| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7: E-Mail Adresse war betroffen / Verdacht auf MalwareWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.01.2014, 22:47
| #1 |
 |  Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware Sehr geehrtes Trojaner-Board Team, wie auch das vieler anderer wurde auch mein E-Mail Konto von www.sicherheitstest.bsi.de positiv getestet. Zudem hat jemand in den letzten Tagen bei meiner Bank angerufen ( mit sämtlichen persönlichen Daten, Kontonr. usw. ) und wollte etwas von meinem Konto überweisen. Deshalb möchte ich gerne sicher gehen und meinen PC mit Ihrer Hilfe auf Herz und Nieren durchchecken. Ich habe vorab mal die 4 Schritte für alle Hilfesuchenden abgearbeitet. Hier die Logs: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:09 on 24/01/2014 (Robert)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2014
Ran by Robert (administrator) on ROBERT-PC on 24-01-2014 20:27:25
Running from C:\Users\Robert\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Gainward Co.) C:\Program Files (x86)\EXPERTool\TBPANEL.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\SetPoint\SetPoint.exe
() C:\Program Files (x86)\ASUS\TurboV\TurboV.exe
(Logitech(c)) C:\Program Files (x86)\Logitech\G35\G35.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
() C:\Program Files (x86)\Logitech\SetPoint\x86\SetPoint32.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\tv_w32.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\tv_x64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\wmi64.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-08-20] (Analog Devices, Inc.)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [TurboV] - C:\Program Files (x86)\ASUS\TurboV\TurboV.exe [4040192 2008-10-21] ()
HKLM-x32\...\Run: [Logitech G35] - C:\Program Files (x86)\Logitech\G35\G35.exe [1811728 2009-06-30] (Logitech(c))
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2008-04-15] (Analog Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1644680 2013-02-08] (Ask)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-03-28] (DivX, LLC)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logitech\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [GAINWARD] - C:\Program Files (x86)\EXPERTool\TBPanel.exe [2181672 2009-05-12] (Gainward Co.)
HKCU\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-08-20] (Analog Devices, Inc.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
MountPoints2: {192e93a7-4fc1-11e0-8c22-00248c9fd597} - F:\LaunchU3.exe -a
IFEO: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1CF3E2E5C76FCA01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - DefaultScope {7DDC945D-68E7-480A-B922-594CD4878A41} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {7DDC945D-68E7-480A-B922-594CD4878A41} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {9213EACE-9E17-47A0-9C80-CD242746D912} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=588E267A-CBB7-48D0-BCE0-056EEA6E076C&apn_sauid=8948AD11-A5CB-4A78-95AD-B29C308810D0
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://isearch.avg.com/search?cid={2D9D9775-C2BD-4E15-8099-A602BFC047A0}&mid=ca395b9b148047d1a60dd1b647e4e9f2-c62222099914541bc2a95e063d81af64193236db&lang=de&ds=tt014&pr=sa&d=2011-12-18 15:04:29&v=12.2.5.32&sap=dsp&q={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Windows\SysWOW64\PrxerNsp.dll [56424] ()
Winsock: Catalog9 09 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 10 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 11 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 12 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 24 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog5-x64 07 %SystemRoot%\system32\PrxerNsp.dll [57448] ()
Winsock: Catalog9-x64 09 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 10 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 11 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 12 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 24 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default
FF user.js: detected! => C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\user.js
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://google.de/
FF NetworkProxy: "backup.ftp", "58.20.127.100"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "58.20.127.100"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "58.20.127.100"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "80.193.214.239"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "80.193.214.239"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "80.193.214.239"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "80.193.214.239"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 1
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 - C:\Users\Robert\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1002170-0-npoctoshape.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Robert\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)
FF SearchPlugin: C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Ask Toolbar - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\toolbar@ask.com [2013-10-30]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Adblock Plus - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-04]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2011-01-20]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2011-01-20]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-10-27]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-01]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-19]
Chrome:
=======
CHR HomePage:
CHR DefaultSearchKeyword: google.de_
CHR DefaultSearchURL: hxxp://www.google.de/search?q={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Free Studio) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\np_dvs_plugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (ijji Web Launching Plugin for FF) - C:\Program Files (x86)\Mozilla Firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
CHR Plugin: (Octoshape Streaming Services) - C:\Users\Robert\AppData\Roaming\Mozilla\plugins\npoctoshape.dll (Octoshape ApS)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Google Update) - C:\Users\Robert\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (ProxTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-01-19]
CHR Extension: (Google Drive) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-09-16]
CHR Extension: (Brushed) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg [2013-03-27]
CHR Extension: (YouTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-09-16]
CHR Extension: (Google-Suche) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-09-16]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2012-09-16]
CHR Extension: (AdBlock) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-09-16]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2013-01-21]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-01-19]
CHR Extension: (Virtuelle Tastatur) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2012-09-16]
CHR Extension: (FVD Downloader) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2012-11-04]
CHR Extension: (Google Wallet) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-09-16]
CHR Extension: (NotScripts) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2012-09-29]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2012-11-01]
CHR Extension: (Google Mail) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-09-16]
CHR Extension: (Anti-Banner) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2012-09-16]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Robert\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx [2012-09-15]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896056 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [86016 2008-08-15] ()
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
S4 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [678416 2012-11-14] ()
S3 LBTServ; C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe [160784 2009-07-20] (Logitech, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-01] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
R2 TeamViewer8; E:\Programme\Teamviewer\TeamViewer_Service.exe [5087584 2013-10-01] (TeamViewer GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2409272 2013-12-10] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)
S3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2009-12-03] (Turtle Entertainment GmbH)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [160784 2012-11-14] (<Turtle Entertainment>)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-19] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620640 2014-01-19] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-01-19] (Kaspersky Lab ZAO)
R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [61712 2009-05-28] (Logitech)
R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [376848 2009-05-28] (Logitech)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15680 2006-11-01] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [47632 2009-10-20] (CACE Technologies, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-08-28] (TuneUp Software)
S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [20480 2010-08-24] (Motorola)
S3 VaneFltr; C:\Windows\System32\drivers\Lachesis.sys [30336 2007-08-17] (Razer (Asia-Pacific) Pte Ltd)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-24 20:17 - 2014-01-24 20:17 - 00044110 _____ C:\Users\Robert\Desktop\Addition.txt
2014-01-24 20:16 - 2014-01-24 20:28 - 00034673 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:11 - 2014-01-24 20:11 - 02077696 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-24 20:09 - 2014-01-24 20:16 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-21 21:57 - 2014-01-21 22:15 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:51 - 2014-01-19 22:36 - 00000000 ____D C:\Profi cash
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:19 - 2014-01-19 17:18 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-24 20:25 - 00422572 _____ C:\Windows\setupact.log
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-24 19:36 - 00007240 _____ C:\Windows\PFRO.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:55 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 07:54 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-18 07:54 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-18 07:54 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-15 16:22 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 16:22 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 16:22 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18310112 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
==================== One Month Modified Files and Folders =======
2014-01-24 20:28 - 2014-01-24 20:16 - 00034673 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-24 20:28 - 2009-12-11 17:22 - 01864262 _____ C:\Windows\WindowsUpdate.log
2014-01-24 20:26 - 2013-04-08 10:59 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-24 20:25 - 2014-01-18 15:26 - 00422572 _____ C:\Windows\setupact.log
2014-01-24 20:25 - 2012-11-24 16:45 - 00000000 ____D C:\ProgramData\VMware
2014-01-24 20:25 - 2009-08-13 22:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-24 20:25 - 2009-08-05 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-24 20:25 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-24 20:17 - 2014-01-24 20:17 - 00044110 _____ C:\Users\Robert\Desktop\Addition.txt
2014-01-24 20:16 - 2014-01-24 20:09 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-24 20:15 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-24 20:15 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:11 - 2014-01-24 20:11 - 02077696 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-24 20:09 - 2009-12-11 17:03 - 00000000 ____D C:\Users\Robert
2014-01-24 20:08 - 2011-06-27 16:17 - 00000000 ____D C:\Users\Robert\AppData\Local\PMB Files
2014-01-24 19:51 - 2012-09-16 13:47 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job
2014-01-24 19:45 - 2010-03-07 03:07 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{17212944-8BF8-4509-BFF6-0D177AC05DDE}
2014-01-24 19:36 - 2014-01-18 15:25 - 00007240 _____ C:\Windows\PFRO.log
2014-01-24 00:51 - 2012-09-16 13:47 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job
2014-01-23 23:48 - 2012-10-03 00:08 - 00000000 ____D C:\Users\Robert\AppData\Roaming\vlc
2014-01-23 07:44 - 2011-03-31 17:32 - 00003694 _____ C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-01-22 19:33 - 2009-07-14 18:58 - 00747994 _____ C:\Windows\system32\perfh007.dat
2014-01-22 19:33 - 2009-07-14 18:58 - 00170676 _____ C:\Windows\system32\perfc007.dat
2014-01-22 19:33 - 2009-07-14 06:13 - 01751820 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-22 18:48 - 2013-09-15 15:53 - 00000000 ____D C:\Users\Robert\AppData\Local\Deployment
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-22 16:28 - 2009-08-05 18:41 - 00000000 ___RD C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-22 10:30 - 2013-07-12 15:42 - 00000000 ____D C:\Users\Robert\AppData\Local\TSVNCache
2014-01-21 22:15 - 2014-01-21 21:57 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 22:36 - 2014-01-19 20:51 - 00000000 ____D C:\Profi cash
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:52 - 2006-11-02 13:34 - 00000237 _____ C:\Windows\win.ini
2014-01-19 20:49 - 2012-09-15 20:17 - 00000000 ____D C:\Users\Robert\AppData\Roaming\QuickScan
2014-01-19 20:11 - 2013-10-17 15:47 - 00620640 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-19 20:11 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-01-19 20:11 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:27 - 2009-12-02 12:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2014-01-19 17:19 - 2011-01-20 12:32 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2014-01-19 17:18 - 2014-01-19 17:19 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-19 03:14 - 2013-04-19 18:24 - 00768000 ___SH C:\Users\Robert\Thumbs.db
2014-01-19 03:06 - 2013-07-12 14:27 - 00000000 ____D C:\Users\Robert\AppData\Local\Package Cache
2014-01-19 00:47 - 2010-02-03 15:13 - 00000000 ____D C:\Users\Robert\AppData\Roaming\TS3Client
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 08:24 - 2009-12-11 18:16 - 00003704 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2014-01-18 08:13 - 2013-06-22 18:18 - 00000000 ____D C:\Users\Robert\Desktop\WOW WICHTIG!
