| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Download Protect 2.2 im Browser!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
03.04.2014, 11:58
| #1 |
| |  Download Protect 2.2 im Browser! Heio Community! Seit nun mehr als zwei Wochen ist nun Download Protect 2.2 in der Add-On-Liste meines Feuerfuchses installiert und sorgt häufig für das Löschen meiner gesamten Add-Ons und Abstürzen des Browsers im Minutentakt. Hab schon vieles versucht, unter anderem hab ich Malwarebytes und AdwCleaner und auch den ESET Scanner drübergucken lassen, aber keiner der Scanner hat bis jetzt etwas gefunden. Ich bin für jede Hilfe mehr als dankbar und freue mich wirklich über jede Hilfestellung, die ihr mir geben könnt. Liebe Grüße, Laisolong! Geändert von Laisolong (03.04.2014 um 12:43 Uhr) |
|
03.04.2014, 12:22
| #2 |
| /// the machine /// TB-Ausbilder    | Download Protect 2.2 im Browser! hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
03.04.2014, 12:42
| #3 |
| | Download Protect 2.2 im Browser! Vielen, vielen Dank für die Antwort! Hab ein Logfile erstellt bekommen, und unter Extensions bei Feuerfuchs und Chrome war Download Protect eingetragen. Ordner gelöscht und mit TFC Reste beseitigt. Kann ich sonst noch etwas tun oder ist damit gesichert, dass das Mistding nie wieder einen Fuss auf meinen Rechner setzt?
__________________ |
|
04.04.2014, 09:34
| #4 |
| /// the machine /// TB-Ausbilder | Download Protect 2.2 im Browser! Gesichert ist gar nix solange ich die Logs nit sehe 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.04.2014, 12:20
| #5 |
| | Download Protect 2.2 im Browser! FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by User (administrator) on USER-PC on 04-04-2014 13:00:35
Running from C:\Users\User\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
() C:\Windows\system32\MSAC3EOC.exe
(NVIDIA) C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtWlan.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2182144 2009-06-17] (VIA)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-03-21] (Microsoft Corporation)
HKU\S-1-5-21-1286391921-2359739017-786261735-1000\...\Policies\Explorer: [DisallowRun] 1
HKU\S-1-5-21-1286391921-2359739017-786261735-1000\...\MountPoints2: {470ea85f-4eaa-11e3-ad2b-d3dcd95c5947} - F:\DieVölker2GE.exe
HKU\S-1-5-21-1286391921-2359739017-786261735-1000\...\MountPoints2: {e32c9203-fb14-11de-b802-806e6f6e6963} - E:\StartUp.exe
HKU\S-1-5-21-1286391921-2359739017-786261735-1000\...\MountPoints2: {fa101aa8-79d3-11e2-a5d9-8402d73e1e44} - F:\Startme.exe
Startup: C:\Users\Privat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
ProxyServer: localhost:21320
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{9908A390-79DE-4B21-92BA-FF204DB8FED8}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default
FF DefaultSearchEngine: eBay
FF SelectedSearchEngine: eBay
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus Pop-up Addon - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-04-03]
FF Extension: anonymoX - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\client@anonymox.net.xpi [2014-04-02]
FF Extension: YouTube Video and Audio Downloader - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\feca4b87-3be4-43da-a1b1-137c24220968@jetpack.xpi [2014-04-03]
FF Extension: Ghostery - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\firefox@ghostery.com.xpi [2014-04-03]
FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-02]
FF HKLM\...\Firefox\Extensions: [{121C6AF3-6778-4360-AFDB-57BD4E3E4343}] - C:\Program Files\Playzy\Firefox
FF HKLM\...\Firefox\Extensions: [{14DD0E04-D4F6-45d2-A958-F361FBD4F64F}] - C:\Program Files\WBC Engine\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFF [2013-10-10]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\ []
FF HKLM-x32\...\Firefox\Extensions: [{D7147CE7-24AC-4800-AFBE-AC95185ADD7C}] - C:\Windows\Installer\{B29D5059-C608-4D50-9936-A65984517A6F}\{D7147CE7-24AC-4800-AFBE-AC95185ADD7C}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{45544AB0-68F0-4ADE-8371-844283A04D37}] - C:\Windows\Installer\{44E19A6E-7D08-4D6C-AA35-15CCA59FF785}\{45544AB0-68F0-4ADE-8371-844283A04D37}.xpi
Chrome:
=======
CHR HomePage: hxxp://www.google.de?hl=de&gl=de
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\User\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx []
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx [2014-04-03]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 Realtek11nCU; C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe [36864 2010-04-16] (Realtek)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 timeoutd; C:\Windows\system32\MSAC3EOC.exe [114688 2013-06-14] ()
R2 UpdateCenterService; C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe [282728 2009-11-06] (NVIDIA)
==================== Drivers (Whitelisted) ====================
S3 ASPI; C:\Windows\SysWOW64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-01-15] ()
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-01-02] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20140403.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-01-15] ()
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-11] (ManyCam LLC)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] ()
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20140403.032\ENG64.SYS [126040 2014-03-12] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20140403.032\EX64.SYS [2099288 2014-03-12] (Symantec Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [47632 2010-01-27] (CACE Technologies, Inc.)
