexwert für die falsch
formatierte Zeichenfolge, während das zweite und dritte DWORD im Datenbereich die
letzten gültigen Indexwerte enthalten.
Error - 13.12.2013 04:58:49 | Computer Name = SAMY | Source = Microsoft-Windows-LoadPerf | ID = 3002
Description = Der Textzeichenfolgenwert zur Beschreibung des Leistungsindikators
in der Registrierung ist falsch formatiert. Die falsch formatierte Zeichenfolge
ist "??". Das erste DWORD im Datenbereich enthält den Indexwert für die falsch
formatierte Zeichenfolge, während das zweite und dritte DWORD im Datenbereich die
letzten gültigen Indexwerte enthalten.
Error - 13.12.2013 08:39:06 | Computer Name = SAMY | Source = Microsoft-Windows-LoadPerf | ID = 3002
Description = Der Textzeichenfolgenwert zur Beschreibung des Leistungsindikators
in der Registrierung ist falsch formatiert. Die falsch formatierte Zeichenfolge
ist "??". Das erste DWORD im Datenbereich enthält den Indexwert für die falsch
formatierte Zeichenfolge, während das zweite und dritte DWORD im Datenbereich die
letzten gültigen Indexwerte enthalten.
Error - 21.12.2013 11:02:05 | Computer Name = SAMY | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428,
Zeitstempel: 0x525b664c Name des fehlerhaften Moduls: nvumdshim.dll, Version: 8.17.12.5997,
Zeitstempel: 0x4cc8db24 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000fd32 ID des fehlerhaften
Prozesses: 0x1618 Startzeit der fehlerhaften Anwendung: 0x01cefe5d5deeef32 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Pfad
des fehlerhaften Moduls: C:\Windows\system32\nvumdshim.dll Berichtskennung: da7bba20-6a50-11e3-a238-1c75083ca7c1
Error - 21.12.2013 11:02:18 | Computer Name = SAMY | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428,
Zeitstempel: 0x525b664c Name des fehlerhaften Moduls: nvumdshim.dll, Version: 8.17.12.5997,
Zeitstempel: 0x4cc8db24 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000fd32 ID des fehlerhaften
Prozesses: 0x14bc Startzeit der fehlerhaften Anwendung: 0x01cefe5da246d861 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Pfad
des fehlerhaften Moduls: C:\Windows\system32\nvumdshim.dll Berichtskennung: e2598648-6a50-11e3-a238-1c75083ca7c1
Error - 21.12.2013 11:03:13 | Computer Name = SAMY | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428,
Zeitstempel: 0x525b664c Name des fehlerhaften Moduls: nvumdshim.dll, Version: 8.17.12.5997,
Zeitstempel: 0x4cc8db24 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000fd32 ID des fehlerhaften
Prozesses: 0x1a18 Startzeit der fehlerhaften Anwendung: 0x01cefe5dc175938d Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Pfad
des fehlerhaften Moduls: C:\Windows\system32\nvumdshim.dll Berichtskennung: 02cb461d-6a51-11e3-a238-1c75083ca7c1
Error - 21.12.2013 11:03:22 | Computer Name = SAMY | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428,
Zeitstempel: 0x525b664c Name des fehlerhaften Moduls: nvumdshim.dll, Version: 8.17.12.5997,
Zeitstempel: 0x4cc8db24 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000fd32 ID des fehlerhaften
Prozesses: 0x83c Startzeit der fehlerhaften Anwendung: 0x01cefe5dc807ccad Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Pfad
des fehlerhaften Moduls: C:\Windows\system32\nvumdshim.dll Berichtskennung: 08921675-6a51-11e3-a238-1c75083ca7c1
Error - 21.12.2013 11:22:33 | Computer Name = SAMY | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Toolbar.exe, Version: 21.5.0.2560,
Zeitstempel: 0x524f145e Name des fehlerhaften Moduls: so.dll_unloaded, Version:
0.0.0.0, Zeitstempel: 0x524f1452 Ausnahmecode: 0xc0000005 Fehleroffset: 0x62798870
ID
des fehlerhaften Prozesses: 0x1328 Startzeit der fehlerhaften Anwendung: 0x01cefe5d62bb3540
Pfad
der fehlerhaften Anwendung: C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Toolbar.exe
Pfad
des fehlerhaften Moduls: so.dll Berichtskennung: b62d1d5a-6a53-11e3-a238-1c75083ca7c1
Error - 21.12.2013 13:54:32 | Computer Name = SAMY | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428,
Zeitstempel: 0x525b664c Name des fehlerhaften Moduls: ldrtbDVDV.dll_unloaded, Version:
0.0.0.0, Zeitstempel: 0x50eaf94f Ausnahmecode: 0xc0000005 Fehleroffset: 0x68f76de0
ID
des fehlerhaften Prozesses: 0xf7c Startzeit der fehlerhaften Anwendung: 0x01cefe75afbf8e6b
Pfad
der fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Pfad
des fehlerhaften Moduls: ldrtbDVDV.dll Berichtskennung: f1cb74c8-6a68-11e3-a238-1c75083ca7c1
[ System Events ]
Error - 13.07.2013 12:15:45 | Computer Name = SAMY | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte
Systeme (KB2667402)
Error - 14.07.2013 03:01:43 | Computer Name = SAMY | Source = Service Control Manager | ID = 7000
Description = Der Dienst "hardlock" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 14.07.2013 03:04:30 | Computer Name = SAMY | Source = DCOM | ID = 10010
Description =
Error - 14.07.2013 03:10:23 | Computer Name = SAMY | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte
Systeme (KB2667402)
Error - 14.07.2013 06:55:42 | Computer Name = SAMY | Source = Service Control Manager | ID = 7000
Description = Der Dienst "hardlock" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 14.07.2013 14:44:55 | Computer Name = SAMY | Source = Service Control Manager | ID = 7000
Description = Der Dienst "hardlock" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 14.07.2013 14:47:56 | Computer Name = SAMY | Source = DCOM | ID = 10010
Description =
Error - 14.07.2013 16:58:54 | Computer Name = SAMY | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte
Systeme (KB2667402)
Error - 27.07.2013 04:46:36 | Computer Name = SAMY | Source = Service Control Manager | ID = 7000
Description = Der Dienst "hardlock" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 27.07.2013 06:27:20 | Computer Name = SAMY | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte
Systeme (KB2667402)
< End of report >
Hilft das weiter? |
|
10.01.2014, 16:00
| #5 |
| | Ich kann keine dateien herrunterladen. Ok Operation Erfolgreich mit AdwCleaner: Code:
ATTFilter # AdwCleaner v3.016 - Bericht erstellt am 10/01/2014 um 11:48:19
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : expert - SAMY
# Gestartet von : C:\Users\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\Conduit
Ordner Gelöscht : C:\ProgramData\FreeRIP
Ordner Gelöscht : C:\Program Files (x86)\FreeRIP
Ordner Gelöscht : C:\Program Files (x86)\HDvidCodec.com
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\expert\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\expert\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\expert\AppData\Local\NativeMessaging
Ordner Gelöscht : C:\Users\expert\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\expert\AppData\Local\Searchprotect
Ordner Gelöscht : C:\Users\expert\AppData\Local\TBHostSupport
Ordner Gelöscht : C:\Users\expert\AppData\Local\WhiteListing
Ordner Gelöscht : C:\Users\expert\AppData\Local\Temp\Iminent
Ordner Gelöscht : C:\Users\expert\AppData\Local\Temp\NativeMessaging
Ordner Gelöscht : C:\Users\expert\AppData\Local\Temp\CT2625848
Ordner Gelöscht : C:\Users\expert\AppData\Local\Temp\CT3317892
Ordner Gelöscht : C:\Users\expert\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\expert\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\expert\AppData\Roaming\Windows Net Data
Ordner Gelöscht : C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeRIP
Ordner Gelöscht : C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDvidCodec.com
Ordner Gelöscht : C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\Smartbar
Ordner Gelöscht : C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\CT2625848
Ordner Gelöscht : C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\CT3317892
Ordner Gelöscht : C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM
Ordner Gelöscht : C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\Extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
Ordner Gelöscht : C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\Extensions\{422f7661-9403-4da4-b4ef-cc3e268817b5}
Datei Gelöscht : C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\Extensions\hdvc@hdvc.com.xpi
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\expert\Desktop\HDVidCodec.lnk
Datei Gelöscht : C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\searchplugins\Conduit.xml
Datei Gelöscht : C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage
Datei Gelöscht : C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage-journal
Datei Gelöscht : C:\Users\expert\AppData\Local\Google\Chrome\user data\default\local storage\hxxp_pricegong.conduitapps.com_0.localstorage
Datei Gelöscht : C:\Users\expert\AppData\Local\Google\Chrome\user data\default\local storage\hxxp_pricegong.conduitapps.com_0.localstorage-journal
Datei Gelöscht : C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage
Datei Gelöscht : C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal
Datei Gelöscht : C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage
Datei Gelöscht : C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage-journal
Datei Gelöscht : C:\Windows\System32\Tasks\BackgroundContainer Startup Task
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\bhphemoobgnikcoofkgackkaimpfmenm
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bhphemoobgnikcoofkgackkaimpfmenm
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\kpkbnefaikfaeadgidhpoanckoiaheli
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FreeRIP3_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FreeRIP3_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3317892
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A8E5842E-102B-4289-9D57-3B3F5B5E15D3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB797681-40E0-11D2-9BD5-0060082AE372}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{501451DE-5808-4599-B544-8BD0915B6B24}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\prefs.js ]
Zeile gelöscht : user_pref("CT2625848.1000082.isDisplayHidden", "true");
Zeile gelöscht : user_pref("CT2625848.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock\",\"url\":\"hxxp://feedlive.net/california.asx\"}");
Zeile gelöscht : user_pref("CT2625848.2625848a129894023611240511000000paramsGK1.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzU3OTkyNTg4MjUxLCJ1cGRhdGVSZXNwVGltZSI6MTM1Nzk5MjU5MDgzOCwiZGF0YSI6eyJzZXR0aW5ncyI6eyJpY29uIjoiaHR0cDovL3[...]