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 07:54 - 2013-07-01 22:56 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-17 21:58 - 2009-08-14 17:31 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Skype
2014-01-17 21:57 - 2011-05-12 18:30 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-17 21:57 - 2009-08-13 21:42 - 00000000 ____D C:\ProgramData\Skype
2014-01-17 21:53 - 2012-09-15 18:43 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2014-01-17 20:36 - 2009-12-11 17:02 - 01725164 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-17 20:34 - 2013-08-17 03:45 - 00000000 ____D C:\Windows\system32\MRT
2014-01-17 20:31 - 2010-01-14 17:47 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 15:52 - 2012-09-16 14:21 - 00002362 _____ C:\Users\Robert\Desktop\Google Chrome.lnk
2014-01-13 20:23 - 2009-10-24 17:27 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2014-01-11 20:04 - 2013-07-12 14:25 - 00000000 ____D C:\Users\Robert\Downloads\HonorB
2014-01-11 00:52 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Local\VMware
2014-01-09 20:45 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Roaming\VMware
2014-01-09 14:56 - 2009-08-27 15:10 - 00000000 ___RD C:\Users\Robert\Wichtiges
2014-01-04 15:37 - 2013-07-12 15:51 - 00000000 ____D C:\Users\Robert\AppData\Local\HonorbuddyMeshes
Some content of TEMP:
====================
C:\Users\Robert\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-19 00:16
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2014
Ran by Robert at 2014-01-24 20:28:46
Running from C:\Users\Robert\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (x32 Version: 10.1.9 - Adobe Systems Incorporated)
Ask Toolbar (x32 Version: 1.15.15.0 - Ask.com) <==== ATTENTION
Ask Toolbar Updater (HKCU Version: 1.2.4.36191 - Ask.com) <==== ATTENTION
Assassin's Creed Revelations 1.03 (x32 Version: 1.03 - Ubisoft)
Avira Antivirus Premium (x32 Version: 14.0.2.286 - Avira)
Badaboom 1.1.1.241 (x32 Version: 1.1.1.241 - Elemental Technologies)
Battlefield 3™ (x32 Version: 1.4.0.0 - Electronic Arts)
Battlefield 4™ Beta (x32 Version: 1.0.0.0 - Electronic Arts)
Call of Duty: Black Ops II - Multiplayer (x32 Version: - )
Call of Duty: Black Ops II (x32 Version: - Treyarch)
CCleaner (Version: 4.08 - Piriform)
CDDRV_Installer (Version: 4.60 - Logitech) Hidden
Cool & Quiet (x32 Version: - )
Counter-Strike: Global Offensive Beta (x32 Version: - )
Counter-Strike: Source (x32 Version: 1.0.0.0 - Valve)
Curse Client (HKCU Version: 5.1.1.792 - Curse)
DivX Converter (x32 Version: 7.1.0 - DivX, Inc.)
DivX Plus DirectShow Filters (x32 Version: - DivX, Inc.)
DivX-Setup (x32 Version: 2.6.1.28 - DivX, LLC)
EasyBits GO (HKCU Version: - EasyBits Media)
EPU-6 Engine (x32 Version: 1.00.28 - )
erLT (x32 Version: 1.20.0137 - Logitech, Inc.) Hidden
ESL Wire 1.15 (Version: - Turtle Entertainment GmbH)
ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)
EXPERTool 7.5 (x32 Version: - Gainward Co., Ltd)
Express Gate Updater (x32 Version: 1.1.1.2 - DeviceVM)
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.23.0 - MAGIX AG)
Free YouTube to MP3 Converter version 3.12.12.827 (x32 Version: 3.12.12.827 - DVDVideoSoft Ltd.)
GameSpy Comrade (x32 Version: 1.5.0.156 - GameSpy)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKCU Version: 32.0.1700.76 - Google Inc.)
Google Update Helper (x32 Version: 1.3.21.111 - Google Inc.) Hidden
Heroes of Newerth (x32 Version: 2.3.0 - S2 Games)
Honorbuddy (HKCU Version: 2.5.7291.636 - Bossland GmbH)
Honorbuddy (HKCU Version: 2.5.7346.637 - Bossland GmbH)
Honorbuddy (HKCU Version: 2.5.9468.722 - Bossland GmbH)
Honorbuddy (x32 Version: 2.5.9468.722 - Bossland GmbH) Hidden
Host OpenAL (ADI) (x32 Version: - )
ICQ7.2 (x32 Version: 7.2 - ICQ)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
KhalInstallWrapper (Version: 2.00.0000 - Logitech) Hidden
Logitech G35 (Version: 1.0.152 - Logitech)
Logitech SetPoint (x32 Version: 4.80 - Logitech)
MAGIX Screenshare (x32 Version: 4.3.6.1987 - MAGIX AG)
MAGIX Speed burnR (x32 Version: 7.0.2.7 - MAGIX AG)
Microsoft .NET Framework 1.1 (x32 Version: - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 1.1 Security Update (KB953297) (x32 Version: - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Age of Empires II (x32 Version: - )
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
mIRC (x32 Version: 6.35 - mIRC Co. Ltd.)
Mozilla Firefox 17.0.1 (x86 de) (x32 Version: 17.0.1 - Mozilla)
Mozilla Maintenance Service (x32 Version: 17.0.1 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
NCsoft Launcher (x32 Version: 1.5.19002 - NCsoft)
Notepad++ (x32 Version: 6.5 - Notepad++ Team)
NVIDIA 3D Vision Controller Driver (x32 Version: 280.19 - NVIDIA Corporation) Hidden
NVIDIA 3D Vision Controller-Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3221 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice.org 3.3 (x32 Version: 3.3.9567 - OpenOffice.org)
Origin (x32 Version: 8.6.0.357 - Electronic Arts, Inc.)
Pando Media Booster (x32 Version: 2.3.6.0 - Pando Networks Inc.)
Profi cash (x32 Version: - )
PROTOTYPE 2 (x32 Version: - Radical Entertainment)
Proxifier version 3.21 (x32 Version: 3.21 - Initex)
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Skype Click to Call (x32 Version: 5.6.8442 - Skype Technologies S.A.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Sniper Elite V2 (x32 Version: - )
SoundMAX (x32 Version: 6.10.2.6520 - Analog Devices)
Steam(TM) (x32 Version: 1.0.0.0 - Valve)
TeamSpeak 3 Client (x32 Version: 3.0.13.1 - TeamSpeak Systems GmbH)
TeamViewer 8 (x32 Version: 8.0.22298 - TeamViewer)
tools-linux (x32 Version: 9.6.1.1379776 - VMware, Inc.) Hidden
TortoiseSVN 1.8.0.24401 (64 bit) (Version: 1.8.24401 - TortoiseSVN)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.179 - TuneUp Software)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.179 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 10.0.4410.1 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.2160.11 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.4000.179 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 9.0.5100.2 - TuneUp Software) Hidden
TurboV (x32 Version: 1.00.17 - )
Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.3 (x32 Version: 2.0.3 - VideoLAN)
VLC media player 2.1.2 (Version: 2.1.2 - VideoLAN)
VMware Player (Version: 6.0.1 - VMware, Inc.) Hidden
VMware Player (x32 Version: 6.0.1 - VMware, Inc)
vReveal (x32 Version: - MotionDSP)
Warcraft III (x32 Version: - )
Warcraft III: All Products (HKCU Version: - )
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
WinPcap 4.1.1 (x32 Version: 4.1.0.1753 - CACE Technologies)
WinRAR (x32 Version: - )
World of Warcraft (x32 Version: - Blizzard Entertainment)
==================== Restore Points =========================
24-01-2014 04:16:53 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2006-11-02 13:34 - 2006-09-18 22:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {08631979-D016-4152-A093-6D3E4F4E7A12} - System32\Tasks\SVN Update2 => E:\SVN Update2.bat [2013-11-09] ()
Task: {13A36FA7-B51E-42A7-A24C-6928FFE7F87D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)
Task: {18010635-0EE2-4B03-9EA6-30B0C50C7AA2} - System32\Tasks\{90A3A757-3A64-445C-B407-B3956DB512CD} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-15] (Skype Technologies S.A.)
Task: {185BBCC6-9B25-4AA5-8140-FEA91F0FDB77} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {1D571EDF-1EB8-4D06-98B6-621613C54E70} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-02-08] ()
Task: {20A7E74B-22CA-479E-8562-49CB05E8038C} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2009-07-14] (Microsoft Corporation)
Task: {3BE67737-A7A8-4186-AE85-99C5B26A9113} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)
Task: {4C0E5B45-8EB2-4F5D-B752-ED53133328B6} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2013-12-10] (TuneUp Software)
Task: {4C2F3E75-29AC-4B0E-BB2B-6AE7C8756AF2} - System32\Tasks\{B37E03D7-724D-4ED6-A0C3-B870D6690AA1} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {4D820902-3FAA-4D64-97FE-DAFF65749979} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)
Task: {4F814AB8-EA3A-4587-B9FD-BBF302E0FE65} - System32\Tasks\{B60632FC-CD32-4786-B57E-6F6D7D05B405} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {830998AC-4D46-484A-AA33-5DF38748633E} - System32\Tasks\DivX-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2013-02-13] ()
Task: {90F5E964-C187-40A6-A384-1CF67A1D603D} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {910171FB-FEFF-46DF-9C99-7378CF46AC7A} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe
Task: {9475DD97-BB54-4FD8-A31A-032B4833F6AA} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {95C6CA51-3E2A-47DE-9288-024625960618} - System32\Tasks\{DCED82F0-7941-43D4-BB72-5307D26CA57A} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-15] (Skype Technologies S.A.)