R3 nvoclk64; C:\Windows\System32\DRIVERS\nvoclk64.sys [42088 2009-09-15] (NVIDIA Corp.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation )
R2 SecDrv; C:\Windows\SysWOW64\drivers\SECDRV.SYS [11376 2002-10-21] ()
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-15] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-01-28] (Symantec Corporation)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-20] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-01-30] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-08-01] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [43680 2012-11-15] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2012-11-15] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
S2 tandpl; C:\Windows\SysWOW64\drivers\tandpl.sys [4736 2003-04-19] ()
R1 vmm; C:\Windows\system32\Treiber\vmm.sys [296816 2007-02-18] (Microsoft Corporation)
U2 ccEvtMgr;
U2 ccSetMgr;
U3 navapsvc;
U3 SAVRT;
U1 SAVRTPEL;
U3 TlntSvr;
U2 wuaserv;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-03 19:49 - 2014-04-04 11:47 - 00000560 _____ () C:\Windows\setupact.log
2014-04-03 19:49 - 2014-04-03 19:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-03 17:45 - 2014-04-03 17:45 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-03 17:44 - 2014-04-03 17:44 - 04787368 _____ (Piriform Ltd) C:\Users\User\Downloads\ccsetup412.exe
2014-04-03 13:18 - 2014-04-03 13:18 - 00380416 _____ () C:\Users\User\Downloads\k01fg67r.exe
2014-04-03 13:03 - 2014-04-03 13:05 - 00050515 _____ () C:\Users\User\Downloads\Addition.txt
2014-04-03 13:02 - 2014-04-04 13:00 - 00018286 _____ () C:\Users\User\Downloads\FRST.txt
2014-04-03 13:02 - 2014-04-04 13:00 - 00000000 ____D () C:\FRST
2014-04-03 13:02 - 2014-04-03 13:02 - 00380416 _____ () C:\Users\User\Downloads\tyzuwgdb.exe
2014-04-03 13:01 - 2014-04-03 13:01 - 02157056 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-04-03 13:01 - 2014-04-03 13:01 - 01145856 _____ (Farbar) C:\Users\User\Downloads\FRST.exe
2014-04-03 12:43 - 2014-04-03 12:43 - 00448512 _____ (OldTimer Tools) C:\Users\User\Downloads\TFC.exe
2014-04-03 09:43 - 2014-04-03 09:43 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe
2014-04-02 20:55 - 2014-04-02 20:55 - 00001929 _____ () C:\Users\User\Desktop\Drakensang.lnk
2014-04-02 18:54 - 2014-04-02 18:54 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-03-31 15:52 - 2014-03-31 15:52 - 00002088 _____ () C:\{B0B5949C-2666-48DE-BE5B-225AB826C873}
2014-03-31 15:50 - 2014-03-31 15:50 - 00002136 _____ () C:\{8A0B66BD-D375-4BEF-8BA0-E29B7090A54D}
2014-03-31 15:46 - 2014-03-31 15:46 - 00002128 _____ () C:\{C5A3030C-4F69-463E-88FA-5D99EB49E715}
2014-03-31 15:42 - 2014-03-31 15:42 - 00002160 _____ () C:\{B0C8FB38-F1CE-4BBF-911D-D503E8DDF0F0}
2014-03-31 15:38 - 2014-03-31 15:38 - 00002168 _____ () C:\{74D4CF7E-3A62-460D-9F6E-B2EF38998DCA}
2014-03-31 15:35 - 2014-03-31 15:35 - 00002160 _____ () C:\{52081577-7905-4723-AC25-FF9FE65B2A82}
2014-03-31 15:29 - 2014-03-31 15:29 - 00002376 _____ () C:\{F93246E9-18A2-47C4-A90D-6C270A93C915}
2014-03-31 14:53 - 2014-03-31 14:53 - 00002656 _____ () C:\{B113D6B6-CA79-4389-8095-23F62C348123}
2014-03-31 14:51 - 2014-03-31 14:51 - 00002672 _____ () C:\{0713E16E-8D8E-4B10-BC25-1A92B2AA65FE}
2014-03-31 14:49 - 2014-03-31 14:49 - 00002416 _____ () C:\{AD30FAEB-8A15-4D16-9AA6-5B8D62F52837}
2014-03-31 14:47 - 2014-03-31 14:47 - 00002440 _____ () C:\{8E532289-3850-4103-831D-1FD071995237}
2014-03-31 14:28 - 2014-03-31 14:28 - 00002504 _____ () C:\{A0FE26E1-3CA3-432D-BAA8-43C9C96A3FF7}
2014-03-30 21:35 - 2014-03-30 21:36 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_enu.exe
2014-03-30 21:03 - 2014-03-30 21:03 - 00002392 _____ () C:\{CD8A38DB-9CF3-4DCD-BD3E-58D66B98416D}
2014-03-30 21:02 - 2014-03-30 21:02 - 00002248 _____ () C:\{6885A95F-E6E1-4A9D-AB2E-BAE8F9969240}
2014-03-30 20:13 - 2014-03-30 20:13 - 00003544 _____ () C:\{6F8E51E1-8F5D-40D4-ACD4-F1D5F93FC76C}
2014-03-30 20:11 - 2014-03-30 20:11 - 00003384 _____ () C:\{04D80F8C-75E3-4375-992B-22173FECC1B1}
2014-03-30 19:24 - 2014-03-30 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-03-30 19:23 - 2014-03-30 21:26 - 00000000 ____D () C:\Users\User\Desktop\mbar