Zeile gelöscht : user_pref("CT2625848.CBOpenMAMSettings.enc", "MA==");
Zeile gelöscht : user_pref("CT2625848.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.FirstTime", "true");
Zeile gelöscht : user_pref("CT2625848.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT2625848.InstallDate", "12/1/2013 13:09:29");
Zeile gelöscht : user_pref("CT2625848.LoginRevertSettingsEnabled", true);
Zeile gelöscht : user_pref("CT2625848.RevertSettingsEnabled", true);
Zeile gelöscht : user_pref("CT2625848.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&CUI=SB_CUI&q=");
Zeile gelöscht : user_pref("CT2625848.UserID", "UN26603503080219692");
Zeile gelöscht : user_pref("CT2625848.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.autoDisableScopes", -1);
Zeile gelöscht : user_pref("CT2625848.browser.search.defaultthis.engineName", true);
Zeile gelöscht : user_pref("CT2625848.cbcountry_001.enc", "UFk=");
Zeile gelöscht : user_pref("CT2625848.cbfirsttime.enc", "U2F0IEphbiAxMiAyMDEzIDEzOjA5OjU1IEdNVCswMTAw");
Zeile gelöscht : user_pref("CT2625848.defaultSearch", "true");
Zeile gelöscht : user_pref("CT2625848.embeddedsData", "[{\"appId\":\"129181467799155027\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]
Zeile gelöscht : user_pref("CT2625848.enableAlerts", "false");
Zeile gelöscht : user_pref("CT2625848.enableSearchFromAddressBar", "true");
Zeile gelöscht : user_pref("CT2625848.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundError", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.fixUrls", true);
Zeile gelöscht : user_pref("CT2625848.installId", "conduitnsisintegration");
Zeile gelöscht : user_pref("CT2625848.installType", "conduitnsisintegration");
Zeile gelöscht : user_pref("CT2625848.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT2625848.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT2625848.isNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2625848.isPerformedSmartBarTransition", "true");
Zeile gelöscht : user_pref("CT2625848.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT2625848.keyword", true);
Zeile gelöscht : user_pref("CT2625848.migrateAppsAndComponents", true);
Zeile gelöscht : user_pref("CT2625848.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fdvdvideosofttbde.ourtoolbar.com%2FUninstallInstructions%2F\",\"EB_MAIN_FRAME_TITLE\":\"%0A%09Wie%20die%20Symbolleist[...]
Zeile gelöscht : user_pref("CT2625848.openThankYouPage", "false");
Zeile gelöscht : user_pref("CT2625848.openUninstallPage", "true");
Zeile gelöscht : user_pref("CT2625848.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"01\\\\/12\\\\/2013 15\\\"}\"}");
Zeile gelöscht : user_pref("CT2625848.price-gong.isManagedApp", "true");
Zeile gelöscht : user_pref("CT2625848.revertSettingsEnabled", "true");
Zeile gelöscht : user_pref("CT2625848.search.searchAppId", "129181467799155027");
Zeile gelöscht : user_pref("CT2625848.search.searchCount", "0");
Zeile gelöscht : user_pref("CT2625848.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2625848\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://DVDVideoSoftTBDE.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"DVDVideoSoftTB DE\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1357992581061");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appsMetadata_lastUpdate", "1357992581089");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1357992583224");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.13.40.15_lastUpdate", "1357992582739");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1357992583294");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_searchAPI_lastUpdate", "1357992577012");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_serviceMap_lastUpdate", "1357992575813");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarContextMenu_lastUpdate", "1357992582962");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarSettings_lastUpdate", "1357992577845");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_translation_lastUpdate", "1357992581274");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_userApps_lastUpdate", "1357992588470");
Zeile gelöscht : user_pref("CT2625848.settingsINI", true);
Zeile gelöscht : user_pref("CT2625848.shouldFirstTimeDialog", "false");
Zeile gelöscht : user_pref("CT2625848.smartbar.CTID", "CT2625848");
Zeile gelöscht : user_pref("CT2625848.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT2625848.smartbar.homepage", true);
Zeile gelöscht : user_pref("CT2625848.smartbar.toolbarName", "DVDVideoSoftTB DE ");
Zeile gelöscht : user_pref("CT2625848.toolbarBornServerTime", "12-1-2013");
Zeile gelöscht : user_pref("CT2625848.toolbarCurrentServerTime", "12-1-2013");
Zeile gelöscht : user_pref("CT2625848.toolbarDisabled", "true");
Zeile gelöscht : user_pref("CT2625848_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1357992573669,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("CT3317892.UserID", "UN23038928413218311");
Zeile gelöscht : user_pref("CT3317892.fullUserID", "UN23038928413218311.IN.20131116153732");
Zeile gelöscht : user_pref("CT3317892.installerVersion", "1.8.1.4");
Zeile gelöscht : user_pref("CT3317892.toolbarInstallDate", "16-11-2013 15:37:32");
Zeile gelöscht : user_pref("CT3317892.versionFromInstaller", "10.22.3.18");
Zeile gelöscht : user_pref("CT3317892.xpeMode", "0");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3317892&octid=CT3317892&SearchSource=61&CUI=UN23038928413218311&UM=2&UP=SP4EE6B1E6-1F24-4C64-BFD1-A540C1533745");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "DVDVideoSoftTB DE Customized Web Search");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&CUI=SB_CUI&q=");
Zeile gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT2625848");
Zeile gelöscht : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT2625848&SearchSource=13&CUI=SB_CUI,hxxp://search.conduit.com/?ctid=CT3317892&octid=CT3317892&SearchSource=61&CUI=UN23038928[...]
Zeile gelöscht : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&CUI=SB_CUI&q=");
Zeile gelöscht : user_pref("smartbar.machineId", "GMH16BSLCV+Z0N96EOPHNCHQB2KALEZGJITIF7XIQWZSK8W0NU22RTD4ASL9DKOPY5UXXAD+ZSF3QTTB5QWXEG");
Zeile gelöscht : user_pref("smartbar.originalHomepage", "chrome://branding/locale/browserconfig.properties");
Zeile gelöscht : user_pref("smartbar.originalSearchAddressUrl", "");
Zeile gelöscht : user_pref("smartbar.originalSearchEngine", false);
-\\ Google Chrome v
[ Datei : C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht : homepage
Gelöscht : urls_to_restore_on_startup
*************************
AdwCleaner[R0].txt - [17216 octets] - [10/01/2014 11:47:15]
AdwCleaner[S0].txt - [16628 octets] - [10/01/2014 11:48:19]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [16689 octets] ##########
Kann jetzt Antivir aktualisieren. Und FRST konnte jetzt auch Berichte ausspucken. FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-01-2014
Ran by expert (administrator) on SAMY on 10-01-2014 11:56:27
Running from C:\Users\expert\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Salfeld Computer) C:\Windows\SysWOW64\cchservice.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Salfeld Computer) C:\Windows\tray\wintmr.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Dropbox, Inc.) C:\Users\expert\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Salfeld Computer) C:\Windows\SysWOW64\cc32\webtmr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-04-13] (ELAN Microelectronic Corp.)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)
HKLM-x32\...\Run: [ChicoSys] - C:\Windows\SysWOW64\cc32\webtmr.exe [5516696 2009-07-14] (Salfeld Computer)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [WinampAgent] - "C:\Program Files (x86)\Winamp\winampa.exe"
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [TomTomHOME.exe] - "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
HKCU\...\Run: [Google Update] - C:\Users\expert\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-04-29] (Google Inc.)
HKCU\...\Run: [CCWinTray] - C:\Windows\tray\wintmr.exe [5502872 2009-07-14] (Salfeld Computer)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [ares] - "C:\Program Files (x86)\Ares\Ares.exe" -h
HKCU\...\Run: [TBHostSupport] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\expert\AppData\Local\TBHostSupport\TBHostSupport.dll",DLLRunTBHostSupportPlugin <===== ATTENTION
HKCU\...\Policies\system: [DisableClock] 0
HKCU\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Policies\Explorer: [NoSaveSettings] 0
HKCU\...\Policies\Explorer: [NoFind] 0
HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000
MountPoints2: {56a17cdd-4cef-11e1-946b-18f46a89c2c4} - E:\AutoRun.exe
MountPoints2: {56a17d02-4cef-11e1-946b-18f46a89c2c4} - E:\AutoRun.exe
MountPoints2: {5ca9815b-0f0f-11e1-9761-1c75083ca7c1} - F:\seite1.exe
MountPoints2: {7571851a-53d9-11e1-bfed-806e6f6e6963} - E:\AutoRun.exe
MountPoints2: {7a991875-4f7d-11e2-93d8-18f46a89c2c4} - E:\Windows\Install.exe
MountPoints2: {7a99188c-4f7d-11e2-93d8-18f46a89c2c4} - E:\AutoRun.exe
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
HKU\Gast\...\Run: [TomTomHOME.exe] - "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
HKU\Gast\...\Run: [Google Update] - C:\Users\expert\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-04-29] (Google Inc.)
HKU\Gast\...\Run: [CCWinTray] - C:\Windows\tray\wintmr.exe [5502872 2009-07-14] (Salfeld Computer)
HKU\Gast\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKU\Gast\...\Run: [ares] - "C:\Program Files (x86)\Ares\Ares.exe" -h
HKU\Gast\...\Run: [SearchProtect] - C:\Users\Gast\AppData\Roaming\SearchProtect\bin\cltmng.exe
HKU\Gast\...\Run: [BackgroundContainer] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\expert\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION
HKU\Gast\...\Policies\system: [DisableClock] 1
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [111720 2010-10-28] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [100456 2010-10-28] (NVIDIA Corporation)
Startup: C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\expert\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://acer.msn.com
URLSearchHook: HKLM-x32 - (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File
URLSearchHook: HKCU - (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\expert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\expert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\gcswf32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Chrome NaCl) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Google Gears 0.5.33.0) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\gears.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.131.2_0\McChPlg.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Windows Live? Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\expert\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Google Wallet) - C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0
CHR HKCU\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\expert\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx
CHR HKLM-x32\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\expert\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx
CHR StartMenuInternet: Google Chrome - C:\Users\expert\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S2 ksupmgr; C:\Windows\SysWOW64\ksupmgr.exe [762520 2010-07-28] (Salfeld Computer)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 SjtWinIo; C:\Windows\System32\DRIVERS\SjtWinIo.sys [9216 2009-01-01] (SpeedJet Technology INC.)