Task: {9B34B395-2186-49B7-B5EB-CF53607FE0E9} - System32\Tasks\Google Updater and Installer => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)
Task: {A6651D8F-83E0-4A57-9E78-6B6803C1E6A8} - System32\Tasks\SVN Update => E:\SVN Update.bat [2013-10-06] ()
Task: {AB54D6C5-5BC4-4375-9039-960F7F6F2A56} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {AE17272F-8E41-4056-B822-354581F6C6E2} - System32\Tasks\{DCE9D458-5A5C-4C33-B054-1E531B793694} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {B165A169-FAA2-4ECD-818B-24F0047F56C9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)
Task: {C15A9275-9D3A-49A2-9FAE-ECBE177427D5} - System32\Tasks\{862D60CD-E564-4C01-9101-9AF7AD4B6E2B} => E:\Programme\HoN\hon.exe [2013-10-13] (S2 Games)
Task: {C15F8E8F-C064-4FEB-AF1A-4C3ACC1A2649} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {C28278BF-1ABF-4595-BB2A-15201DDF25E3} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {C592C51D-489B-4B85-BE20-EF6F489FD5E1} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {DC69638B-35B6-4932-A742-8CF09EA335AD} - System32\Tasks\{DFB05294-0DC7-4FEE-9B93-42EC5DC53F4C} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-06-17 19:27 - 2013-06-17 19:27 - 00075504 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll
2013-06-17 19:27 - 2013-06-17 19:27 - 00088304 _____ () C:\Program Files\TortoiseSVN\bin\libsasl.dll
2009-09-14 13:08 - 2009-07-20 11:35 - 00018960 _____ () C:\Program Files (x86)\Logitech\SetPoint\khalwrapper.dll
2013-09-03 15:53 - 2012-11-22 17:57 - 00057448 _____ () C:\Windows\system32\PrxerNsp.dll
2012-11-13 15:45 - 2013-06-08 16:02 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2009-08-05 19:01 - 1998-10-31 09:55 - 00005120 _____ () C:\Program Files (x86)\EXPERTool\TBManage.dll
2009-08-05 18:58 - 2005-05-11 15:39 - 00565248 _____ () C:\Program Files (x86)\ASUS\TurboV\pngio.dll
2009-08-05 18:58 - 2008-09-04 16:42 - 01126912 _____ () C:\Program Files (x86)\ASUS\TurboV\OcProfile.dll
2009-08-05 18:58 - 2008-08-21 14:19 - 00126976 _____ () C:\Program Files (x86)\ASUS\TurboV\TVOCLIB.DLL
2013-10-18 12:46 - 2013-10-18 12:46 - 01260624 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:24721E3C
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/24/2014 08:26:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/24/2014 08:23:21 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (01/24/2014 07:38:51 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/23/2014 10:47:52 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1".
Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/23/2014 10:45:13 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (01/23/2014 07:21:36 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/23/2014 07:18:37 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (01/22/2014 07:15:25 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Steam2k5.Launcher.exe, Version: 2.5.9468.722, Zeitstempel: 0x52d943fd
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x19a0
Startzeit der fehlerhaften Anwendung: 0xSteam2k5.Launcher.exe0
Pfad der fehlerhaften Anwendung: Steam2k5.Launcher.exe1
Pfad des fehlerhaften Moduls: Steam2k5.Launcher.exe2
Berichtskennung: Steam2k5.Launcher.exe3
Error: (01/22/2014 07:15:24 PM) (Source: .NET Runtime) (User: )
Description: Anwendung: Steam2k5.Launcher.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.InvalidOperationException
Stapel:
bei System.Diagnostics.Process.WaitForInputIdle(Int32)
bei System.Diagnostics.Process.WaitForInputIdle()
bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.Input.InputManager.ProcessStagingArea()
bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
bei Microsoft.Win32.NativeMethods.ShellExecuteEx(ShellExecuteInfo)
bei System.Diagnostics.ShellExecuteHelper.ShellExecuteFunction()
bei System.Diagnostics.ShellExecuteHelper.ShellExecuteOnSTAThread()
bei System.Diagnostics.Process.StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)
bei System.Diagnostics.Process.Start()
bei System.Diagnostics.Process.Start(System.Diagnostics.ProcessStartInfo)
bei System.Diagnostics.Process.Start(System.String, System.String)
bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.Input.InputManager.ProcessStagingArea()
bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
bei System.Windows.Threading.Dispatcher.Run()
bei System.Windows.Application.RunDispatcher(System.Object)
bei System.Windows.Application.RunInternal(System.Windows.Window)
bei System.Windows.Application.Run(System.Windows.Window)
bei System.Windows.Application.Run()
bei Honorbuddy.Launcher.App.Main()
Error: (01/22/2014 10:51:57 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1".
Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (01/24/2014 02:02:44 AM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (01/22/2014 05:49:18 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Error: (01/22/2014 05:49:18 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Error: (01/22/2014 05:49:17 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Error: (01/22/2014 05:49:17 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Error: (01/22/2014 10:30:11 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "TeamViewer 8" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/22/2014 10:30:11 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst TeamViewer 8 erreicht.
Error: (01/19/2014 08:11:46 PM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (01/19/2014 03:02:53 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Error: (01/18/2014 03:26:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office Sessions:
=========================
Error: (01/24/2014 08:26:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/24/2014 08:23:21 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe)(User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (01/24/2014 07:38:51 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/23/2014 10:47:52 AM) (Source: SideBySide)(User: )
Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files (x86)\windows live\messenger\wlcsdk.exe
Error: (01/23/2014 10:45:13 AM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
Error: (01/23/2014 07:21:36 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/23/2014 07:18:37 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe)(User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
Error: (01/22/2014 07:15:25 PM) (Source: Application Error)(User: )
Description: Steam2k5.Launcher.exe2.5.9468.72252d943fdKERNELBASE.dll6.1.7601.1822951fb1116e04343520000c41f19a001cf179dd9523bcfE:\Programme\BG\Steam2k5.Launcher.exeC:\Windows\syswow64\KERNELBASE.dll29b72253-8391-11e3-b4ad-005056c00008
Error: (01/22/2014 07:15:24 PM) (Source: .NET Runtime)(User: )
Description: Anwendung: Steam2k5.Launcher.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.InvalidOperationException
Stapel:
bei System.Diagnostics.Process.WaitForInputIdle(Int32)
bei System.Diagnostics.Process.WaitForInputIdle()
bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.Input.InputManager.ProcessStagingArea()
bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
bei Microsoft.Win32.NativeMethods.ShellExecuteEx(ShellExecuteInfo)
bei System.Diagnostics.ShellExecuteHelper.ShellExecuteFunction()
bei System.Diagnostics.ShellExecuteHelper.ShellExecuteOnSTAThread()
bei System.Diagnostics.Process.StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)
bei System.Diagnostics.Process.Start()
bei System.Diagnostics.Process.Start(System.Diagnostics.ProcessStartInfo)
bei System.Diagnostics.Process.Start(System.String, System.String)
bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
bei System.Windows.Input.InputManager.ProcessStagingArea()
bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
bei System.Windows.Threading.Dispatcher.Run()
bei System.Windows.Application.RunDispatcher(System.Object)
bei System.Windows.Application.RunInternal(System.Windows.Window)
bei System.Windows.Application.Run(System.Windows.Window)
bei System.Windows.Application.Run()
bei Honorbuddy.Launcher.App.Main()
Error: (01/22/2014 10:51:57 AM) (Source: SideBySide)(User: )
Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files (x86)\windows live\messenger\wlcsdk.exe
CodeIntegrity Errors:
===================================
Date: 2014-01-23 10:47:06.063
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-23 10:47:06.062
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-23 10:47:06.060
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-23 10:47:06.045
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-23 10:47:06.044
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-23 10:47:06.042
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-22 10:50:21.441
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-22 10:50:21.440
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-22 10:50:21.438
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-22 10:50:21.415
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 35%
Total physical RAM: 6135.12 MB
Available physical RAM: 3957.72 MB
Total Pagefile: 12268.41 MB
Available Pagefile: 9653.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:298.09 GB) (Free:194.39 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Volume) (Fixed) (Total:698.63 GB) (Free:535.13 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: E7091A42)
Partition 1: (Active) - (Size=298 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 114AA6A5)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-24 20:49:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 SAMSUNG_HD322HJ rev.1AC01118 298,09GB
Running: gmer.exe; Driver: C:\Users\Robert\AppData\Local\Temp\kgdiqpow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 000000007793faa8 5 bytes JMP 00000001710c18a8
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940038 5 bytes JMP 00000001710c1ea1
.text C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 00000000711f1a22 2 bytes [1F, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 00000000711f1ad0 2 bytes [1F, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 00000000711f1b08 2 bytes [1F, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 00000000711f1bba 2 bytes [1F, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 00000000711f1bda 2 bytes [1F, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000765f1465 2 bytes [5F, 76]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000765f14bb 2 bytes [5F, 76]
.text ... * 2
.text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000765f1465 2 bytes [5F, 76]
.text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000765f14bb 2 bytes [5F, 76]
.text ... * 2
.text C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 26 000000006f3013c6 2 bytes [30, 6F]
.text C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 74 000000006f3013f6 2 bytes [30, 6F]
.text C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 257 000000006f3014ad 2 bytes [30, 6F]
.text C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 303 000000006f3014db 2 bytes [30, 6F]
.text ... * 2
.text C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 79 000000006f301577 2 bytes [30, 6F]
.text C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 175 000000006f3015d7 2 bytes [30, 6F]
.text C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 620 000000006f301794 2 bytes [30, 6F]
.text C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 921 000000006f3018c1 2 bytes [30, 6F]
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000765f1465 2 bytes [5F, 76]
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000765f14bb 2 bytes [5F, 76]
.text ... * 2
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000777411f5 8 bytes {JMP 0xd}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077741390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007774143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007774158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007774191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077741b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077741bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077741d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077741eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077741edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077741f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077741fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077741fd7 8 bytes {JMP 0xb}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077742272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077742301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077742792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000777427b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000777427d2 8 bytes {JMP 0x10}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007774282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077742890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077742d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077742d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077743023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007774323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000777433c0 16 bytes {JMP 0x4e}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077743a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077743ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077743b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077743d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077744190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077791380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077791500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077791530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077791650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077791700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077791d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077791f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777927e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752713cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007527146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752716d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752716e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752719db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752719fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000075271a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000075271a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000075271a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000075271a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\KLIF\Parameters@LastProcessedRevision 7043064
---- EOF - GMER 2.1 ----
Ich sollte noch erwähnen, dass KASPERSKY Internet Security 2014 und Avira Antivirus Suite nichts auf dem Rechner gefunden haben. Deshalb habe ich hierzu auch keine Logs gepostet. Editieren des Beitrags war leider nicht mehr möglich. |
|
25.01.2014, 10:27
| #2 | |
| /// the machine /// TB-Ausbilder    | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
25.01.2014, 13:53
| #3 |
| | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware Hi,
__________________vielen Dank, dass Sie mir helfen. Code:
ATTFilter ComboFix 14-01-23.02 - Robert 25.01.2014 13:12:13.1.8 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.6135.4006 [GMT 1:00]
ausgeführt von:: c:\users\Robert\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Robert\AppData\Local\assembly\tmp
c:\windows\IsUn0407.exe
c:\windows\SysWow64\~GLH03d9.TMP
c:\windows\SysWow64\~GLH03db.TMP
c:\windows\SysWow64\~GLH03dd.TMP
c:\windows\SysWow64\~GLH03f6.TMP
c:\windows\SysWow64\~GLH03f8.TMP
c:\windows\SysWow64\~GLH03fa.TMP
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-12-25 bis 2014-01-25 ))))))))))))))))))))))))))))))
.