2014-03-30 19:23 - 2014-03-30 19:23 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-30 19:20 - 2014-03-30 19:20 - 12589848 _____ (Malwarebytes Corp.) C:\Users\User\Downloads\mbar-1.07.0.1009.exe
2014-03-30 19:09 - 2014-03-30 19:09 - 00002816 _____ () C:\{881B3B77-D330-4BBE-9375-9C18EDE227AE}
2014-03-30 19:05 - 2014-03-30 19:05 - 00002984 _____ () C:\{65756D68-210C-4D18-8FFD-54FE0104AE20}
2014-03-30 13:35 - 2014-03-30 13:35 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-30 13:34 - 2014-04-03 17:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-30 13:34 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 13:18 - 2014-03-30 19:14 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-03-30 13:10 - 2014-03-30 13:10 - 00004051 _____ () C:\Users\User\Desktop\bookmarks-2014-03-30##
2014-03-30 12:57 - 2014-03-30 12:57 - 00000000 ____D () C:\Windows\ERUNT
2014-03-30 12:56 - 2014-03-30 12:56 - 01038974 _____ (Thisisu) C:\Users\User\Downloads\JRT.exe
2014-03-30 12:39 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-30 12:39 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-30 12:33 - 2014-03-30 12:33 - 00230780 _____ () C:\Users\User\Desktop\bookmarks-2014-03-30.json
2014-03-29 23:03 - 2014-03-29 23:03 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2014-03-29 23:02 - 2014-03-29 23:03 - 00283192 _____ (Mozilla) C:\Users\User\Downloads\Firefox Setup Stub 28.0.exe
2014-03-29 23:02 - 2014-03-29 23:02 - 00000000 ____D () C:\Games
2014-03-29 22:49 - 2014-03-29 22:49 - 00000000 ____D () C:\ProgramData\Oracle
2014-03-29 22:49 - 2013-12-18 22:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-03-29 22:49 - 2013-12-18 22:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-03-29 22:49 - 2013-12-18 22:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-03-29 22:49 - 2013-12-18 22:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-03-29 22:47 - 2014-03-29 22:49 - 00005933 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-29 19:25 - 2014-03-29 19:25 - 00045536 _____ () C:\Users\User\Downloads\Minecraft Cracked.rar
2014-03-27 16:54 - 2014-04-03 09:59 - 00000000 ____D () C:\AdwCleaner
2014-03-27 16:54 - 2014-03-27 16:54 - 00613200 ____H (Chip Digital GmbH) C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-26 17:01 - 2014-03-26 17:01 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 ____D () C:\Users\User\AppData\Local\cache
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 _____ () C:\Users\User\daemonprocess.txt
2014-03-21 18:25 - 2013-10-02 14:59 - 00000000 ____D () C:\Users\User\Desktop\Saltatio Mortis - Das schwarze IXI (2013) [320]
2014-03-21 17:30 - 2014-03-21 18:13 - 128367703 ____H () C:\Users\User\Downloads\Saltatio Mortis - Das schwarze IXI (2013) [320].rar
2014-03-14 16:55 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-14 16:55 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-14 16:55 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-14 16:55 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-14 16:55 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-14 16:55 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-14 16:55 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-14 16:55 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-14 16:55 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-14 16:55 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-14 16:55 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-14 16:55 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-14 16:55 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 16:55 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-14 16:55 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-14 16:55 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 16:55 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-14 16:55 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-14 16:55 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 16:55 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-14 16:55 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 16:55 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 16:55 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 16:55 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-14 