S2 hardlock; \??\C:\Windows\system32\drivers\hardlock.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [x]
S3 k57nd60a; system32\DRIVERS\k57nd60a.sys [x]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-10 15:34 - 2014-01-10 15:34 - 01233962 _____ C:\Users\adwcleaner.exe
2014-01-10 14:24 - 2014-01-10 14:24 - 01932166 _____ (Farbar) C:\Users\FRST64.exe
2014-01-10 11:56 - 2014-01-10 11:57 - 00013549 _____ C:\Users\expert\Downloads\FRST.txt
2014-01-10 11:55 - 2014-01-10 11:56 - 01932166 _____ (Farbar) C:\Users\expert\Downloads\FRST64.exe
2014-01-10 11:47 - 2014-01-10 11:48 - 00000000 ____D C:\AdwCleaner
2014-01-10 11:41 - 2014-01-10 11:41 - 00003288 ____N C:\bootsqm.dat
2014-01-10 11:01 - 2014-01-10 11:01 - 00072306 _____ C:\Users\expert\Desktop\Extras.Txt
2014-01-10 11:00 - 2014-01-10 11:00 - 00117790 _____ C:\Users\expert\Desktop\OTL.Txt
2014-01-10 10:59 - 2014-01-10 10:59 - 00072306 _____ C:\Users\expert\Downloads\Extras.Txt
2014-01-10 10:58 - 2014-01-10 10:58 - 00117790 _____ C:\Users\expert\Downloads\OTL.Txt
2014-01-10 10:45 - 2014-01-10 10:45 - 00602112 _____ (OldTimer Tools) C:\Users\expert\Downloads\OTL.exe
2014-01-10 10:27 - 2014-01-10 11:56 - 00000000 ____D C:\FRST
2013-12-31 16:50 - 2013-12-31 16:50 - 00334228 _____ C:\Users\expert\Downloads\ImageshopCart_1950343.zip
2013-12-31 15:48 - 2013-12-31 15:49 - 01027947 _____ C:\Users\expert\Downloads\ImageshopCart_1847805.zip
2013-12-25 16:46 - 2013-12-25 16:46 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP
2013-12-25 15:27 - 2013-12-25 15:29 - 03178668 _____ C:\Users\expert\Downloads\phpBB-3.0.12-deutsch.zip
2013-12-25 14:43 - 2013-12-25 14:43 - 00002659 _____ C:\Users\Public\Desktop\SmartFTP Client.lnk
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Users\expert\AppData\Roaming\SmartFTP
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Program Files\SmartFTP Client
2013-12-25 14:42 - 2013-12-25 14:42 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP Client 5.0 Setup
2013-12-25 14:40 - 2013-12-25 14:42 - 18571400 _____ (SmartSoft Ltd) C:\Users\expert\Downloads\SFTPMSI.exe
2013-12-25 14:36 - 2013-12-25 14:36 - 00003164 _____ C:\Windows\System32\Tasks\{25906794-6631-4804-BD9A-9412412C3232}
2013-12-25 14:35 - 2013-12-25 14:35 - 04076719 _____ C:\Users\expert\Downloads\FileZilla_3.2.7.1_win32-setup.exe
2013-12-25 13:44 - 2013-12-25 13:45 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_164544.zip
2013-12-25 13:02 - 2013-12-25 13:02 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_162811.zip
2013-12-25 12:48 - 2013-12-25 12:48 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_1548626.zip
2013-12-25 12:31 - 2013-12-25 12:31 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_1531590.zip
2013-12-25 11:36 - 2013-12-25 11:36 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_1436884.zip
2013-12-25 10:08 - 2013-12-25 10:08 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_138534.zip
2013-12-25 10:02 - 2013-12-25 10:04 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_132659.zip
2013-12-21 17:09 - 2013-12-21 17:09 - 00163878 _____ C:\Users\expert\Downloads\orion.zip
2013-12-21 17:09 - 2013-12-21 17:09 - 00163878 _____ C:\Users\expert\Downloads\orion(1).zip
2013-12-16 19:20 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-16 19:20 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-16 19:20 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-16 19:20 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-16 19:20 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-16 19:20 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-16 19:20 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-16 19:20 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-16 19:20 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-16 19:20 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-16 19:20 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-16 19:20 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-16 19:20 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-16 19:20 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-16 19:20 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-16 19:20 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-16 19:20 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-16 19:20 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-16 19:20 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-16 19:20 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-16 19:20 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-16 19:20 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-16 19:20 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-16 19:20 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-16 19:20 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-16 19:20 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-16 19:20 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-16 19:20 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-16 19:20 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-16 19:20 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-16 19:20 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-14 12:46 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-12-14 12:42 - 2013-12-14 12:42 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-14 12:42 - 2013-12-14 12:42 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-14 12:42 - 2013-12-14 12:42 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-14 12:42 - 2013-12-14 12:42 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-14 12:42 - 2013-12-14 12:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-14 12:42 - 2013-12-14 12:42 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-14 12:42 - 2013-12-14 12:42 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-14 12:40 - 2013-12-14 12:46 - 00009961 _____ C:\Windows\IE11_main.log
2013-12-13 16:04 - 2013-12-13 16:04 - 00282516 _____ C:\Users\expert\Downloads\ImageshopCart_194277.zip
2013-12-13 11:09 - 2013-12-13 11:09 - 00524894 _____ C:\Users\expert\Downloads\ImageshopCart_148586.zip
2013-12-13 08:08 - 2013-12-13 08:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-13 07:41 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-13 07:41 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-13 07:41 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-13 07:41 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-12 14:20 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 14:20 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 14:20 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 14:14 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 14:14 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 14:14 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-12 14:14 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-12 14:14 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 14:14 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 14:14 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-12 14:14 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-12 14:13 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 14:13 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 14:13 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-12 14:13 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 14:13 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-12 14:13 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 14:13 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-12 14:13 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
==================== One Month Modified Files and Folders =======
2014-01-10 15:34 - 2014-01-10 15:34 - 01233962 _____ C:\Users\adwcleaner.exe
2014-01-10 14:24 - 2014-01-10 14:24 - 01932166 _____ (Farbar) C:\Users\FRST64.exe
2014-01-10 11:57 - 2014-01-10 11:56 - 00013549 _____ C:\Users\expert\Downloads\FRST.txt
2014-01-10 11:56 - 2014-01-10 11:55 - 01932166 _____ (Farbar) C:\Users\expert\Downloads\FRST64.exe
2014-01-10 11:56 - 2014-01-10 10:27 - 00000000 ____D C:\FRST
2014-01-10 11:53 - 2010-11-21 06:42 - 01871443 _____ C:\Windows\WindowsUpdate.log
2014-01-10 11:50 - 2013-12-06 14:39 - 00000000 ___RD C:\Users\expert\Dropbox
2014-01-10 11:50 - 2013-12-06 14:38 - 00000000 ____D C:\Users\expert\AppData\Roaming\Dropbox
2014-01-10 11:50 - 2011-05-30 10:57 - 00000121 _____ C:\Windows\SysWOW64\SWCTL.DLL
2014-01-10 11:49 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-10 11:49 - 2009-07-14 05:51 - 00078536 _____ C:\Windows\setupact.log
2014-01-10 11:49 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-10 11:49 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-10 11:48 - 2014-01-10 11:47 - 00000000 ____D C:\AdwCleaner
2014-01-10 11:41 - 2014-01-10 11:41 - 00003288 ____N C:\bootsqm.dat
2014-01-10 11:30 - 2011-05-30 10:57 - 00003151 _____ C:\NET.INI
2014-01-10 11:24 - 2011-04-29 14:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2975014363-2867879005-296608908-1002UA.job
2014-01-10 11:01 - 2014-01-10 11:01 - 00072306 _____ C:\Users\expert\Desktop\Extras.Txt
2014-01-10 11:00 - 2014-01-10 11:00 - 00117790 _____ C:\Users\expert\Desktop\OTL.Txt
2014-01-10 10:59 - 2014-01-10 10:59 - 00072306 _____ C:\Users\expert\Downloads\Extras.Txt
2014-01-10 10:58 - 2014-01-10 10:58 - 00117790 _____ C:\Users\expert\Downloads\OTL.Txt
2014-01-10 10:58 - 2012-12-26 18:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-10 10:45 - 2014-01-10 10:45 - 00602112 _____ (OldTimer Tools) C:\Users\expert\Downloads\OTL.exe
2014-01-09 15:11 - 2012-12-26 18:35 - 00000000 ____D C:\Users\expert\AppData\Roaming\Skype
2014-01-02 12:47 - 2012-12-26 18:04 - 00011270 _____ C:\Windows\SysWOW64\cchservice.err
2013-12-31 16:50 - 2013-12-31 16:50 - 00334228 _____ C:\Users\expert\Downloads\ImageshopCart_1950343.zip
2013-12-31 15:49 - 2013-12-31 15:48 - 01027947 _____ C:\Users\expert\Downloads\ImageshopCart_1847805.zip