.
2014-01-25 12:17 . 2014-01-25 12:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-24 19:13 . 2014-01-24 19:13 -------- d-----w- C:\FRST
2014-01-19 19:51 . 2014-01-19 21:36 -------- d-----w- C:\Profi cash
2014-01-19 02:11 . 2014-01-19 02:11 6649344 ----a-r- c:\users\Robert\AppData\Roaming\Microsoft\Installer\{6D8FB164-2A7D-43B2-A59E-E16BF568ACB0}\DesktopIcon.exe
2014-01-18 06:55 . 2014-01-18 06:55 -------- d-----w- c:\programdata\Oracle
2014-01-18 06:54 . 2013-12-18 20:09 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-17 20:57 . 2014-01-17 20:57 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-01-15 15:22 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 15:22 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 15:22 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 15:22 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 15:22 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 15:22 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 15:22 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 15:22 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2014-01-15 15:22 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-19 19:11 . 2013-10-17 14:47 620640 ----a-w- c:\windows\system32\drivers\klif.sys
2014-01-19 19:11 . 2013-10-17 14:47 458336 ----a-w- c:\windows\system32\drivers\kl1.sys
2014-01-19 19:11 . 2013-06-06 16:38 178272 ----a-w- c:\windows\system32\drivers\kneps.sys
2014-01-17 19:31 . 2010-01-14 16:47 86054176 ----a-w- c:\windows\system32\MRT.exe
2013-12-19 20:33 . 2009-09-27 14:12 3071656 ----a-w- c:\windows\system32\nvapi64.dll
2013-12-19 20:33 . 2009-09-27 14:12 2698272 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-12-19 18:53 . 2010-10-16 11:13 6671648 ----a-w- c:\windows\system32\nvcpl.dll
2013-12-19 18:53 . 2010-10-16 11:13 3490080 ----a-w- c:\windows\system32\nvsvc64.dll
2013-12-19 18:53 . 2010-10-16 11:13 386336 ----a-w- c:\windows\system32\nvmctray.dll
2013-12-19 18:53 . 2010-10-16 11:13 922912 ----a-w- c:\windows\system32\nvvsvc.exe
2013-12-19 18:53 . 2010-10-16 11:13 2559776 ----a-w- c:\windows\system32\nvsvcr.dll
2013-12-19 18:53 . 2009-05-01 00:46 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-12-19 11:20 . 2013-12-19 11:20 590112 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-12-18 14:53 . 2013-05-07 16:29 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-12-18 14:53 . 2013-03-30 02:09 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-18 14:53 . 2013-03-30 02:09 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-10 22:26 . 2013-04-08 09:59 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-10 22:26 . 2013-04-08 09:59 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-10 17:43 . 2012-09-19 12:59 35640 ----a-w- c:\windows\system32\TURegOpt.exe
2013-12-10 17:43 . 2012-09-22 13:23 38200 ----a-w- c:\windows\system32\uxtuneup.dll
2013-12-10 17:43 . 2012-09-22 13:23 30520 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2013-12-10 17:43 . 2012-09-19 12:59 26936 ----a-w- c:\windows\system32\authuitu.dll
2013-12-10 17:43 . 2012-09-19 12:59 22328 ----a-w- c:\windows\SysWow64\authuitu.dll
2013-12-10 02:15 . 2013-10-30 02:25 982232 ----a-w- c:\windows\SysWow64\nvspcap.dll
2013-12-10 02:14 . 2013-10-30 02:25 1100248 ----a-w- c:\windows\system32\nvspcap64.dll
2013-12-05 08:42 . 2013-12-17 19:20 39200 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2013-12-05 08:42 . 2013-12-17 19:20 32544 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2013-12-05 08:42 . 2013-10-02 13:44 35104 ----a-w- c:\windows\system32\nvaudcap64v.dll
2013-11-26 11:54 . 2013-12-12 02:01 23183360 ----a-w- c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-12 02:01 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-12 02:01 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-12 02:01 66048 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-12 02:01 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-12 02:01 2764288 ----a-w- c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-12 02:01 53760 ----a-w- c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-12 02:01 33792 ----a-w- c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-12 02:01 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-12 02:01 574976 ----a-w- c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-12 02:01 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-12 02:01 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-12 02:01 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-12 02:01 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-12 02:01 5769216 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-12 02:01 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 02:01 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-12 02:01 1995264 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-12 02:01 12996608 ----a-w- c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-12 02:01 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-12 02:01 2334208 ----a-w- c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-12 02:01 1395200 ----a-w- c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-12 02:01 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-12 02:01 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2013-11-25 19:02 . 2013-03-30 02:09 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-11-23 18:26 . 2013-12-12 00:25 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 00:25 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-14 19:35 . 2013-11-14 19:35 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-14 19:35 . 2013-11-14 19:35 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-14 19:34 . 2013-11-14 19:34 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-14 19:34 . 2013-11-14 19:34 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-14 19:34 . 2013-11-14 19:34 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-14 19:34 . 2013-11-14 19:34 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-14 19:34 . 2013-11-14 19:34 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-14 19:34 . 2013-11-14 19:34 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-14 19:34 . 2013-11-14 19:34 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-14 19:34 . 2013-11-14 19:34 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-14 19:34 . 2013-11-14 19:34 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-14 19:34 . 2013-11-14 19:34 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-14 19:34 . 2013-11-14 19:34 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-14 19:34 . 2013-11-14 19:34 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-14 19:34 . 2013-11-14 19:34 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-14 19:34 . 2013-11-14 19:34 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-14 19:34 . 2013-11-14 19:34 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-14 19:34 . 2013-11-14 19:34 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-14 19:34 . 2013-11-14 19:34 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-14 19:34 . 2013-11-14 19:34 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-14 19:34 . 2013-11-14 19:34 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-14 19:34 . 2013-11-14 19:34 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-14 19:34 . 2013-11-14 19:34 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-14 19:34 . 2013-11-14 19:34 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-14 19:34 . 2013-11-14 19:34 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-14 19:34 . 2013-11-14 19:34 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-14 19:34 . 2013-11-14 19:34 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-14 19:34 . 2013-11-14 19:34 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-14 19:34 . 2013-11-14 19:34 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-14 19:34 . 2013-11-14 19:34 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-14 19:34 . 2013-11-14 19:34 413696 ----a-w- c:\windows\system32\html.iec
2013-11-14 19:34 . 2013-11-14 19:34 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-14 19:34 . 2013-11-14 19:34 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-14 19:34 . 2013-11-14 19:34 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-14 19:34 . 2013-11-14 19:34 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-14 19:34 . 2013-11-14 19:34 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-14 19:34 . 2013-11-14 19:34 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-14 19:34 . 2013-11-14 19:34 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-14 19:34 . 2013-11-14 19:34 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-14 19:34 . 2013-11-14 19:34 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-14 19:34 . 2013-11-14 19:34 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-14 19:34 . 2013-11-14 19:34 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-14 19:34 . 2013-11-14 19:34 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-14 19:34 . 2013-11-14 19:34 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-14 19:34 . 2013-11-14 19:34 62464 ----a-w- c:\windows\system32\pngfilt.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-02-08 1520776]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2013-02-08 13:55 1520776 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-02-08 1520776]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2010-11-20 163328]
"GAINWARD"="c:\program files (x86)\EXPERTool\TBPanel.exe" [2009-05-12 2181672]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"SoundMax"="c:\program files (x86)\Analog Devices\SoundMAX\SoundMAX.exe" [2008-08-20 3858432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"TurboV"="c:\program files (x86)\ASUS\TurboV\TurboV.exe" [2008-10-21 4040192]
"Logitech G35"="c:\program files (x86)\Logitech\G35\G35.exe" [2009-06-30 1811728]
"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2008-04-15 1310720]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-18 684600]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2013-02-08 1644680]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-03-28 450560]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files (x86)\Logitech\SetPoint\SetPoint.exe [2009-8-13 1207312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"DivXMediaServer"=c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
.