16:55 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 16:55 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-14 16:55 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-14 16:55 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-14 16:55 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-14 16:55 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 16:55 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 16:55 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-14 16:55 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 16:55 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-14 16:55 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 16:55 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-14 16:55 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 16:55 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 16:55 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-14 16:55 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-14 16:31 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-14 16:31 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-12 20:58 - 2014-03-12 20:58 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 16:42 - 2014-03-12 16:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\LucasArts
2014-03-11 18:14 - 2014-03-04 13:32 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-03-11 18:10 - 2014-03-04 16:35 - 31474976 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 25255256 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 23716640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 17755424 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 12708128 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-03-11 18:10 - 2014-03-04 16:35 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 03143456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02958792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02783008 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02411976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00877856 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00863064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00846168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-03-07 17:44 - 2014-03-07 17:44 - 00096068 ____H () C:\Users\User\Downloads\binkw32.zip
==================== One Month Modified Files and Folders =======
2014-04-04 13:01 - 2014-04-03 13:02 - 00018286 _____ () C:\Users\User\Downloads\FRST.txt
2014-04-04 13:00 - 2014-04-03 13:02 - 00000000 ____D () C:\FRST
2014-04-04 12:56 - 2012-10-23 14:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-04 11:54 - 2009-07-14 06:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-04 11:54 - 2009-07-14 06:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-04 11:50 - 2010-01-07 00:46 - 01990095 _____ () C:\Windows\WindowsUpdate.log
2014-04-04 11:47 - 2014-04-03 19:49 - 00000560 _____ () C:\Windows\setupact.log
2014-04-04 11:47 - 2010-01-07 18:22 - 00000324 _____ () C:\Windows\Tasks\GlaryInitialize.job
2014-04-04 11:47 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-04 11:46 - 2010-07-01 21:58 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-04-03 19:49 - 2014-04-03 19:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-03 17:48 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-03 17:46 - 2011-05-29 11:47 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-03 17:46 - 2010-04-01 13:14 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2014-04-03 17:45 - 2014-04-03 17:45 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-03 17:45 - 2011-10-19 19:47 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2014-04-03 17:45 - 2010-01-07 17:55 - 00000000 ___RD () C:\Users\User\Desktop\Fehlerbehebung
2014-04-03 17:45 - 2010-01-07 00:42 - 00000000 ____D () C:\Windows\Panther
2014-04-03 17:44 - 2014-04-03 17:44 - 04787368 _____ (Piriform Ltd) C:\Users\User\Downloads\ccsetup412.exe
2014-04-03 17:44 - 2010-01-07 18:23 - 00000000 ____D () C:\Program Files (x86)\CCleaner
2014-04-03 17:08 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-03 13:18 - 2014-04-03 13:18 - 00380416 _____ () C:\Users\User\Downloads\k01fg67r.exe