2013-12-29 15:47 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-26 16:28 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-25 16:46 - 2013-12-25 16:46 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP
2013-12-25 15:29 - 2013-12-25 15:27 - 03178668 _____ C:\Users\expert\Downloads\phpBB-3.0.12-deutsch.zip
2013-12-25 14:43 - 2013-12-25 14:43 - 00002659 _____ C:\Users\Public\Desktop\SmartFTP Client.lnk
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Users\expert\AppData\Roaming\SmartFTP
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Program Files\SmartFTP Client
2013-12-25 14:42 - 2013-12-25 14:42 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP Client 5.0 Setup
2013-12-25 14:42 - 2013-12-25 14:40 - 18571400 _____ (SmartSoft Ltd) C:\Users\expert\Downloads\SFTPMSI.exe
2013-12-25 14:39 - 2013-04-12 16:25 - 00001718 _____ C:\Users\expert\Desktop\ftp-uploader.lnk
2013-12-25 14:38 - 2011-03-05 19:46 - 00000000 ____D C:\Users\expert\AppData\Local\VirtualStore
2013-12-25 14:36 - 2013-12-25 14:36 - 00003164 _____ C:\Windows\System32\Tasks\{25906794-6631-4804-BD9A-9412412C3232}
2013-12-25 14:35 - 2013-12-25 14:35 - 04076719 _____ C:\Users\expert\Downloads\FileZilla_3.2.7.1_win32-setup.exe
2013-12-25 13:45 - 2013-12-25 13:44 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_164544.zip
2013-12-25 13:02 - 2013-12-25 13:02 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_162811.zip
2013-12-25 12:48 - 2013-12-25 12:48 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_1548626.zip
2013-12-25 12:31 - 2013-12-25 12:31 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_1531590.zip
2013-12-25 11:36 - 2013-12-25 11:36 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_1436884.zip
2013-12-25 10:08 - 2013-12-25 10:08 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_138534.zip
2013-12-25 10:04 - 2013-12-25 10:02 - 00000022 _____ C:\Users\expert\Downloads\ImageshopCart_132659.zip
2013-12-21 17:09 - 2013-12-21 17:09 - 00163878 _____ C:\Users\expert\Downloads\orion.zip
2013-12-21 17:09 - 2013-12-21 17:09 - 00163878 _____ C:\Users\expert\Downloads\orion(1).zip
2013-12-21 15:53 - 2010-11-21 06:39 - 00033946 _____ C:\Windows\PFRO.log
2013-12-21 15:53 - 2010-08-30 10:24 - 00000000 ____D C:\Program Files (x86)\EgisTec MyWinLocker
2013-12-20 16:35 - 2010-08-30 10:12 - 00000000 ____D C:\Program Files (x86)\Acer GameZone
2013-12-20 16:34 - 2011-09-11 01:16 - 00000000 ____D C:\ProgramData\Firefly Studios
2013-12-20 16:34 - 2010-08-30 10:03 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-20 16:32 - 2013-02-07 07:47 - 00000000 ____D C:\Program Files (x86)\Winamp
2013-12-20 16:32 - 2010-08-30 10:21 - 00000000 ____D C:\Program Files (x86)\Acer
2013-12-20 16:29 - 2011-06-15 20:49 - 00000000 ____D C:\Users\Gast
2013-12-20 16:29 - 2010-11-21 06:43 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-12-20 16:28 - 2013-04-12 16:19 - 00000000 ____D C:\Program Files (x86)\phase5
2013-12-20 16:27 - 2010-08-30 10:24 - 00000000 ____D C:\ProgramData\EgisTec IPS
2013-12-19 08:41 - 2013-09-11 05:33 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-19 08:41 - 2013-09-11 05:31 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-19 08:41 - 2013-09-11 05:31 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-19 08:37 - 2013-12-06 14:39 - 00001020 _____ C:\Users\expert\Desktop\Dropbox.lnk
2013-12-19 08:37 - 2013-12-06 14:38 - 00000542 _____ C:\Windows\wininit.ini
2013-12-19 08:37 - 2013-12-06 14:38 - 00000000 ____D C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-19 08:37 - 2011-03-05 19:46 - 00000000 ___RD C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-16 19:20 - 2013-08-18 13:34 - 00000000 ____D C:\Windows\system32\MRT
2013-12-16 15:17 - 2011-05-30 21:33 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-14 20:54 - 2011-03-05 19:46 - 00001425 _____ C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-14 20:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-14 12:46 - 2013-12-14 12:40 - 00009961 _____ C:\Windows\IE11_main.log
2013-12-14 12:42 - 2013-12-14 12:42 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-14 12:42 - 2013-12-14 12:42 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-14 12:42 - 2013-12-14 12:42 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-14 12:42 - 2013-12-14 12:42 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-14 12:42 - 2013-12-14 12:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-14 12:42 - 2013-12-14 12:42 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-14 12:42 - 2013-12-14 12:42 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-14 12:42 - 2013-12-14 12:42 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-14 12:42 - 2013-12-14 12:42 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-14 11:09 - 2013-01-22 17:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-13 16:04 - 2013-12-13 16:04 - 00282516 _____ C:\Users\expert\Downloads\ImageshopCart_194277.zip
2013-12-13 11:09 - 2013-12-13 11:09 - 00524894 _____ C:\Users\expert\Downloads\ImageshopCart_148586.zip
2013-12-13 09:56 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-13 09:54 - 2009-07-14 05:45 - 00344120 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-13 08:08 - 2013-12-13 08:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-13 08:00 - 2012-12-26 18:00 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-13 07:59 - 2012-12-26 18:00 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-13 07:59 - 2012-12-26 18:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
Some content of TEMP:
====================
C:\Users\expert\AppData\Local\Temp\AskSLib.dll
C:\Users\expert\AppData\Local\Temp\atl100.dll
C:\Users\expert\AppData\Local\Temp\avgnt.exe
C:\Users\expert\AppData\Local\Temp\BearShare_setup.exe
C:\Users\expert\AppData\Local\Temp\COMAP.EXE
C:\Users\expert\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\expert\AppData\Local\Temp\EBU3CC4.exe
C:\Users\expert\AppData\Local\Temp\EBU41E3.DLL
C:\Users\expert\AppData\Local\Temp\EBUC094.EXE
C:\Users\expert\AppData\Local\Temp\EBUC1FA.DLL
C:\Users\expert\AppData\Local\Temp\GUR4490.exe
C:\Users\expert\AppData\Local\Temp\GUR7119.exe
C:\Users\expert\AppData\Local\Temp\IERunner.dll
C:\Users\expert\AppData\Local\Temp\MSNFFE2.exe
C:\Users\expert\AppData\Local\Temp\msvcp100.dll
C:\Users\expert\AppData\Local\Temp\msvcr100.dll
C:\Users\expert\AppData\Local\Temp\nsa43A7.exe
C:\Users\expert\AppData\Local\Temp\nsg3900.exe
C:\Users\expert\AppData\Local\Temp\nsgC60F.exe
C:\Users\expert\AppData\Local\Temp\nsl285A.exe
C:\Users\expert\AppData\Local\Temp\nsl8A4B.exe
C:\Users\expert\AppData\Local\Temp\nsv8D34.exe
C:\Users\expert\AppData\Local\Temp\nsv96F7.exe
C:\Users\expert\AppData\Local\Temp\Quarantine.exe
C:\Users\expert\AppData\Local\Temp\ResetDevice.exe
C:\Users\expert\AppData\Local\Temp\SetupDataMngr_BearShare.exe
C:\Users\expert\AppData\Local\Temp\SPStub.exe
C:\Users\expert\AppData\Local\Temp\tbRadi.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-31 13:31
==================== End Of Log ============================
Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-01-2014
Ran by expert at 2014-01-10 11:58:12
Running from C:\Users\expert\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Acer Backup Manager (x32 Version: 2.0.0.68 - NewTech Infosystems)
Acer Crystal Eye webcam (x32 Version: 1.0.4.5 - Liteon)
Acer ePower Management (x32 Version: 5.00.3005 - Acer Incorporated)
Acer eRecovery Management (x32 Version: 4.05.3013 - Acer Incorporated)
Acer Registration (x32 Version: 1.03.3003 - Acer Incorporated)
Acer ScreenSaver (x32 Version: 1.1.0707.2010 - Acer Incorporated)
Acer Updater (x32 Version: 1.02.3001 - Acer Incorporated)
Acrobat.com (x32 Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Airport Mania First Flight (x32 Version: - Oberon Media)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Backup Manager Basic (x32 Version: 2.0.0.68 - NewTech Infosystems) Hidden
CyberLink PowerDVD 9 (x32 Version: 9.0.3216.50 - CyberLink Corp.)
CyberLink PowerDVD 9 (x32 Version: 9.0.3216.50 - CyberLink Corp.) Hidden
Dropbox (HKCU Version: 2.4.10 - Dropbox, Inc.)
DVD Shrink 3.2 deutsch (DeCSS-frei) (x32 Version: - DVD Shrink)
e-Sword (x32 Version: 10.01.0000 - Rick Meyers)
ETDWare PS/2-x64 7.0.6.5_WHQL (Version: 7.0.6.5 - ELAN Microelectronics Corp.)
FIFA 10 (x32 Version: 1.0.0.0 - Electronic Arts)
Free YouTube Download version 3.1.42.1212 (x32 Version: 3.1.42.1212 - DVDVideoSoft Ltd.)
ftp-uploader (x32 Version: 3.3.0.0 - Firma Gregor Schommer Systemberatung, Raderthaler Str. 31, D-50968 Köln)
Google Chrome (HKCU Version: 31.0.1650.63 - Google Inc.)
Identity Card (x32 Version: 1.00.3003 - Acer Incorporated)
inSSIDer (x32 Version: 2.1.6 - MetaGeek)
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2182 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 9.6.2.1001 - Intel Corporation)
Internet Movil Tigo (x32 Version: 11.300.05.00.303 - Huawei Technologies Co.,Ltd)
Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Kindersicherung 2010 (x32 Version: - Salfeld Computer GmbH)
Launch Manager (x32 Version: 4.0.14 - Acer Inc.)
LibreOffice 4.0.1.2 (x32 Version: 4.0.1.2 - The Document Foundation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Age of Empires II (x32 Version: - )
Microsoft Age of Empires II: The Conquerors Expansion (x32 Version: - )
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
MSXML4 Parser (x32 Version: 1.0.0 - Microsoft Game Studios)
NBA 2K11 (x32 Version: 1.0.0 - 2K Sports)
NTI Media Maker 9 (x32 Version: 9.0.2.8939 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.8939 - NTI Corporation) Hidden
NVIDIA Display Control Panel (Version: 6.14.12.5997 - NVIDIA Corporation)
NVIDIA Drivers (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA PhysX (x32 Version: 9.10.0224 - NVIDIA Corporation)
NVIDIA Updatus (x32 Version: 1.0.3 - NVIDIA Corporation) Hidden
QuickTime (x32 Version: 7.73.80.64 - Apple Inc.)