R2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ESLvnic1;ESLvnic Virtual Network 64 Bit;c:\windows\system32\DRIVERS\ESLvnic.sys;c:\windows\SYSNATIVE\DRIVERS\ESLvnic.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys;c:\windows\SYSNATIVE\drivers\ScreamingBAudio64.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 UPnPService;UPnPService;c:\program files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe;c:\program files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [x]
R3 VaneFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys;c:\windows\SYSNATIVE\drivers\Lachesis.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R4 EslWireHelper;ESL Wire Helper Service;c:\program files\EslWire\service\WireHelperSvc.exe;c:\program files\EslWire\service\WireHelperSvc.exe [x]
R4 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
R4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R4 klflt;klflt;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys;c:\windows\SYSNATIVE\drivers\vsock.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 ESLWireAC;ESLWireAC;c:\windows\system32\drivers\ESLWireACD.sys;c:\windows\SYSNATIVE\drivers\ESLWireACD.sys [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer8;TeamViewer 8;e:\programme\Teamviewer\TeamViewer_Service.exe;e:\programme\Teamviewer\TeamViewer_Service.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 LADF_DHP2;G35 DHP2 Filter Driver;c:\windows\system32\DRIVERS\ladfDHP2amd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfDHP2amd64.sys [x]
S3 LADF_SBVM;G35 SBVM Filter Driver;c:\windows\system32\DRIVERS\ladfSBVMamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfSBVMamd64.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - KLBG
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-08 22:26]
.
2014-01-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job
- c:\users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16 13:20]
.
2014-01-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job
- c:\users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16 13:20]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 08:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-08 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube to MP3 Converter - c:\users\Robert\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Zu Anti-Banner hinzufügen - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ie_banner_deny.htm
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
LSP: %SystemRoot%\system32\PrxerDrv.dll
LSP: %windir%\system32\vsocklib.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.de/
FF - prefs.js: network.proxy.ftp - 80.193.214.239
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.http - 80.193.214.239
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.socks - 80.193.214.239
FF - prefs.js: network.proxy.socks_port - 3128
FF - prefs.js: network.proxy.ssl - 80.193.214.239
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 1
FF - ExtSQL: !HIDDEN! 2009-12-11 17:06; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-{17c3ec1c-d814-4d83-ac88-062376366583} - c:\users\Robert\AppData\Local\Package Cache\{17c3ec1c-d814-4d83-ac88-062376366583}\Honorbuddy Installer v2.5.7291.636.exe
AddRemove-{a7b6917c-def9-4e52-909e-c77d3246bf2d} - c:\users\Robert\AppData\Local\Package Cache\{a7b6917c-def9-4e52-909e-c77d3246bf2d}\Honorbuddy Installer v2.5.7346.637.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,
91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{326E768D-4182-46FD-9C16-1449A49795F4}"=hex:51,66,7a,6c,4c,1d,38,12,e3,75,7d,
36,b0,0f,93,03,e3,00,57,09,a1,c9,d1,e0
"{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}"=hex:51,66,7a,6c,4c,1d,38,12,da,39,34,
5d,e1,a9,97,05,de,be,2c,e9,c9,ff,c2,38
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93,
aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{E33CF602-D945-461A-83F0-819F76A199F8}"=hex:51,66,7a,6c,4c,1d,38,12,6c,f5,2f,
e7,77,97,74,03,fc,e6,c2,df,73,ff,dd,ec
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:45,db,33,83,59,26,cd,01
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-01-25 13:19:22
ComboFix-quarantined-files.txt 2014-01-25 12:19
.
Vor Suchlauf: 9 Verzeichnis(se), 210.150.072.320 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 210.262.712.320 Bytes frei
.
- - End Of File - - 474ED209CEFAD4F27CEAC5559C5F5B43
A36C5E4F47E84449FF07ED3517B43A31
Könnten Sie mir dann auch eine kurze Info geben, ob Ihnen bisher etwas aufgefallen ist? Geändert von Necro0 (25.01.2014 um 14:00 Uhr) |
|
26.01.2014, 07:11
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware Rechner einfach mal neustarten. Du hast schon en bissl Müll auf dem Rechner, aber das bekommen wir hin. PW vom Email Account ändern. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.01.2014, 15:09
| #5 |
| | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware Also Neustart hab ich in der Zwischenzeit schon öfter gemacht hat aber nichts geholfen. Aber wenn da nichts schlimmeres passiert ist der Hintergrund ist mir egal. MBAM Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.26.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Robert :: ROBERT-PC [Administrator] Schutz: Aktiviert 26.01.2014 14:14:33 mbam-log-2014-01-26 (14-14-33).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 218269 Laufzeit: 4 Minute(n), 23 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 1 HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0J1D1Q1L0X2Z1M2V0X2X1R1LtFzvtHzv -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v3.017 - Bericht erstellt am 26/01/2014 um 14:23:28
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : Robert - ROBERT-PC
# Gestartet von : C:\Users\Robert\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Users\Robert\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Robert\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\Robert\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\toolbar@ask.com
Datei Gelöscht : C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\invalidprefs.js
Datei Gelöscht : C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml
Datei Gelöscht : C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_hamachi_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_hamachi_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tubebox_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_tubebox_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Wert Gelöscht : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1]
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
-\\ Mozilla Firefox v17.0.1 (de)
[ Datei : C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [6882 octets] - [26/01/2014 14:22:26]
AdwCleaner[S0].txt - [6306 octets] - [26/01/2014 14:23:28]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6366 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Ultimate x64
Ran by Robert on 26.01.2014 at 14:29:49,85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9213EACE-9E17-47A0-9C80-CD242746D912}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Robert\appdata\local\apn"
~~~ FireFox
Emptied folder: C:\Users\Robert\AppData\Roaming\mozilla\firefox\profiles\2xcpxftx.default\minidumps [9 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.01.2014 at 14:35:28,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-01-2014 01
Ran by Robert (administrator) on ROBERT-PC on 26-01-2014 14:51:32
Running from C:\Users\Robert\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Gainward Co.) C:\Program Files (x86)\EXPERTool\TBPANEL.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
() C:\Program Files (x86)\ASUS\TurboV\TurboV.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\SetPoint\SetPoint.exe
(Logitech(c)) C:\Program Files (x86)\Logitech\G35\G35.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer_Service.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
() C:\Program Files (x86)\Logitech\SetPoint\x86\SetPoint32.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\tv_w32.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\tv_x64.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [TurboV] - C:\Program Files (x86)\ASUS\TurboV\TurboV.exe [4040192 2008-10-21] ()
HKLM-x32\...\Run: [Logitech G35] - C:\Program Files (x86)\Logitech\G35\G35.exe [1811728 2009-06-30] (Logitech(c))
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2008-04-15] (Analog Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-03-28] (DivX, LLC)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logitech\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [GAINWARD] - C:\Program Files (x86)\EXPERTool\TBPanel.exe [2181672 2009-05-12] (Gainward Co.)
HKCU\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-08-20] (Analog Devices, Inc.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1CF3E2E5C76FCA01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {7DDC945D-68E7-480A-B922-594CD4878A41} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Windows\SysWOW64\PrxerNsp.dll [56424] ()
Winsock: Catalog9 09 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 10 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 11 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 12 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 24 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog5-x64 07 %SystemRoot%\system32\PrxerNsp.dll [57448] ()
Winsock: Catalog9-x64 09 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 10 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 11 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 12 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 24 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
FireFox:
========
FF ProfilePath: C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://google.de/
FF NetworkProxy: "backup.ftp", "58.20.127.100"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "58.20.127.100"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "58.20.127.100"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "80.193.214.239"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "80.193.214.239"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "80.193.214.239"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "80.193.214.239"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 1
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 - C:\Users\Robert\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1002170-0-npoctoshape.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Robert\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Adblock Plus - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-04]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2011-01-20]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2011-01-20]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-10-27]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-01]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-19]
Chrome:
=======
CHR HomePage:
CHR DefaultSearchKeyword: google.de_
CHR DefaultSearchURL: hxxp://www.google.de/search?q={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Free Studio) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\np_dvs_plugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (ijji Web Launching Plugin for FF) - C:\Program Files (x86)\Mozilla Firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
CHR Plugin: (Octoshape Streaming Services) - C:\Users\Robert\AppData\Roaming\Mozilla\plugins\npoctoshape.dll (Octoshape ApS)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Google Update) - C:\Users\Robert\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (ProxTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-01-19]