2014-04-03 13:05 - 2014-04-03 13:03 - 00050515 _____ () C:\Users\User\Downloads\Addition.txt
2014-04-03 13:02 - 2014-04-03 13:02 - 00380416 _____ () C:\Users\User\Downloads\tyzuwgdb.exe
2014-04-03 13:01 - 2014-04-03 13:01 - 02157056 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-04-03 13:01 - 2014-04-03 13:01 - 01145856 _____ (Farbar) C:\Users\User\Downloads\FRST.exe
2014-04-03 12:43 - 2014-04-03 12:43 - 00448512 _____ (OldTimer Tools) C:\Users\User\Downloads\TFC.exe
2014-04-03 09:59 - 2014-03-27 16:54 - 00000000 ____D () C:\AdwCleaner
2014-04-03 09:43 - 2014-04-03 09:43 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe
2014-04-02 21:16 - 2011-01-14 19:25 - 00000000 ____D () C:\Program Files (x86)\Drakensang
2014-04-02 20:55 - 2014-04-02 20:55 - 00001929 _____ () C:\Users\User\Desktop\Drakensang.lnk
2014-04-02 18:54 - 2014-04-02 18:54 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-03-31 17:59 - 2010-01-07 20:53 - 00089704 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-31 16:22 - 2012-02-20 17:30 - 00000000 ____D () C:\Users\User\AppData\Roaming\DVDVideoSoft
2014-03-31 15:52 - 2014-03-31 15:52 - 00002088 _____ () C:\{B0B5949C-2666-48DE-BE5B-225AB826C873}
2014-03-31 15:50 - 2014-03-31 15:50 - 00002136 _____ () C:\{8A0B66BD-D375-4BEF-8BA0-E29B7090A54D}
2014-03-31 15:46 - 2014-03-31 15:46 - 00002128 _____ () C:\{C5A3030C-4F69-463E-88FA-5D99EB49E715}
2014-03-31 15:42 - 2014-03-31 15:42 - 00002160 _____ () C:\{B0C8FB38-F1CE-4BBF-911D-D503E8DDF0F0}
2014-03-31 15:38 - 2014-03-31 15:38 - 00002168 _____ () C:\{74D4CF7E-3A62-460D-9F6E-B2EF38998DCA}
2014-03-31 15:35 - 2014-03-31 15:35 - 00002160 _____ () C:\{52081577-7905-4723-AC25-FF9FE65B2A82}
2014-03-31 15:29 - 2014-03-31 15:29 - 00002376 _____ () C:\{F93246E9-18A2-47C4-A90D-6C270A93C915}
2014-03-31 14:53 - 2014-03-31 14:53 - 00002656 _____ () C:\{B113D6B6-CA79-4389-8095-23F62C348123}
2014-03-31 14:51 - 2014-03-31 14:51 - 00002672 _____ () C:\{0713E16E-8D8E-4B10-BC25-1A92B2AA65FE}
2014-03-31 14:49 - 2014-03-31 14:49 - 00002416 _____ () C:\{AD30FAEB-8A15-4D16-9AA6-5B8D62F52837}
2014-03-31 14:47 - 2014-03-31 14:47 - 00002440 _____ () C:\{8E532289-3850-4103-831D-1FD071995237}
2014-03-31 14:28 - 2014-03-31 14:28 - 00002504 _____ () C:\{A0FE26E1-3CA3-432D-BAA8-43C9C96A3FF7}
2014-03-30 21:36 - 2014-03-30 21:35 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_enu.exe
2014-03-30 21:26 - 2014-03-30 19:24 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-03-30 21:26 - 2014-03-30 19:23 - 00000000 ____D () C:\Users\User\Desktop\mbar
2014-03-30 21:03 - 2014-03-30 21:03 - 00002392 _____ () C:\{CD8A38DB-9CF3-4DCD-BD3E-58D66B98416D}
2014-03-30 21:02 - 2014-03-30 21:02 - 00002248 _____ () C:\{6885A95F-E6E1-4A9D-AB2E-BAE8F9969240}
2014-03-30 20:23 - 2009-07-14 19:58 - 08137306 _____ () C:\Windows\system32\perfh007.dat
2014-03-30 20:23 - 2009-07-14 19:58 - 02566800 _____ () C:\Windows\system32\perfc007.dat
2014-03-30 20:23 - 2009-07-14 07:13 - 00006260 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-30 20:13 - 2014-03-30 20:13 - 00003544 _____ () C:\{6F8E51E1-8F5D-40D4-ACD4-F1D5F93FC76C}
2014-03-30 20:11 - 2014-03-30 20:11 - 00003384 _____ () C:\{04D80F8C-75E3-4375-992B-22173FECC1B1}
2014-03-30 19:23 - 2014-03-30 19:23 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-30 19:20 - 2014-03-30 19:20 - 12589848 _____ (Malwarebytes Corp.) C:\Users\User\Downloads\mbar-1.07.0.1009.exe
2014-03-30 19:14 - 2014-03-30 13:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-03-30 19:09 - 2014-03-30 19:09 - 00002816 _____ () C:\{881B3B77-D330-4BBE-9375-9C18EDE227AE}
2014-03-30 19:05 - 2014-03-30 19:05 - 00002984 _____ () C:\{65756D68-210C-4D18-8FFD-54FE0104AE20}
2014-03-30 18:53 - 2009-07-14 06:45 - 00365576 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-30 13:54 - 2013-02-18 16:47 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-03-30 13:35 - 2014-03-30 13:35 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-30 13:34 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 13:10 - 2014-03-30 13:10 - 00004051 _____ () C:\Users\User\Desktop\bookmarks-2014-03-30##
2014-03-30 12:57 - 2014-03-30 12:57 - 00000000 ____D () C:\Windows\ERUNT
2014-03-30 12:56 - 2014-03-30 12:56 - 01038974 _____ (Thisisu) C:\Users\User\Downloads\JRT.exe