SEMA Holzbausoftware V10.4 (de) (x32 Version: - )
Shredder (Version: 2.0.8.3 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.3 - Egis Technology Inc.) Hidden
Skype™ 6.3 (x32 Version: 6.3.107 - Skype Technologies S.A.)
SmartFTP Client (Version: 5.0.1349.0 - SmartSoft Ltd.)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Sync (x32 Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029 - Microsoft Corporation)
==================== Restore Points =========================
31-12-2013 08:03:21 Windows Update
01-01-2014 18:57:53 Windows Update
01-01-2014 22:11:55 Windows Update
02-01-2014 15:31:26 Windows Update
10-01-2014 07:50:49 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {2790E258-4100-466F-9B1F-5F6F7E4381D8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2975014363-2867879005-296608908-1002Core => C:\Users\expert\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-29] (Google Inc.)
Task: {55B12456-203F-4EFD-B689-D5B5537D82FB} - System32\Tasks\{3D929BD7-A53C-490D-B8EB-6E90A3E2471E} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&page=tsInstall
Task: {985255A4-76E3-4F2F-87E2-EDBBB906A890} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2975014363-2867879005-296608908-1002UA => C:\Users\expert\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-29] (Google Inc.)
Task: {BF104B1C-CAC3-4E90-99BD-35982162D19D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-13] (Adobe Systems Incorporated)
Task: {D7CC5439-6A57-45B8-A265-62E63B702CF9} - \BackgroundContainer Startup Task No Task File
Task: {E89E58CC-1B7A-4123-BF8F-2EB42A381C52} - System32\Tasks\{E6EF2451-57B3-4D12-B517-ED2B9C4DDF21} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&page=tsInstall
Task: {F0600240-26F5-40FE-B940-A127ABB28887} - System32\Tasks\{F7AA4891-6BA6-44E8-B4C4-2E2523C42675} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&page=tsInstall
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2975014363-2867879005-296608908-1002Core.job => C:\Users\expert\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2975014363-2867879005-296608908-1002UA.job => C:\Users\expert\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-06-22 06:48 - 2011-06-22 06:48 - 00034304 _____ () C:\Windows\System32\ssp7ml6.dll
2013-09-11 05:31 - 2013-09-10 23:31 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2010-06-28 23:20 - 2010-06-28 23:20 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2010-06-28 23:12 - 2010-06-28 23:12 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\expert\AppData\Roaming\Dropbox\bin\libcef.dll
2010-08-30 10:45 - 2009-05-20 07:02 - 00072200 _____ () C:\Program Files (x86)\Launch Manager\CdDirIo.dll
2010-11-02 11:59 - 2010-10-28 03:06 - 00010856 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-12-13 08:08 - 2013-12-13 08:08 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-08-30 08:11 - 2013-08-30 08:11 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\eff228aa396c1d45248a54b44d7ce5a0\IsdiInterop.ni.dll
2010-08-30 10:03 - 2010-04-13 17:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:CDFF58FE
AlternateDataStreams: C:\Users\expert\Downloads:Shareaza.GUID
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ksupmgr => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ksupmgr => ""="Service"
==================== Faulty Device Manager Devices =============
Name: Ethernet-Controller
Description: Ethernet-Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/10/2014 11:29:35 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1020) SUS20ClientDataStore: Versuch, Datei "C:\Windows\SoftwareDistribution\DataStore\Logs\edbres00002.jrs" zu erstellen, ist mit Systemfehler 1393 (0x00000571): "Die Datenträgerstruktur ist beschädigt und nicht lesbar. " fehlgeschlagen. Fehler -1022 (0xfffffc02) beim Erstellen von Dateien.
Error: (01/10/2014 11:29:35 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1020) SUS20ClientDataStore: Das Datenbankmodul kann keine Aktualisierungen akzeptieren, weil die Festplatte, auf der sich die Protokolldatei der Datenbank befindet, über zu wenig freien Speicherplatz verfügt .
Error: (01/10/2014 11:29:35 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1020) SUS20ClientDataStore: Versuch, Datei "C:\Windows\SoftwareDistribution\DataStore\Logs\edbres00002.jrs" zu erstellen, ist mit Systemfehler 1393 (0x00000571): "Die Datenträgerstruktur ist beschädigt und nicht lesbar. " fehlgeschlagen. Fehler -1022 (0xfffffc02) beim Erstellen von Dateien.
Error: (01/10/2014 11:29:35 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1020) SUS20ClientDataStore: Versuch, Datei "C:\Windows\SoftwareDistribution\DataStore\Logs\edbres00002.jrs" zu erstellen, ist mit Systemfehler 1393 (0x00000571): "Die Datenträgerstruktur ist beschädigt und nicht lesbar. " fehlgeschlagen. Fehler -1022 (0xfffffc02) beim Erstellen von Dateien.
Error: (01/10/2014 11:29:35 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1020) SUS20ClientDataStore: Das Datenbankmodul kann keine Aktualisierungen akzeptieren, weil die Festplatte, auf der sich die Protokolldatei der Datenbank befindet, über zu wenig freien Speicherplatz verfügt .
Error: (01/10/2014 11:29:35 AM) (Source: ESENT) (User: )
Description: wuaueng.dll (1020) SUS20ClientDataStore: Versuch, Datei "C:\Windows\SoftwareDistribution\DataStore\Logs\edbres00002.jrs" zu erstellen, ist mit Systemfehler 1393 (0x00000571): "Die Datenträgerstruktur ist beschädigt und nicht lesbar. " fehlgeschlagen. Fehler -1022 (0xfffffc02) beim Erstellen von Dateien.
Error: (01/10/2014 11:25:11 AM) (Source: Windows Search Service) (User: )
Description: Der Gatherer-Dienst kann nicht initialisiert werden.
Details:
Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben. (HRESULT : 0x80070660) (0x80070660)
Error: (01/10/2014 11:23:24 AM) (Source: Windows Search Service) (User: )
Description: Der Gatherer-Dienst kann nicht initialisiert werden.
Details:
Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben. (HRESULT : 0x80070660) (0x80070660)
Error: (01/10/2014 11:20:31 AM) (Source: Windows Search Service) (User: )
Description: Der Gatherer-Dienst kann nicht initialisiert werden.
Details:
Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben. (HRESULT : 0x80070660) (0x80070660)
Error: (01/10/2014 11:17:38 AM) (Source: Windows Search Service) (User: )
Description: Der Gatherer-Dienst kann nicht initialisiert werden.
Details:
Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben. (HRESULT : 0x80070660) (0x80070660)
System errors:
=============
Error: (01/10/2014 11:50:01 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "hardlock" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/10/2014 11:46:08 AM) (Source: NetBT) (User: )
Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.116
registriert werden. Der Computer mit IP-Adresse 192.168.1.110 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (01/10/2014 11:45:14 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "hardlock" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/10/2014 11:31:29 AM) (Source: Ntfs) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "Acer" den Befehl "chkdsk" aus.
Error: (01/10/2014 11:31:29 AM) (Source: Ntfs) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "Acer" den Befehl "chkdsk" aus.
Error: (01/10/2014 11:31:19 AM) (Source: Service Control Manager) (User: )
Description: Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 35 Mal passiert.
Error: (01/10/2014 11:31:19 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem Fehler beendet:
%%1393
Error: (01/10/2014 11:31:19 AM) (Source: Ntfs) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "Acer" den Befehl "chkdsk" aus.
Error: (01/10/2014 11:31:19 AM) (Source: Ntfs) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "Acer" den Befehl "chkdsk" aus.
Error: (01/10/2014 11:31:19 AM) (Source: Ntfs) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "Acer" den Befehl "chkdsk" aus.
Microsoft Office Sessions:
=========================
Error: (01/10/2014 11:29:35 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1020SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edbres00002.jrs-1022 (0xfffffc02)1393 (0x00000571)Die Datenträgerstruktur ist beschädigt und nicht lesbar.
Error: (01/10/2014 11:29:35 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1020SUS20ClientDataStore:
Error: (01/10/2014 11:29:35 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1020SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edbres00002.jrs-1022 (0xfffffc02)1393 (0x00000571)Die Datenträgerstruktur ist beschädigt und nicht lesbar.
Error: (01/10/2014 11:29:35 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1020SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edbres00002.jrs-1022 (0xfffffc02)1393 (0x00000571)Die Datenträgerstruktur ist beschädigt und nicht lesbar.
Error: (01/10/2014 11:29:35 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1020SUS20ClientDataStore:
Error: (01/10/2014 11:29:35 AM) (Source: ESENT)(User: )
Description: wuaueng.dll1020SUS20ClientDataStore: C:\Windows\SoftwareDistribution\DataStore\Logs\edbres00002.jrs-1022 (0xfffffc02)1393 (0x00000571)Die Datenträgerstruktur ist beschädigt und nicht lesbar.