CHR Extension: (Google Drive) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-09-16]
CHR Extension: (Brushed) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg [2013-03-27]
CHR Extension: (YouTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-09-16]
CHR Extension: (Google-Suche) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-09-16]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2012-09-16]
CHR Extension: (AdBlock) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-09-16]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2013-01-21]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-01-19]
CHR Extension: (Virtuelle Tastatur) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2012-09-16]
CHR Extension: (FVD Downloader) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2012-11-04]
CHR Extension: (Google Wallet) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-09-16]
CHR Extension: (NotScripts) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2012-09-29]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2012-11-01]
CHR Extension: (Google Mail) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-09-16]
CHR Extension: (Anti-Banner) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2012-09-16]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Robert\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx [2012-09-15]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896056 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [86016 2008-08-15] ()
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
S4 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [678416 2012-11-14] ()
S3 LBTServ; C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe [160784 2009-07-20] (Logitech, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-01] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
R2 TeamViewer8; E:\Programme\Teamviewer\TeamViewer_Service.exe [5087584 2013-10-01] (TeamViewer GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2409272 2013-12-10] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)
S3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2009-12-03] (Turtle Entertainment GmbH)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [160784 2012-11-14] (<Turtle Entertainment>)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-19] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620640 2014-01-19] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-01-19] (Kaspersky Lab ZAO)
R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [61712 2009-05-28] (Logitech)
R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [376848 2009-05-28] (Logitech)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15680 2006-11-01] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [47632 2009-10-20] (CACE Technologies, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-08-28] (TuneUp Software)
S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [20480 2010-08-24] (Motorola)
S3 VaneFltr; C:\Windows\System32\drivers\Lachesis.sys [30336 2007-08-17] (Razer (Asia-Pacific) Pte Ltd)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-26 14:51 - 2014-01-26 14:51 - 00032737 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-26 14:35 - 2014-01-26 14:35 - 00001101 _____ C:\Users\Robert\Desktop\JRT.txt
2014-01-26 14:29 - 2014-01-26 14:29 - 00000000 ____D C:\Windows\ERUNT
2014-01-26 14:28 - 2014-01-26 14:28 - 00006466 _____ C:\Users\Robert\Desktop\AdwCleaner[S0].txt
2014-01-26 14:22 - 2014-01-26 14:23 - 00000000 ____D C:\AdwCleaner
2014-01-26 14:11 - 2014-01-26 14:11 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-26 14:10 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-26 14:09 - 2014-01-26 14:09 - 01037068 _____ (Thisisu) C:\Users\Robert\Desktop\JRT.exe
2014-01-26 14:08 - 2014-01-26 14:08 - 02078208 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-26 14:07 - 2014-01-26 14:07 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Robert\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-26 14:07 - 2014-01-26 14:07 - 01236282 _____ C:\Users\Robert\Desktop\adwcleaner.exe
2014-01-26 02:55 - 2014-01-26 02:55 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-26 02:55 - 2014-01-26 02:54 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-26 02:55 - 2014-01-26 02:54 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-26 02:55 - 2014-01-26 02:54 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-26 02:54 - 2014-01-26 02:54 - 00000000 ____D C:\Program Files\Java
2014-01-26 00:02 - 2014-01-26 00:02 - 00000488 __RSH C:\ProgramData\ntuser.pol
2014-01-25 13:19 - 2014-01-25 13:19 - 00032474 _____ C:\ComboFix.txt
2014-01-25 13:10 - 2014-01-25 13:19 - 00000000 ____D C:\Qoobox
2014-01-25 13:10 - 2014-01-25 13:18 - 00000000 ____D C:\Windows\erdnt
2014-01-25 13:10 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-25 13:10 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-25 13:10 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-25 13:06 - 2014-01-25 13:06 - 05175240 ____R (Swearware) C:\Users\Robert\Desktop\ComboFix.exe
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:09 - 2014-01-26 14:08 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-21 21:57 - 2014-01-21 22:15 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:51 - 2014-01-19 22:36 - 00000000 ____D C:\Profi cash
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:19 - 2014-01-19 17:18 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-26 14:47 - 00739420 _____ C:\Windows\setupact.log
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-26 14:25 - 00008158 _____ C:\Windows\PFRO.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-15 16:22 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 16:22 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 16:22 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18310112 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
==================== One Month Modified Files and Folders =======
2014-01-26 14:51 - 2014-01-26 14:51 - 00032737 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-26 14:51 - 2012-09-16 13:47 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job
2014-01-26 14:47 - 2014-01-18 15:26 - 00739420 _____ C:\Windows\setupact.log
2014-01-26 14:47 - 2012-11-24 16:45 - 00000000 ____D C:\ProgramData\VMware
2014-01-26 14:47 - 2009-08-13 22:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-26 14:46 - 2009-08-05 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-26 14:46 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-26 14:44 - 2009-12-11 17:22 - 01940945 _____ C:\Windows\WindowsUpdate.log
2014-01-26 14:35 - 2014-01-26 14:35 - 00001101 _____ C:\Users\Robert\Desktop\JRT.txt
2014-01-26 14:34 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-26 14:34 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-26 14:29 - 2014-01-26 14:29 - 00000000 ____D C:\Windows\ERUNT
2014-01-26 14:28 - 2014-01-26 14:28 - 00006466 _____ C:\Users\Robert\Desktop\AdwCleaner[S0].txt
2014-01-26 14:26 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-26 14:25 - 2014-01-18 15:25 - 00008158 _____ C:\Windows\PFRO.log
2014-01-26 14:23 - 2014-01-26 14:22 - 00000000 ____D C:\AdwCleaner
2014-01-26 14:11 - 2014-01-26 14:11 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-26 14:09 - 2014-01-26 14:09 - 01037068 _____ (Thisisu) C:\Users\Robert\Desktop\JRT.exe
2014-01-26 14:08 - 2014-01-26 14:08 - 02078208 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-26 14:08 - 2014-01-24 20:09 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-26 14:07 - 2014-01-26 14:07 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Robert\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-26 14:07 - 2014-01-26 14:07 - 01236282 _____ C:\Users\Robert\Desktop\adwcleaner.exe
2014-01-26 14:02 - 2010-03-07 03:07 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{17212944-8BF8-4509-BFF6-0D177AC05DDE}
2014-01-26 03:26 - 2013-04-08 10:59 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-26 02:55 - 2014-01-26 02:55 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-26 02:54 - 2014-01-26 02:55 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-26 02:54 - 2014-01-26 02:55 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-26 02:54 - 2014-01-26 02:55 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-26 02:54 - 2014-01-26 02:54 - 00000000 ____D C:\Program Files\Java
2014-01-26 00:51 - 2012-09-16 13:47 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job
2014-01-26 00:02 - 2014-01-26 00:02 - 00000488 __RSH C:\ProgramData\ntuser.pol
2014-01-25 13:19 - 2014-01-25 13:19 - 00032474 _____ C:\ComboFix.txt
2014-01-25 13:19 - 2014-01-25 13:10 - 00000000 ____D C:\Qoobox
2014-01-25 13:19 - 2010-07-15 17:23 - 00000000 ____D C:\Users\Robert\AppData\Local\Apps\2.0
2014-01-25 13:18 - 2014-01-25 13:10 - 00000000 ____D C:\Windows\erdnt
2014-01-25 13:17 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-25 13:06 - 2014-01-25 13:06 - 05175240 ____R (Swearware) C:\Users\Robert\Desktop\ComboFix.exe
2014-01-25 00:51 - 2009-08-27 15:10 - 00000000 ___RD C:\Users\Robert\Wichtiges
2014-01-24 22:48 - 2013-09-15 15:53 - 00000000 ____D C:\Users\Robert\AppData\Local\Deployment
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-24 20:09 - 2009-12-11 17:03 - 00000000 ____D C:\Users\Robert
2014-01-24 20:08 - 2011-06-27 16:17 - 00000000 ____D C:\Users\Robert\AppData\Local\PMB Files
2014-01-23 23:48 - 2012-10-03 00:08 - 00000000 ____D C:\Users\Robert\AppData\Roaming\vlc
2014-01-23 07:44 - 2011-03-31 17:32 - 00003694 _____ C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-01-22 19:33 - 2009-07-14 18:58 - 00747994 _____ C:\Windows\system32\perfh007.dat
2014-01-22 19:33 - 2009-07-14 18:58 - 00170676 _____ C:\Windows\system32\perfc007.dat
2014-01-22 19:33 - 2009-07-14 06:13 - 01751820 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-22 16:28 - 2009-08-05 18:41 - 00000000 ___RD C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-22 10:30 - 2013-07-12 15:42 - 00000000 ____D C:\Users\Robert\AppData\Local\TSVNCache
2014-01-21 22:15 - 2014-01-21 21:57 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 22:36 - 2014-01-19 20:51 - 00000000 ____D C:\Profi cash
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:52 - 2006-11-02 13:34 - 00000237 _____ C:\Windows\win.ini
2014-01-19 20:49 - 2012-09-15 20:17 - 00000000 ____D C:\Users\Robert\AppData\Roaming\QuickScan
2014-01-19 20:11 - 2013-10-17 15:47 - 00620640 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-19 20:11 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-01-19 20:11 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:27 - 2009-12-02 12:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2014-01-19 17:19 - 2011-01-20 12:32 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2014-01-19 17:18 - 2014-01-19 17:19 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-19 03:14 - 2013-04-19 18:24 - 00768000 ___SH C:\Users\Robert\Thumbs.db
2014-01-19 03:06 - 2013-07-12 14:27 - 00000000 ____D C:\Users\Robert\AppData\Local\Package Cache
2014-01-19 00:47 - 2010-02-03 15:13 - 00000000 ____D C:\Users\Robert\AppData\Roaming\TS3Client
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 08:24 - 2009-12-11 18:16 - 00003704 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2014-01-18 08:13 - 2013-06-22 18:18 - 00000000 ____D C:\Users\Robert\Desktop\WOW WICHTIG!