2014-03-30 12:33 - 2014-03-30 12:33 - 00230780 _____ () C:\Users\User\Desktop\bookmarks-2014-03-30.json
2014-03-30 03:34 - 2010-01-07 17:53 - 00000000 ___RD () C:\Users\User\Desktop\Spieleordner
2014-03-30 03:05 - 2011-10-19 16:03 - 00000000 ____D () C:\Program Files (x86)\Warcraft III Reign of Chaos & The Frozen Throne
2014-03-30 01:39 - 2013-01-18 15:52 - 00000000 ___RD () C:\Users\User\Dropbox
2014-03-29 23:03 - 2014-03-29 23:03 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2014-03-29 23:03 - 2014-03-29 23:02 - 00283192 _____ (Mozilla) C:\Users\User\Downloads\Firefox Setup Stub 28.0.exe
2014-03-29 23:02 - 2014-03-29 23:02 - 00000000 ____D () C:\Games
2014-03-29 23:01 - 2013-01-18 15:37 - 00000000 ____D () C:\Users\User\AppData\Roaming\Dropbox
2014-03-29 22:59 - 2011-07-24 17:34 - 00000000 ____D () C:\Users\User\AppData\Roaming\.minecraft
2014-03-29 22:49 - 2014-03-29 22:49 - 00000000 ____D () C:\ProgramData\Oracle
2014-03-29 22:49 - 2014-03-29 22:47 - 00005933 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-29 22:49 - 2011-02-08 14:43 - 00000000 ____D () C:\Program Files (x86)\Java
2014-03-29 19:30 - 2011-12-18 15:48 - 00000000 ____D () C:\ProgramData\EPSON
2014-03-29 19:25 - 2014-03-29 19:25 - 00045536 _____ () C:\Users\User\Downloads\Minecraft Cracked.rar
2014-03-29 19:25 - 2010-01-07 19:53 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-03-27 16:54 - 2014-03-27 16:54 - 00613200 ____H (Chip Digital GmbH) C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-26 17:52 - 2014-03-26 17:51 - 38904116 ____H () C:\Users\User\Downloads\YouPorn%20-%20Schnuggie%20s%20SEXperiment.mp4
2014-03-26 17:01 - 2014-03-26 17:01 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-26 17:01 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-03-24 19:03 - 2014-02-08 20:16 - 00000000 ____D () C:\Users\User\Desktop\Ocarina
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 ____D () C:\Users\User\AppData\Local\cache
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 _____ () C:\Users\User\daemonprocess.txt
2014-03-21 18:13 - 2014-03-21 17:30 - 128367703 ____H () C:\Users\User\Downloads\Saltatio Mortis - Das schwarze IXI (2013) [320].rar
2014-03-19 17:30 - 2014-03-19 17:29 - 19063005 ____H () C:\Users\User\Downloads\YouPorn%20-%20Junge%20Studentin%20aus%20Halle.mp4
2014-03-19 17:17 - 2014-03-19 17:17 - 21456297 ____H () C:\Users\User\Downloads\YouPorn%20-%20S%20sse%20Berliner%20Studentin.mp4
2014-03-12 20:58 - 2014-03-12 20:58 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 20:58 - 2012-10-23 14:13 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 20:58 - 2012-04-22 01:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 20:58 - 2011-08-15 15:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 16:42 - 2014-03-12 16:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\LucasArts
2014-03-12 16:10 - 2010-01-07 17:42 - 00000000 ____D () C:\Program Files (x86)\LucasArts
2014-03-11 18:14 - 2010-07-19 22:40 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-03-11 17:37 - 2013-07-02 15:12 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA
2014-03-07 17:44 - 2014-03-07 17:44 - 00096068 ____H () C:\Users\User\Downloads\binkw32.zip
ZeroAccess:
C:\Windows\assembly\tmp
C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
C:\Windows\assembly\tmp\3APM67DW\System.AddIn.dll
ZeroAccess:
C:\Users\User\AppData\Local\a2f8192b
C:\Users\User\AppData\Local\a2f8192b\@
Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\drm_dyndata_7390006.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-10 15:04
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by User at 2014-04-03 13:05:11
Running from C:\Users\User\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Norton Internet Security (Disabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Norton Internet Security (Disabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
==================== Installed Programs ======================
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9120 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.3.9120 - Adobe Systems Inc.) Hidden
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.3.133 - Adobe Systems, Inc.)