Error: (01/10/2014 11:25:11 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben. (HRESULT : 0x80070660) (0x80070660)
Error: (01/10/2014 11:23:24 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben. (HRESULT : 0x80070660) (0x80070660)
Error: (01/10/2014 11:20:31 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben. (HRESULT : 0x80070660) (0x80070660)
Error: (01/10/2014 11:17:38 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der temporäre Ordner befindet sich auf einem Laufwerk, das entweder voll ist, oder es ist kein Zugriff darauf möglich. Geben Sie zusätzlichen Speicherplatz auf dem Laufwerk frei, oder stellen Sie sicher, dass Sie Schreibzugriff auf den temporären Ordner haben. (HRESULT : 0x80070660) (0x80070660)
==================== Memory info ===========================
Percentage of memory in use: 49%
Total physical RAM: 3766.71 MB
Available physical RAM: 1885.54 MB
Total Pagefile: 7531.59 MB
Available Pagefile: 5284.04 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:93.13 GB) (Free:35.37 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 3534313F)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=93 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=360 GB) - (Type=05)
==================== End Of Log ============================
Habt ihr mir noch weitere Tipps? Das Problem ist zwar gelöst, sollte ich jetzt noch weitere Schritte unternehmen? MfG Samuel |
|
11.01.2014, 12:58
| #6 | |
| /// the machine /// TB-Ausbilder | Ich kann keine dateien herrunterladen. Da is noch Arbeit  Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ --> Ich kann keine dateien herrunterladen. |
|
13.01.2014, 18:18
| #7 |
| | Ich kann keine dateien herrunterladen. Das ist ja spannend. Vielen dank für dein Einsatz! Hier die Logdatei (Anhang)  |
|
14.01.2014, 10:11
| #8 |
| /// the machine /// TB-Ausbilder | Ich kann keine dateien herrunterladen. Hi, Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.01.2014, 14:54
| #9 |
| | Ich kann keine dateien herrunterladen. Malwarebytes Anti-Malware Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.14.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 expert :: SAMY [Administrator] Schutz: Aktiviert 14.01.2014 08:10:05 mbam-log-2014-01-14 (08-10-05).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 266562 Laufzeit: 5 Minute(n), 46 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\$Recycle.Bin\S-1-5-21-2975014363-2867879005-296608908-1002\$RAHXK0C.exe (PUP.BundleInstaller.DW) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$Recycle.Bin\S-1-5-21-2975014363-2867879005-296608908-1002\$RBDHZ6D.exe (PUP.BundleInstaller.DW) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\expert\Documents\DTLite4413-0173.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.017 - Bericht erstellt am 14/01/2014 um 09:44:39
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : expert - SAMY
# Gestartet von : C:\Users\expert\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [17216 octets] - [10/01/2014 11:47:15]
AdwCleaner[R1].txt - [1040 octets] - [14/01/2014 09:00:01]
AdwCleaner[R2].txt - [1101 octets] - [14/01/2014 09:22:32]
AdwCleaner[S0].txt - [16778 octets] - [10/01/2014 11:48:19]
AdwCleaner[S1].txt - [1023 octets] - [14/01/2014 09:44:39]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1083 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by expert on 14.01.2014 at 9:56:31,43
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\Users\expert\appdata\local\cre"
~~~ FireFox
Emptied folder: C:\Users\expert\AppData\Roaming\mozilla\firefox\profiles\7o5nj0mn.default\minidumps [87 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.01.2014 at 10:14:18,69
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-01-2014 02
Ran by expert (administrator) on SAMY on 14-01-2014 10:52:49
Running from C:\Users\expert\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Salfeld Computer) C:\Windows\tray\wintmr.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Dropbox, Inc.) C:\Users\expert\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Salfeld Computer) C:\Windows\SysWOW64\cchservice.exe
(Salfeld Computer) C:\Windows\SysWOW64\cc32\webtmr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-04-13] (ELAN Microelectronic Corp.)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)
HKLM-x32\...\Run: [ChicoSys] - C:\Windows\SysWOW64\cc32\webtmr.exe [5516696 2009-07-14] (Salfeld Computer)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [CCWinTray] - C:\Windows\tray\wintmr.exe [5502872 2009-07-14] (Salfeld Computer)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Policies\system: [DisableClock] 0
HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
HKU\Gast\...\Run: [TomTomHOME.exe] - "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
HKU\Gast\...\Run: [Google Update] - C:\Users\expert\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-04-29] (Google Inc.)
HKU\Gast\...\Run: [CCWinTray] - C:\Windows\tray\wintmr.exe [5502872 2009-07-14] (Salfeld Computer)
HKU\Gast\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKU\Gast\...\Run: [ares] - "C:\Program Files (x86)\Ares\Ares.exe" -h
HKU\Gast\...\Run: [SearchProtect] - C:\Users\Gast\AppData\Roaming\SearchProtect\bin\cltmng.exe
HKU\Gast\...\Run: [BackgroundContainer] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\expert\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION
HKU\Gast\...\Policies\system: [DisableClock] 1
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [111720 2010-10-28] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [100456 2010-10-28] (NVIDIA Corporation)
Startup: C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\expert\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKLM-x32 - (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\expert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\expert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-07-13]
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\gcswf32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Chrome NaCl) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Google Gears 0.5.33.0) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\gears.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.131.2_0\McChPlg.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Windows Live? Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\expert\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Google Wallet) - C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0 [2013-12-21]
CHR HKCU\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\expert\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx [2013-12-21]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-01-12]
CHR HKLM-x32\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\expert\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx [2013-01-12]
CHR StartMenuInternet: Google Chrome - C:\Users\expert\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S2 ksupmgr; C:\Windows\SysWOW64\ksupmgr.exe [762520 2010-07-28] (Salfeld Computer)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 SjtWinIo; C:\Windows\System32\DRIVERS\SjtWinIo.sys [9216 2009-01-01] (SpeedJet Technology INC.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S2 hardlock; \??\C:\Windows\system32\drivers\hardlock.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [x]
S3 k57nd60a; system32\DRIVERS\k57nd60a.sys [x]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-14 10:52 - 2014-01-14 10:52 - 00012881 _____ C:\Users\expert\Downloads\FRST.txt
2014-01-14 10:14 - 2014-01-14 10:14 - 00000882 _____ C:\Users\expert\Desktop\JRT.txt
2014-01-14 09:57 - 2014-01-14 09:57 - 02075648 _____ (Farbar) C:\Users\expert\Downloads\FRST64.exe
2014-01-14 09:56 - 2014-01-14 09:56 - 00000000 ____D C:\Windows\ERUNT
2014-01-14 09:22 - 2014-01-14 09:23 - 01037068 _____ (Thisisu) C:\Users\expert\Downloads\JRT.exe
2014-01-14 08:59 - 2014-01-14 08:59 - 01236282 _____ C:\Users\expert\Downloads\adwcleaner.exe
2014-01-14 07:14 - 2014-01-14 07:14 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\Users\expert\AppData\Roaming\Malwarebytes
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-14 07:14 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-14 07:12 - 2014-01-14 07:14 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\expert\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-13 17:24 - 2014-01-13 17:24 - 00023119 _____ C:\ComboFix.txt
2014-01-13 17:00 - 2014-01-13 17:24 - 00000000 ____D C:\Qoobox
2014-01-13 17:00 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-13 17:00 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-13 17:00 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-13 17:00 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-13 17:00 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-13 17:00 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-13 17:00 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-13 17:00 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-13 16:59 - 2014-01-13 17:21 - 00000000 ____D C:\Windows\erdnt
2014-01-13 15:14 - 2014-01-14 09:53 - 00000100 _____ C:\Windows\SysWOW64\SWCTL.DLL
2014-01-10 15:34 - 2014-01-10 15:34 - 01233962 _____ C:\Users\adwcleaner.exe
2014-01-10 14:24 - 2014-01-10 14:24 - 01932166 _____ (Farbar) C:\Users\FRST64.exe
2014-01-10 11:47 - 2014-01-14 09:44 - 00000000 ____D C:\AdwCleaner
2014-01-10 10:27 - 2014-01-10 11:56 - 00000000 ____D C:\FRST
2013-12-25 16:46 - 2013-12-25 16:46 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Users\expert\AppData\Roaming\SmartFTP
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Program Files\SmartFTP Client
2013-12-25 14:42 - 2013-12-25 14:42 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP Client 5.0 Setup
2013-12-25 14:36 - 2013-12-25 14:36 - 00003164 _____ C:\Windows\System32\Tasks\{25906794-6631-4804-BD9A-9412412C3232}
2013-12-16 19:20 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-16 19:20 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-16 19:20 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-16 19:20 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-16 19:20 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-16 19:20 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-16 19:20 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-16 19:20 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-16 19:20 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-16 19:20 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-16 19:20 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-16 19:20 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-16 19:20 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-16 19:20 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-16 19:20 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-16 19:20 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-16 19:20 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-16 19:20 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-16 19:20 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-16 19:20 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-16 19:20 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-16 19:20 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-16 19:20 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-16 19:20 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-16 19:20 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-16 19:20 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-16 19:20 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-16 19:20 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-16 19:20 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-16 19:20 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-16 19:20 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