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 07:54 - 2013-07-01 22:56 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-17 21:58 - 2009-08-14 17:31 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Skype
2014-01-17 21:57 - 2011-05-12 18:30 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-17 21:57 - 2009-08-13 21:42 - 00000000 ____D C:\ProgramData\Skype
2014-01-17 21:53 - 2012-09-15 18:43 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2014-01-17 20:36 - 2009-12-11 17:02 - 01725164 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-17 20:34 - 2013-08-17 03:45 - 00000000 ____D C:\Windows\system32\MRT
2014-01-17 20:31 - 2010-01-14 17:47 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 15:52 - 2012-09-16 14:21 - 00002362 _____ C:\Users\Robert\Desktop\Google Chrome.lnk
2014-01-13 20:23 - 2009-10-24 17:27 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2014-01-11 20:04 - 2013-07-12 14:25 - 00000000 ____D C:\Users\Robert\Downloads\HonorB
2014-01-11 00:52 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Local\VMware
2014-01-09 20:45 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Roaming\VMware
2014-01-04 15:37 - 2013-07-12 15:51 - 00000000 ____D C:\Users\Robert\AppData\Local\HonorbuddyMeshes
Some content of TEMP:
====================
C:\Users\Robert\AppData\Local\Temp\avgnt.exe
C:\Users\Robert\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-19 00:16
==================== End Of Log ============================
--- --- --- --- --- --- Ich weiß nicht genau wie weit wir sind, aber wenn wir mit dem PC an sich fertig sind könntest du mir dann noch kurz bei 3 Sachen helfen? 1. Meine externe Festplatte ( mit einer Sicherung dieses PC's ) und meine USB Sticks bereinigen? ( Die Sicherung ist mir egal die werde ich dann sowieso löschen, aber die anderen Daten sollten erhalten bleiben ) 2. Vielleicht so ne kleine Hilfestellung bzw. ein Programm wie ich das in Zukunft besser machen kann. Z.B. habe ich bei AdwCleaner gesehen, dass man bspw. Hosts Anti-PUP/Adware installieren sollte. 3. Ist MBAM ein Programm, dass man sich anschaffen sollte? Um das System öfters mal damit zu scannen? |
|
27.01.2014, 10:02
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: E-Mail Adresse war betroffen / Verdacht auf MalwareESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware |
|
28.01.2014, 06:00
| #7 |
| | Windows 7: E-Mail Adresse war betroffen / Verdacht auf MalwareCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=cc800ab1afc9c2499daf167e727c9a78
# engine=16820
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-28 02:58:54
# local_time=2014-01-28 03:58:54 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 17245011 142507784 0 0
# scanned=272208
# found=0
# cleaned=0
# scan_time=12592
Allerdings habe ich ESET nicht direkt wieder deinstalliert macht das einen Unterschied? Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Kaspersky Internet Security Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 TuneUp Utilities 2013 TuneUp Utilities Language Pack (de-DE) TuneUp Utilities 2013 TuneUp Utilities Language Pack (de-DE) Adobe Flash Player 11.9.900.170 Adobe Reader 10.1.9 Adobe Reader out of Date! Mozilla Firefox 17.0.1 Firefox out of Date! Google Chrome 32.0.1700.72 Google Chrome 32.0.1700.76 ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe Kaspersky Lab Kaspersky Internet Security 14.0.0 avp.exe Kaspersky Lab Kaspersky Internet Security 14.0.0 avpui.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-01-2014 02
Ran by Robert (administrator) on ROBERT-PC on 28-01-2014 05:56:12
Running from C:\Users\Robert\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Gainward Co.) C:\Program Files (x86)\EXPERTool\TBPANEL.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer_Service.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\SetPoint\SetPoint.exe
() C:\Program Files (x86)\Logitech\SetPoint\x86\SetPoint32.exe
() C:\Program Files (x86)\ASUS\TurboV\TurboV.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(Logitech(c)) C:\Program Files (x86)\Logitech\G35\G35.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [TurboV] - C:\Program Files (x86)\ASUS\TurboV\TurboV.exe [4040192 2008-10-21] ()
HKLM-x32\...\Run: [Logitech G35] - C:\Program Files (x86)\Logitech\G35\G35.exe [1811728 2009-06-30] (Logitech(c))
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2008-04-15] (Analog Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-03-28] (DivX, LLC)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logitech\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [GAINWARD] - C:\Program Files (x86)\EXPERTool\TBPanel.exe [2181672 2009-05-12] (Gainward Co.)
HKCU\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-08-20] (Analog Devices, Inc.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1CF3E2E5C76FCA01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {7DDC945D-68E7-480A-B922-594CD4878A41} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Windows\SysWOW64\PrxerNsp.dll [56424] ()
Winsock: Catalog9 09 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 10 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 11 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 12 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 24 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog5-x64 07 %SystemRoot%\system32\PrxerNsp.dll [57448] ()
Winsock: Catalog9-x64 09 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 10 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 11 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 12 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 24 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://google.de/
FF NetworkProxy: "backup.ftp", "58.20.127.100"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "58.20.127.100"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "58.20.127.100"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "80.193.214.239"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "80.193.214.239"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "80.193.214.239"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "80.193.214.239"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 1
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 - C:\Users\Robert\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1002170-0-npoctoshape.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Robert\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Adblock Plus - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-04]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2011-01-20]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2011-01-20]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-10-27]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-01]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-19]
Chrome:
=======
CHR HomePage:
CHR DefaultSearchKeyword: google.de_
CHR DefaultSearchURL: hxxp://www.google.de/search?q={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Free Studio) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\np_dvs_plugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (ijji Web Launching Plugin for FF) - C:\Program Files (x86)\Mozilla Firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
CHR Plugin: (Octoshape Streaming Services) - C:\Users\Robert\AppData\Roaming\Mozilla\plugins\npoctoshape.dll (Octoshape ApS)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Google Update) - C:\Users\Robert\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (ProxTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-01-19]
CHR Extension: (Google Drive) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-09-16]
CHR Extension: (Brushed) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg [2013-03-27]
CHR Extension: (YouTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-09-16]
CHR Extension: (Google-Suche) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-09-16]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2012-09-16]
CHR Extension: (AdBlock) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-09-16]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2013-01-21]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-01-19]
CHR Extension: (Virtuelle Tastatur) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2012-09-16]
CHR Extension: (FVD Downloader) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2012-11-04]
CHR Extension: (Google Wallet) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-09-16]
CHR Extension: (NotScripts) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2012-09-29]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2012-11-01]
CHR Extension: (Google Mail) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-09-16]
CHR Extension: (Anti-Banner) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2012-09-16]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Robert\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx [2012-09-15]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896056 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [86016 2008-08-15] ()
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
S4 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [678416 2012-11-14] ()
S3 LBTServ; C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe [160784 2009-07-20] (Logitech, Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-01] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
R2 TeamViewer8; E:\Programme\Teamviewer\TeamViewer_Service.exe [5087584 2013-10-01] (TeamViewer GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2409272 2013-12-10] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)
S3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2009-12-03] (Turtle Entertainment GmbH)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [160784 2012-11-14] (<Turtle Entertainment>)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-19] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620640 2014-01-19] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-01-19] (Kaspersky Lab ZAO)
R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [61712 2009-05-28] (Logitech)
R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [376848 2009-05-28] (Logitech)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15680 2006-11-01] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [47632 2009-10-20] (CACE Technologies, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-08-28] (TuneUp Software)
S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [20480 2010-08-24] (Motorola)
S3 VaneFltr; C:\Windows\System32\drivers\Lachesis.sys [30336 2007-08-17] (Razer (Asia-Pacific) Pte Ltd)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-28 05:56 - 2014-01-28 05:56 - 00032529 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-28 05:54 - 2014-01-28 05:54 - 00001226 _____ C:\Users\Robert\Desktop\checkup.txt
2014-01-28 05:53 - 2014-01-28 05:53 - 02079232 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-28 00:26 - 2014-01-28 00:26 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-27 19:20 - 2014-01-27 19:20 - 00987425 _____ C:\Users\Robert\Desktop\SecurityCheck.exe
2014-01-26 14:29 - 2014-01-26 14:29 - 00000000 ____D C:\Windows\ERUNT
2014-01-26 14:22 - 2014-01-26 14:23 - 00000000 ____D C:\AdwCleaner
2014-01-26 14:11 - 2014-01-26 14:11 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-26 14:10 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-26 02:55 - 2014-01-26 02:55 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-26 02:55 - 2014-01-26 02:54 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-26 02:55 - 2014-01-26 02:54 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-26 02:55 - 2014-01-26 02:54 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-26 02:54 - 2014-01-26 02:54 - 00000000 ____D C:\Program Files\Java
2014-01-26 00:02 - 2014-01-26 00:02 - 00000488 __RSH C:\ProgramData\ntuser.pol
2014-01-25 13:19 - 2014-01-25 13:19 - 00032474 _____ C:\ComboFix.txt
2014-01-25 13:10 - 2014-01-25 13:19 - 00000000 ____D C:\Qoobox
2014-01-25 13:10 - 2014-01-25 13:18 - 00000000 ____D C:\Windows\erdnt
2014-01-25 13:10 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-25 13:10 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-25 13:10 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-25 13:10 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-25 13:06 - 2014-01-25 13:06 - 05175240 ____R (Swearware) C:\Users\Robert\Desktop\ComboFix.exe
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:09 - 2014-01-28 05:52 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-21 21:57 - 2014-01-21 22:15 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:51 - 2014-01-19 22:36 - 00000000 ____D C:\Profi cash