Age of Mythology - The Titans Expansion (HKLM-x32\...\Age of Mythology Expansion Pack 1.0) (Version: - )
Age of Mythology (HKLM-x32\...\Age of Mythology 1.0) (Version: - )
Angry Birds (HKLM-x32\...\{07A6B206-3F11-4D92-92A1-90E116ADD660}) (Version: 2.0.2 - Rovio)
Angry Birds Rio (HKLM-x32\...\{0D637670-BC00-4FAC-8E00-518EB7F65091}) (Version: 1.4.4 - Rovio)
Angry Birds Seasons (HKLM-x32\...\{FDC4C499-7B67-4A58-A30B-E1276C26BFEF}) (Version: 2.3.0 - Rovio)
Angry Birds Space (HKLM-x32\...\{3F2A323E-60C4-41E8-8CCB-9715D1D750C3}) (Version: 1.0.0 - Rovio)
ANNO 1404 - Gold Edition (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 3.10.0000 - Ubisoft)
ANNO 1602 (HKLM-x32\...\{84F7CAD9-2316-4701-B5CA-E90FD60029E9}) (Version: 1.05 - )
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version: - )
Aufstieg des Hexenkönigs™ (HKLM-x32\...\{B931FB80-537A-4600-00AD-AC5DEDB6C25B}) (Version: - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM-x32\...\CCleaner) (Version: - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cossacks - Back To War (HKLM-x32\...\Cossacks : Back To War) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Defraggler (HKLM\...\Defraggler) (Version: 2.10 - Piriform)
Die Schlacht um Mittelerde™ II (HKLM-x32\...\{2A9F95AB-65A3-432c-8631-B8BC5BF7477A}) (Version: - )
DIE SIEDLER - Aufstieg eines Königreichs (Alle Produkte) (HKLM-x32\...\{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}) (Version: 1.00.0000 - Ubisoft)
DIE SIEDLER - Das Erbe der Könige - Gold Edition (HKLM-x32\...\{E08DE897-B6AF-4DFF-9E90-131E80C876B4}) (Version: 1.00.0000 - Blue Byte)
Die Siedler 7 (HKLM-x32\...\{9C916142-C18C-429D-BFED-40094A7E0BEB}) (Version: 1.12.1396 - Ubisoft)
Die Siedler IV (HKLM-x32\...\S4Uninst) (Version: - )
Don't Starve (HKLM-x32\...\Don't Starve_is1) (Version: - Klei Entertainment)
Drakensang (HKLM-x32\...\Drakensang_is1) (Version: - dtp)
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
EA Download Manager (x32 Version: 4.0.0.455 - Electronic Arts) Hidden
Empire at War Forces of Corruption Mappack 5.00 (HKLM-x32\...\Empire at War Forces of Corruption Mappack) (Version: 5.00 - Petroglyph Games Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
GameRanger (HKCU\...\GameRanger) (Version: - GameRanger Technologies)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Glary Utilities 2.46.0.1518 (HKLM-x32\...\Glary Utilities_is1) (Version: 2.46.0.1518 - Glarysoft Ltd)
Hama Wireless LAN Adapter (HKLM-x32\...\{9C049499-055C-4a0c-A916-1D12314F45EB}) (Version: 1.00.0159 - Hama GmbH & Co KG)
Harveys Neue Augen (HKLM-x32\...\Harvey) (Version: 1.0 - Daedalic Entertainment)
Heroes of Might & Magic V: Hammers of Fate (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200091}) (Version: - )
Heroes of Might and Magic V - Tribes of the East (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200092}) (Version: - )
Heroes of Might and Magic V (HKLM-x32\...\{20071984-5EB1-4881-8EDB-082532ACEC6D}) (Version: - )
ICQ7.5 (HKLM-x32\...\{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}) (Version: 7.5 - ICQ)
iTunes (HKLM\...\{A535111D-95C8-487F-869E-CE4C239972D2}) (Version: 11.1.1.11 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java 7 Update 9 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417009FF}) (Version: 7.0.90 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 30 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216023FF}) (Version: 6.0.300 - Oracle)
L&H TTS3000 Deutsch (HKLM-x32\...\LHTTSGED) (Version: - )
LEGO Insel 2 (HKLM-x32\...\{85967580-EBC2-11D4-AEA3-0050046A88ED}) (Version: - )
LEGO® Star Wars™ III: The Clone Wars™ (HKLM-x32\...\{6C0A6B81-0D00-453F-B220-E1F7931B3C2A}) (Version: 1.0.0.0 - LucasArts)
LIMBO (HKLM-x32\...\LIMBO) (Version: - )
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version: - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version: - )