==================== One Month Modified Files and Folders =======
2014-01-14 10:53 - 2014-01-14 10:52 - 00012881 _____ C:\Users\expert\Downloads\FRST.txt
2014-01-14 10:53 - 2012-12-26 18:35 - 00000000 ____D C:\Users\expert\AppData\Roaming\Skype
2014-01-14 10:33 - 2010-11-21 06:42 - 02094227 _____ C:\Windows\WindowsUpdate.log
2014-01-14 10:24 - 2011-04-29 14:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2975014363-2867879005-296608908-1002UA.job
2014-01-14 10:14 - 2014-01-14 10:14 - 00000882 _____ C:\Users\expert\Desktop\JRT.txt
2014-01-14 10:00 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-14 10:00 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-14 09:58 - 2012-12-26 18:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-14 09:57 - 2014-01-14 09:57 - 02075648 _____ (Farbar) C:\Users\expert\Downloads\FRST64.exe
2014-01-14 09:56 - 2014-01-14 09:56 - 00000000 ____D C:\Windows\ERUNT
2014-01-14 09:53 - 2014-01-13 15:14 - 00000100 _____ C:\Windows\SysWOW64\SWCTL.DLL
2014-01-14 09:53 - 2013-12-06 14:39 - 00000000 ___RD C:\Users\expert\Dropbox
2014-01-14 09:53 - 2013-12-06 14:38 - 00000000 ____D C:\Users\expert\AppData\Roaming\Dropbox
2014-01-14 09:52 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-14 09:52 - 2009-07-14 05:51 - 00078928 _____ C:\Windows\setupact.log
2014-01-14 09:44 - 2014-01-10 11:47 - 00000000 ____D C:\AdwCleaner
2014-01-14 09:23 - 2014-01-14 09:22 - 01037068 _____ (Thisisu) C:\Users\expert\Downloads\JRT.exe
2014-01-14 08:59 - 2014-01-14 08:59 - 01236282 _____ C:\Users\expert\Downloads\adwcleaner.exe
2014-01-14 08:56 - 2010-11-21 06:39 - 00035408 _____ C:\Windows\PFRO.log
2014-01-14 07:14 - 2014-01-14 07:14 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\Users\expert\AppData\Roaming\Malwarebytes
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-14 07:14 - 2014-01-14 07:12 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\expert\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-13 18:52 - 2011-05-30 10:57 - 00003151 _____ C:\NET.INI
2014-01-13 17:24 - 2014-01-13 17:24 - 00023119 _____ C:\ComboFix.txt
2014-01-13 17:24 - 2014-01-13 17:00 - 00000000 ____D C:\Qoobox
2014-01-13 17:21 - 2014-01-13 16:59 - 00000000 ____D C:\Windows\erdnt
2014-01-13 17:13 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-10 15:34 - 2014-01-10 15:34 - 01233962 _____ C:\Users\adwcleaner.exe
2014-01-10 14:24 - 2014-01-10 14:24 - 01932166 _____ (Farbar) C:\Users\FRST64.exe
2014-01-10 12:04 - 2013-04-14 14:18 - 00000000 ____D C:\Program Files (x86)\e-Sword
2014-01-10 11:56 - 2014-01-10 10:27 - 00000000 ____D C:\FRST
2014-01-02 12:47 - 2012-12-26 18:04 - 00011270 _____ C:\Windows\SysWOW64\cchservice.err
2013-12-29 15:47 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-26 16:28 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-25 16:46 - 2013-12-25 16:46 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Users\expert\AppData\Roaming\SmartFTP
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Program Files\SmartFTP Client
2013-12-25 14:42 - 2013-12-25 14:42 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP Client 5.0 Setup
2013-12-25 14:38 - 2011-03-05 19:46 - 00000000 ____D C:\Users\expert\AppData\Local\VirtualStore
2013-12-25 14:36 - 2013-12-25 14:36 - 00003164 _____ C:\Windows\System32\Tasks\{25906794-6631-4804-BD9A-9412412C3232}
2013-12-21 15:53 - 2010-08-30 10:24 - 00000000 ____D C:\Program Files (x86)\EgisTec MyWinLocker
2013-12-20 16:35 - 2010-08-30 10:12 - 00000000 ____D C:\Program Files (x86)\Acer GameZone
2013-12-20 16:34 - 2011-09-11 01:16 - 00000000 ____D C:\ProgramData\Firefly Studios
2013-12-20 16:34 - 2010-08-30 10:03 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-20 16:32 - 2013-02-07 07:47 - 00000000 ____D C:\Program Files (x86)\Winamp
2013-12-20 16:32 - 2010-08-30 10:21 - 00000000 ____D C:\Program Files (x86)\Acer
2013-12-20 16:29 - 2011-06-15 20:49 - 00000000 ____D C:\Users\Gast
2013-12-20 16:29 - 2010-11-21 06:43 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-12-20 16:28 - 2013-04-12 16:19 - 00000000 ____D C:\Program Files (x86)\phase5
2013-12-20 16:27 - 2010-08-30 10:24 - 00000000 ____D C:\ProgramData\EgisTec IPS
2013-12-19 08:41 - 2013-09-11 05:33 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-19 08:41 - 2013-09-11 05:31 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-19 08:41 - 2013-09-11 05:31 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-19 08:37 - 2013-12-06 14:38 - 00000000 ____D C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-19 08:37 - 2011-03-05 19:46 - 00000000 ___RD C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-16 19:20 - 2013-08-18 13:34 - 00000000 ____D C:\Windows\system32\MRT
2013-12-16 15:17 - 2011-05-30 21:33 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\expert\AppData\Local\Temp\avgnt.exe
C:\Users\expert\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-31 13:31
==================== End Of Log ============================
--- --- --- --- --- --- Und was sagt der Doktor? Hab grad noch an meinem systemstart etwas herrumgebastelt und entdeckt das ein programm namens mwlDaemon installiert ist. Was ist das? das klingt doch auch nicht grad sehr gut an?! |
|
15.01.2014, 09:39
| #10 | |
| /// the machine /// TB-Ausbilder | Ich kann keine dateien herrunterladen.Zitat:
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\Gast\...\Run: [SearchProtect] - C:\Users\Gast\AppData\Roaming\SearchProtect\bin\cltmng.exe
HKU\Gast\...\Run: [BackgroundContainer] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\expert\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION
C:\Users\Gast\AppData\Roaming\SearchProtect
C:\Users\expert\AppData\Local\Conduit
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.01.2014, 18:43
| #11 |
| | Ich kann keine dateien herrunterladen.Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-01-2014 03
Ran by expert at 2014-01-16 12:34:43 Run:1
Running from C:\Users\expert\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\Gast\...\Run: [SearchProtect] - C:\Users\Gast\AppData\Roaming\SearchProtect\bin\cltmng.exe
HKU\Gast\...\Run: [BackgroundContainer] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\expert\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION
C:\Users\Gast\AppData\Roaming\SearchProtect
C:\Users\expert\AppData\Local\Conduit
*****************
HKU\Gast\Software\Microsoft\Windows\CurrentVersion\Run\\SearchProtect => Value deleted successfully.
HKU\Gast\Software\Microsoft\Windows\CurrentVersion\Run\\BackgroundContainer => Value deleted successfully.
"C:\Users\Gast\AppData\Roaming\SearchProtect" => File/Directory not found.
"C:\Users\expert\AppData\Local\Conduit" => File/Directory not found.
==== End of Fixlog ====
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=35b606f45ee9fa4aa116838176b87e08
# engine=16679
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-16 01:07:02
# local_time=2014-01-16 02:07:02 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16774142 0 5 5313 2442753 0 0
# compatibility_mode=5893 16776573 100 94 65142 141507472 0 0
# scanned=180840
# found=0
# cleaned=0
# scan_time=4215
Code:
ATTFilter Results of screen317's Security Check version 0.99.78 Windows 7 Service Pack 1 x64 Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 11.9.900.170 Mozilla Firefox (26.0) Google Chrome 31.0.1650.63 Google Chrome 32.0.1700.76 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2014 03
Ran by expert (administrator) on SAMY on 16-01-2014 14:42:08
Running from C:\Users\expert\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Salfeld Computer) C:\Windows\SysWOW64\cchservice.exe
(Salfeld Computer) C:\Windows\SysWOW64\cc32\webtmr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Salfeld Computer) C:\Windows\tray\wintmr.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
==================== Registry (Whitelisted) ==================
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)
HKLM-x32\...\Run: [ChicoSys] - C:\Windows\SysWOW64\cc32\webtmr.exe [5516696 2009-07-14] (Salfeld Computer)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [CCWinTray] - C:\Windows\tray\wintmr.exe [5502872 2009-07-14] (Salfeld Computer)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Policies\system: [DisableClock] 0
HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
HKU\Gast\...\Run: [TomTomHOME.exe] - "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
HKU\Gast\...\Run: [Google Update] - C:\Users\expert\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-04-29] (Google Inc.)
HKU\Gast\...\Run: [CCWinTray] - C:\Windows\tray\wintmr.exe [5502872 2009-07-14] (Salfeld Computer)
HKU\Gast\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKU\Gast\...\Run: [ares] - "C:\Program Files (x86)\Ares\Ares.exe" -h
HKU\Gast\...\Policies\system: [DisableClock] 1
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [111720 2010-10-28] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [100456 2010-10-28] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKLM-x32 - (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\expert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\expert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\7o5nj0mn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-07-13]
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\gcswf32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Chrome NaCl) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Google Gears 0.5.33.0) - C:\Users\expert\AppData\Local\Google\Chrome\Application\31.0.1650.63\gears.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.131.2_0\McChPlg.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Windows Live? Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\expert\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Google Wallet) - C:\Users\expert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0 [2013-12-21]
CHR HKCU\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\expert\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx [2013-12-21]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-01-12]
CHR HKLM-x32\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\expert\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx [2013-01-12]
CHR StartMenuInternet: Google Chrome - C:\Users\expert\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
S2 ksupmgr; C:\Windows\SysWOW64\ksupmgr.exe [762520 2010-07-28] (Salfeld Computer)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