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:19 - 2014-01-19 17:18 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-27 18:58 - 00791999 _____ C:\Windows\setupact.log
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-26 14:25 - 00008158 _____ C:\Windows\PFRO.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-15 16:22 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 16:22 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 16:22 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18310112 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
==================== One Month Modified Files and Folders =======
2014-01-28 05:56 - 2014-01-28 05:56 - 00032529 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-28 05:54 - 2014-01-28 05:54 - 00001226 _____ C:\Users\Robert\Desktop\checkup.txt
2014-01-28 05:53 - 2014-01-28 05:53 - 02079232 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-28 05:52 - 2014-01-24 20:09 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-28 05:51 - 2012-09-16 13:47 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job
2014-01-28 05:26 - 2013-04-08 10:59 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-28 05:22 - 2009-08-13 22:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-28 03:00 - 2009-12-11 17:22 - 01958735 _____ C:\Windows\WindowsUpdate.log
2014-01-28 01:42 - 2010-03-07 03:07 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{17212944-8BF8-4509-BFF6-0D177AC05DDE}
2014-01-28 00:59 - 2012-09-16 13:47 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job
2014-01-28 00:26 - 2014-01-28 00:26 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-27 19:27 - 2009-07-14 18:58 - 00747994 _____ C:\Windows\system32\perfh007.dat
2014-01-27 19:27 - 2009-07-14 18:58 - 00170676 _____ C:\Windows\system32\perfc007.dat
2014-01-27 19:27 - 2009-07-14 06:13 - 01751820 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-27 19:20 - 2014-01-27 19:20 - 00987425 _____ C:\Users\Robert\Desktop\SecurityCheck.exe
2014-01-27 19:05 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-27 19:05 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-27 18:58 - 2014-01-18 15:26 - 00791999 _____ C:\Windows\setupact.log
2014-01-27 18:58 - 2012-11-24 16:45 - 00000000 ____D C:\ProgramData\VMware
2014-01-27 18:58 - 2009-08-05 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-27 18:58 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-26 14:29 - 2014-01-26 14:29 - 00000000 ____D C:\Windows\ERUNT
2014-01-26 14:26 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-26 14:25 - 2014-01-18 15:25 - 00008158 _____ C:\Windows\PFRO.log
2014-01-26 14:23 - 2014-01-26 14:22 - 00000000 ____D C:\AdwCleaner
2014-01-26 14:11 - 2014-01-26 14:11 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-26 14:10 - 2014-01-26 14:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-26 02:55 - 2014-01-26 02:55 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-26 02:54 - 2014-01-26 02:55 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-26 02:54 - 2014-01-26 02:55 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-26 02:54 - 2014-01-26 02:55 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-26 02:54 - 2014-01-26 02:54 - 00000000 ____D C:\Program Files\Java
2014-01-26 00:02 - 2014-01-26 00:02 - 00000488 __RSH C:\ProgramData\ntuser.pol
2014-01-25 13:19 - 2014-01-25 13:19 - 00032474 _____ C:\ComboFix.txt
2014-01-25 13:19 - 2014-01-25 13:10 - 00000000 ____D C:\Qoobox
2014-01-25 13:19 - 2010-07-15 17:23 - 00000000 ____D C:\Users\Robert\AppData\Local\Apps\2.0
2014-01-25 13:18 - 2014-01-25 13:10 - 00000000 ____D C:\Windows\erdnt
2014-01-25 13:17 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-25 13:06 - 2014-01-25 13:06 - 05175240 ____R (Swearware) C:\Users\Robert\Desktop\ComboFix.exe
2014-01-25 00:51 - 2009-08-27 15:10 - 00000000 ___RD C:\Users\Robert\Wichtiges
2014-01-24 22:48 - 2013-09-15 15:53 - 00000000 ____D C:\Users\Robert\AppData\Local\Deployment
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-24 20:09 - 2009-12-11 17:03 - 00000000 ____D C:\Users\Robert
2014-01-24 20:08 - 2011-06-27 16:17 - 00000000 ____D C:\Users\Robert\AppData\Local\PMB Files
2014-01-23 23:48 - 2012-10-03 00:08 - 00000000 ____D C:\Users\Robert\AppData\Roaming\vlc
2014-01-23 07:44 - 2011-03-31 17:32 - 00003694 _____ C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-22 16:28 - 2009-08-05 18:41 - 00000000 ___RD C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-22 10:30 - 2013-07-12 15:42 - 00000000 ____D C:\Users\Robert\AppData\Local\TSVNCache
2014-01-21 22:15 - 2014-01-21 21:57 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 22:36 - 2014-01-19 20:51 - 00000000 ____D C:\Profi cash
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:52 - 2006-11-02 13:34 - 00000237 _____ C:\Windows\win.ini
2014-01-19 20:49 - 2012-09-15 20:17 - 00000000 ____D C:\Users\Robert\AppData\Roaming\QuickScan
2014-01-19 20:11 - 2013-10-17 15:47 - 00620640 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-19 20:11 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-01-19 20:11 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:27 - 2009-12-02 12:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2014-01-19 17:19 - 2011-01-20 12:32 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2014-01-19 17:18 - 2014-01-19 17:19 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-19 03:14 - 2013-04-19 18:24 - 00768000 ___SH C:\Users\Robert\Thumbs.db
2014-01-19 03:06 - 2013-07-12 14:27 - 00000000 ____D C:\Users\Robert\AppData\Local\Package Cache
2014-01-19 00:47 - 2010-02-03 15:13 - 00000000 ____D C:\Users\Robert\AppData\Roaming\TS3Client
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 08:24 - 2009-12-11 18:16 - 00003704 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2014-01-18 08:13 - 2013-06-22 18:18 - 00000000 ____D C:\Users\Robert\Desktop\WOW WICHTIG!
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 07:54 - 2013-07-01 22:56 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-17 21:58 - 2009-08-14 17:31 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Skype
2014-01-17 21:57 - 2011-05-12 18:30 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-17 21:57 - 2009-08-13 21:42 - 00000000 ____D C:\ProgramData\Skype
2014-01-17 21:53 - 2012-09-15 18:43 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2014-01-17 20:36 - 2009-12-11 17:02 - 01725164 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-17 20:34 - 2013-08-17 03:45 - 00000000 ____D C:\Windows\system32\MRT
2014-01-17 20:31 - 2010-01-14 17:47 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 15:52 - 2012-09-16 14:21 - 00002362 _____ C:\Users\Robert\Desktop\Google Chrome.lnk
2014-01-13 20:23 - 2009-10-24 17:27 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2014-01-11 20:04 - 2013-07-12 14:25 - 00000000 ____D C:\Users\Robert\Downloads\HonorB
2014-01-11 00:52 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Local\VMware
2014-01-09 20:45 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Roaming\VMware
2014-01-04 15:37 - 2013-07-12 15:51 - 00000000 ____D C:\Users\Robert\AppData\Local\HonorbuddyMeshes
Some content of TEMP:
====================
C:\Users\Robert\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-19 00:16
==================== End Of Log ============================
|
|
28.01.2014, 15:50
| #8 | |
| /// the machine /// TB-Ausbilder | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware ESET kannste jetzt deinstallieren. Adobe und Firefox updaten. Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.01.2014, 21:11
| #9 |
| | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware Also den oberen Proxy ( 58.20.127.100:3128 ) kenn ich jetzt ned, aber den unteren ( 80.193.214.239:3128 ) müsste ich gesetzt haben ja. Ich benutze Firefox eig nie ich benutze eig immer Chrome. Den Proxy in Firefox benutze ich manchmal wenn ich mir mal nen Video in Youtube anschauen will. Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Kaspersky Internet Security Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 TuneUp Utilities 2013 TuneUp Utilities Language Pack (de-DE) TuneUp Utilities 2013 TuneUp Utilities Language Pack (de-DE) Adobe Flash Player 12.0.0.43 Flash Player out of Date! Adobe Reader XI Mozilla Firefox (26.0) Google Chrome 32.0.1700.102 Google Chrome 32.0.1700.76 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe Kaspersky Lab Kaspersky Internet Security 14.0.0 avp.exe Kaspersky Lab Kaspersky Internet Security 14.0.0 avpui.exe Kaspersky Lab Kaspersky Internet Security 14.0.0 klwtblfs.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Wenn ich auf die HP von Adobe gehe ( ich muss dazu sagen, dass ich gerade gerade die aktuellste Version installiert hab ) dann zeigt er mir wenn ich mit Chrome auf die Seite gehe, dass ich die Version 12.0.0.41 habe und das ist auch die aktuellste Version für Chrome. Wenn ich mit Firefox auf die Seite gehe, dann zeigt er mir an, dass ich die Version 12.0.0.43 habe und das ist beim Firefox ja auch die aktuellste Version. Also ka warum der "out of Date" sein soll. 1 Frage hätte ich gerade noch. Hat das mit Defogger oder ähnlichem zutun, dass TuneUp Utilities plötzlich anzeigt das die Administrative Freigabe aktiviert ist und er diese deaktivieren will? Geändert von Necro0 (28.01.2014 um 21:00 Uhr) |
|
29.01.2014, 12:20
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware Das kommt von einem unserer Tools, ändern wir beim Aufräumen. SecurtiyCheck ignorieren, das spinnt manchmal. und Finger weg von Tune Up Müll, ausser du hast vor den Rechner früher oder später zu toasten. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.01.2014, 22:42
| #11 | |
| | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware Hi Schrauber, Zitat:
erledigt! Jetzt hätte ich aber doch noch paar Fragen, wenn das in Ordnung ist. 1. In jedem Thema, dass ich lese wird immer nur Opera und Firefox als alternativen zum IE aufgeführt. Ich benutze eigentlich schon sehr lange Google Chrome mit AdBlock, NotScripts und jetzt auch WOT. Ich habe jetzt aber aufgrund der Hinweise mal den Firefox komplett neu installiert. Danach habe ich die vorgeschlagenen Addons installiert und in den Einstellungen z.B. die Verfolgung ausgemacht. Sollte ich lieber Mozilla Firefox verwenden und wenn ja was hat dieser für einen Vorteil gegenüber dem Chrome Browser? 2. Mir ist aufgefallen, dass in der Quarantäne von MBAM immer noch die 2 gefundenen Objekte enthalten sind. Sollte ich da noch einen weiteren Schritt durchführen oder ist das so korrekt? 3. Ist als Firewall die Kaspersky Firewall ausreichend oder sollte man sich noch eine extra Firewall anschaffen und dafür dann die Kaspersky Firewall ausschalten? 4. Kannst du mir zufällig sagen, wie ich am besten die Sicherung auf der Festplatte lösche? Kann ich bei einer Sicherung auch einfach "löschen"? 5. und letztens. Kann ich zum aktuellen Zeitpunkt davon ausgehen, dass mein System, meine USB Sticks und meine externe Festplatte frei von Malware sind? Mit freundlichen Grüßen und einem sehr sehr großen DANKESCHÖN!!!!  Necro |
|
30.01.2014, 16:46
| #12 | |||||
| /// the machine /// TB-Ausbilder | Windows 7: E-Mail Adresse war betroffen / Verdacht auf MalwareZitat:
Zitat:
Zitat:
Zitat:
Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.01.2014, 17:42
| #13 |
| | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware Also abschließend nochmal VIELEN DANK SCHRAUBER!!^^ |
|
01.02.2014, 11:28
| #14 |
| /// the machine /// TB-Ausbilder | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.02.2014, 18:09
| #15 |
| | Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware Hi, jetzt müsste ich dich wenn es ok ist doch noch einmal belästigen.^^ Also seit ich mit den letzten Punkten die ganzen Programme/Anwendungen wieder von meinem PC gelöscht habe, startet sich Kaspersky Internet Security 2014 nicht mehr automatisch beim hochfahren des BS. Wenn ich es dann manuell starten will " als Admin ausführen" dann kommt, dass ich keinen Zugriff darauf habe. Erst wenn ich es über die als Admin gestartete Eingabeauff. starte funktioniert es. Gestern hat es beim Neustarten des Rechners auch funktioniert. Sprich Rechner hochgefahren KIS 14 startete nicht-> Neustart->KIS 14 startet. An was könnte das liegen? Davor hat es problemlos funktioniert. |
|
| Themen zu Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware |
| adblock, antivir, antivirus, avira, browser, converter, downloader, dvdvideosoft ltd., e-mail, ebanking, email, error, fehler, flash player, helper, homepage, kaspersky, klelam.sys, malware, mozilla, mp3, ntdll.dll, registry, scan, security, software, svchost.exe, system, tastatur, windows |
Linear-Darstellung