==================== Drivers (Whitelisted) ====================
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 SjtWinIo; C:\Windows\System32\DRIVERS\SjtWinIo.sys [9216 2009-01-01] (SpeedJet Technology INC.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R4 avkmgr; system32\DRIVERS\avkmgr.sys [x]
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S2 hardlock; \??\C:\Windows\system32\drivers\hardlock.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [x]
S3 k57nd60a; system32\DRIVERS\k57nd60a.sys [x]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-16 14:42 - 2014-01-16 14:42 - 00011253 _____ C:\Users\expert\Desktop\FRST.txt
2014-01-16 14:33 - 2014-01-16 14:34 - 00987410 _____ C:\Users\expert\Downloads\SecurityCheck.exe
2014-01-16 12:39 - 2014-01-16 12:40 - 02347384 _____ (ESET) C:\Users\expert\Downloads\esetsmartinstaller_enu.exe
2014-01-16 12:38 - 2014-01-16 12:38 - 00000000 _____ C:\ProgramData\rebootpending.txt
2014-01-16 12:34 - 2014-01-16 12:34 - 00000000 ____D C:\Users\expert\Desktop\FRST-OlderVersion
2014-01-14 16:42 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-14 16:42 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-14 16:42 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-14 16:42 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-14 16:42 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-14 16:42 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-14 16:42 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-14 16:42 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-14 16:42 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 14:57 - 2014-01-14 14:57 - 00572789 _____ C:\Users\expert\Downloads\ImageshopCart_1758991.zip
2014-01-14 10:55 - 2014-01-14 10:55 - 00000000 ____D C:\Windows\pss
2014-01-14 10:52 - 2014-01-14 10:53 - 00025977 _____ C:\Users\expert\Downloads\FRST.txt
2014-01-14 09:57 - 2014-01-16 12:34 - 02076160 _____ (Farbar) C:\Users\expert\Desktop\FRST64.exe
2014-01-14 09:56 - 2014-01-14 09:56 - 00000000 ____D C:\Windows\ERUNT
2014-01-14 09:22 - 2014-01-14 09:23 - 01037068 _____ (Thisisu) C:\Users\expert\Downloads\JRT.exe
2014-01-14 08:59 - 2014-01-14 08:59 - 01236282 _____ C:\Users\expert\Downloads\adwcleaner.exe
2014-01-14 07:14 - 2014-01-14 07:14 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\Users\expert\AppData\Roaming\Malwarebytes
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-14 07:14 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-14 07:12 - 2014-01-14 07:14 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\expert\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-13 17:24 - 2014-01-13 17:24 - 00023119 _____ C:\ComboFix.txt
2014-01-13 17:00 - 2014-01-13 17:24 - 00000000 ____D C:\Qoobox
2014-01-13 17:00 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-13 17:00 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-13 17:00 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-13 17:00 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-13 17:00 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-13 17:00 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-13 17:00 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-13 17:00 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-13 16:59 - 2014-01-13 17:21 - 00000000 ____D C:\Windows\erdnt
2014-01-13 15:14 - 2014-01-15 19:06 - 00000100 _____ C:\Windows\SysWOW64\SWCTL.DLL
2014-01-10 15:34 - 2014-01-10 15:34 - 01233962 _____ C:\Users\adwcleaner.exe
2014-01-10 14:24 - 2014-01-10 14:24 - 01932166 _____ (Farbar) C:\Users\FRST64.exe
2014-01-10 11:47 - 2014-01-14 09:44 - 00000000 ____D C:\AdwCleaner
2014-01-10 10:27 - 2014-01-16 12:34 - 00000000 ____D C:\FRST
2013-12-25 16:46 - 2013-12-25 16:46 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Users\expert\AppData\Roaming\SmartFTP
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Program Files\SmartFTP Client
2013-12-25 14:42 - 2013-12-25 14:42 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP Client 5.0 Setup
2013-12-25 14:36 - 2013-12-25 14:36 - 00003164 _____ C:\Windows\System32\Tasks\{25906794-6631-4804-BD9A-9412412C3232}
==================== One Month Modified Files and Folders =======
2014-01-16 14:42 - 2014-01-16 14:42 - 00011253 _____ C:\Users\expert\Desktop\FRST.txt
2014-01-16 14:34 - 2014-01-16 14:33 - 00987410 _____ C:\Users\expert\Downloads\SecurityCheck.exe
2014-01-16 14:24 - 2011-04-29 14:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2975014363-2867879005-296608908-1002UA.job
2014-01-16 14:03 - 2010-11-21 06:42 - 01559707 _____ C:\Windows\WindowsUpdate.log
2014-01-16 13:59 - 2012-12-26 18:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-16 12:40 - 2014-01-16 12:39 - 02347384 _____ (ESET) C:\Users\expert\Downloads\esetsmartinstaller_enu.exe
2014-01-16 12:38 - 2014-01-16 12:38 - 00000000 _____ C:\ProgramData\rebootpending.txt
2014-01-16 12:38 - 2013-09-11 05:31 - 00000000 ____D C:\ProgramData\Avira
2014-01-16 12:34 - 2014-01-16 12:34 - 00000000 ____D C:\Users\expert\Desktop\FRST-OlderVersion
2014-01-16 12:34 - 2014-01-14 09:57 - 02076160 _____ (Farbar) C:\Users\expert\Desktop\FRST64.exe
2014-01-16 12:34 - 2014-01-10 10:27 - 00000000 ____D C:\FRST
2014-01-16 08:33 - 2011-04-29 14:41 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2975014363-2867879005-296608908-1002Core.job
2014-01-16 08:32 - 2013-08-18 13:34 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 08:32 - 2011-05-30 21:33 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 19:28 - 2013-05-20 00:18 - 00002361 _____ C:\Users\expert\Desktop\Google Chrome.lnk
2014-01-15 19:20 - 2012-12-26 18:35 - 00000000 ____D C:\Users\expert\AppData\Roaming\Skype
2014-01-15 19:12 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-15 19:12 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-15 19:08 - 2012-12-26 18:04 - 00011456 _____ C:\Windows\SysWOW64\cchservice.err
2014-01-15 19:06 - 2014-01-13 15:14 - 00000100 _____ C:\Windows\SysWOW64\SWCTL.DLL
2014-01-15 19:06 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2014-01-15 19:04 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-15 19:04 - 2009-07-14 05:51 - 00079152 _____ C:\Windows\setupact.log
2014-01-15 19:04 - 2009-07-14 05:45 - 00344120 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-14 14:57 - 2014-01-14 14:57 - 00572789 _____ C:\Users\expert\Downloads\ImageshopCart_1758991.zip
2014-01-14 10:55 - 2014-01-14 10:55 - 00000000 ____D C:\Windows\pss
2014-01-14 10:55 - 2011-03-05 19:46 - 00000000 ___RD C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-14 10:53 - 2014-01-14 10:52 - 00025977 _____ C:\Users\expert\Downloads\FRST.txt
2014-01-14 09:56 - 2014-01-14 09:56 - 00000000 ____D C:\Windows\ERUNT
2014-01-14 09:53 - 2013-12-06 14:39 - 00000000 ___RD C:\Users\expert\Dropbox
2014-01-14 09:53 - 2013-12-06 14:38 - 00000000 ____D C:\Users\expert\AppData\Roaming\Dropbox
2014-01-14 09:44 - 2014-01-10 11:47 - 00000000 ____D C:\AdwCleaner
2014-01-14 09:23 - 2014-01-14 09:22 - 01037068 _____ (Thisisu) C:\Users\expert\Downloads\JRT.exe
2014-01-14 08:59 - 2014-01-14 08:59 - 01236282 _____ C:\Users\expert\Downloads\adwcleaner.exe
2014-01-14 08:56 - 2010-11-21 06:39 - 00035408 _____ C:\Windows\PFRO.log
2014-01-14 07:14 - 2014-01-14 07:14 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\Users\expert\AppData\Roaming\Malwarebytes
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-14 07:14 - 2014-01-14 07:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-14 07:14 - 2014-01-14 07:12 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\expert\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-13 18:52 - 2011-05-30 10:57 - 00003151 _____ C:\NET.INI
2014-01-13 17:24 - 2014-01-13 17:24 - 00023119 _____ C:\ComboFix.txt
2014-01-13 17:24 - 2014-01-13 17:00 - 00000000 ____D C:\Qoobox
2014-01-13 17:21 - 2014-01-13 16:59 - 00000000 ____D C:\Windows\erdnt
2014-01-13 17:13 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-10 15:34 - 2014-01-10 15:34 - 01233962 _____ C:\Users\adwcleaner.exe
2014-01-10 14:24 - 2014-01-10 14:24 - 01932166 _____ (Farbar) C:\Users\FRST64.exe
2014-01-10 12:04 - 2013-04-14 14:18 - 00000000 ____D C:\Program Files (x86)\e-Sword
2013-12-29 15:47 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-26 16:28 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-25 16:46 - 2013-12-25 16:46 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Users\expert\AppData\Roaming\SmartFTP
2013-12-25 14:43 - 2013-12-25 14:43 - 00000000 ____D C:\Program Files\SmartFTP Client
2013-12-25 14:42 - 2013-12-25 14:42 - 00000000 ____D C:\Users\expert\AppData\Local\SmartFTP Client 5.0 Setup
2013-12-25 14:38 - 2011-03-05 19:46 - 00000000 ____D C:\Users\expert\AppData\Local\VirtualStore
2013-12-25 14:36 - 2013-12-25 14:36 - 00003164 _____ C:\Windows\System32\Tasks\{25906794-6631-4804-BD9A-9412412C3232}
2013-12-21 15:53 - 2010-08-30 10:24 - 00000000 ____D C:\Program Files (x86)\EgisTec MyWinLocker
2013-12-20 16:35 - 2010-08-30 10:12 - 00000000 ____D C:\Program Files (x86)\Acer GameZone
2013-12-20 16:34 - 2011-09-11 01:16 - 00000000 ____D C:\ProgramData\Firefly Studios
2013-12-20 16:34 - 2010-08-30 10:03 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-20 16:32 - 2013-02-07 07:47 - 00000000 ____D C:\Program Files (x86)\Winamp
2013-12-20 16:32 - 2010-08-30 10:21 - 00000000 ____D C:\Program Files (x86)\Acer
2013-12-20 16:29 - 2011-06-15 20:49 - 00000000 ____D C:\Users\Gast
2013-12-20 16:29 - 2010-11-21 06:43 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-12-20 16:28 - 2013-04-12 16:19 - 00000000 ____D C:\Program Files (x86)\phase5
2013-12-20 16:27 - 2010-08-30 10:24 - 00000000 ____D C:\ProgramData\EgisTec IPS
2013-12-19 08:37 - 2013-12-06 14:38 - 00000000 ____D C:\Users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
Some content of TEMP:
====================
C:\Users\expert\AppData\Local\Temp\avgnt.exe
C:\Users\expert\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-31 13:31
==================== End Of Log ============================
--- --- --- Läuft einwandfrei! Du hast das echt drauf, amigo! |
|
17.01.2014, 12:59
| #12 |
| /// the machine /// TB-Ausbilder | Ich kann keine dateien herrunterladen. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.01.2014, 01:54
| #13 |
| | Ich kann keine dateien herrunterladen. Ok soweit von mir alles erledigt. Vielen Dank! Noch zwei Fragen: MalwareBytes Anti Malware arbeitet anscheinend nicht mit Antivir. Stimmt das? Ein Windows Update funktioniert nicht richtig. Es will herrunter geladen werden, aber es geht nicht. Woran kann das liegen? Gruß samuel |
|
18.01.2014, 17:03
| #14 | ||
| /// the machine /// TB-Ausbilder | Ich kann keine dateien herrunterladen.Zitat:
Zitat:
 Welches? KB Nummer? welcher Fehlercode?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Ich kann keine dateien herrunterladen. |
| ahnung, andere, anderen, antivir, avira, dateien, download, film, filme, firefox, gucken, home, kein update, movie, nichts, nutze, partition, premium, problem, programme, troja, ubuntu, update, vermutung, vorgeschichte |
Linear-Darstellung