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft DirectX SDK (June 2010) (HKLM-x32\...\Microsoft DirectX SDK (June 2010)) (Version: 9.29.1962.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60310.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Virtual PC 2007 (HKLM\...\{8A7CAA24-7B23-410B-A7C3-F994B0944160}) (Version: 6.0.156.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{37E7D5C3-AF57-4103-851F-076E8AAFC03E}) (Version: 1.5.2 - MINECRAFTinstall.net)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML4 Parser (HKLM-x32\...\{01501EBA-EC35-4F9F-8889-3BE346E5DA13}) (Version: 1.0.0 - Microsoft Game Studios)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 20.4.0.40 - Symantec Corporation)
NVIDIA 3D Vision Controller Driver (x32 Version: 275.33 - NVIDIA Corporation) Hidden
NVIDIA 3D Vision Controller-Treiber 335.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 335.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.147.1067 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3523 - NVIDIA Corporation) Hidden
NVIDIA System Monitor (HKLM-x32\...\InstallShield_{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}) (Version: 6.5 - NVIDIA Corporation)
NVIDIA System Update (HKLM-x32\...\InstallShield_{65A92AAA-3D05-4C94-9F70-731C05E60C16}) (Version: 3.00 - NVIDIA Corporation)
NVIDIA System Update (x32 Version: 3.00 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 335.23 (Version: 335.23 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice.org 3.4 (HKLM-x32\...\{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}) (Version: 3.4.9590 - OpenOffice.org)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Realtek 8136 8168 8169 Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
RollerCoaster Tycoon 2 (HKLM-x32\...\{72DF62BD-FF36-424E-AA5F-D89BAFF2C249}) (Version: - )
RollerCoaster Tycoon 2: Time Twister (HKLM-x32\...\{BA1E1AFD-D1F2-4C52-88C3-186FC5E61604}) (Version: 1.00.000 - )
RollerCoaster Tycoon 2: Wacky Worlds (HKLM-x32\...\{B1AD83A0-DC92-41E3-B111-E9472349768C}) (Version: - )
S.M.A.R.T. Disk Monitor (HKLM-x32\...\{ECA0A0F9-67C5-4123-8E68-94A67116EEA5}) (Version: - )
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version: - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version: - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version: - )
Samsung PC Studio 3 (x32 Version: 3.0.0.80206 - Samsung Electronics Co., Ltd.) Hidden
Samsung_MonSetup (HKLM-x32\...\{8EA79DBF-D637-448A-89D6-410A087A4493}) (Version: 1.00.0000 - Samsung)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Sid Meier's Civilization 4 - Beyond the Sword (HKLM-x32\...\{32E4F0D2-C135-475E-A841-1D59A0D22989}) (Version: 3.19 - Firaxis Games)
Sid Meier's Civilization 4 Complete (HKCU\...\{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}) (Version: 1.74 - Firaxis Games)
Sid Meier's Civilization 4 Demo (x32 Version: 1.00.0000 - Firaxis Games) Hidden
Sid Meier's Civilization IV Colonization (HKCU\...\{EF36A836-BF89-4A4F-B079-057B0C68C1E0}) (Version: 1.00 - Firaxis Games)
Siedler3 (HKLM-x32\...\Siedler3Deinstall) (Version: - )
Skype™ 6.13 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.13.104 - Skype Technologies S.A.)
Sony Ericsson Update Engine (HKLM-x32\...\Update Engine) (Version: 2.13.7.201306141231 - Sony Ericsson Communications AB)
Sony PC Companion 2.10.165 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.165 - Sony)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.1.19 - Safer-Networking Ltd.)
Star Wars Empire at War (HKLM-x32\...\{99AE7207-8612-4DBA-A8F8-BAE5C633390D}) (Version: 1.0 - LucasArts)
Star Wars Empire at War Forces of Corruption (HKLM-x32\...\{6592FDEC-2C1A-413A-9985-25FEC2F0848D}) (Version: 1.0 - LucasArts)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold (HKLM-x32\...\{C917BA70-28A3-4C74-B163-41FD8C8E1A5A}) (Version: 1.20.0000 - Firefly Studios)
Stronghold 2 (HKLM-x32\...\{16D2C649-CBA8-44EE-B730-12584667D487}) (Version: 1.40.1000 - Firefly Studios)
Stronghold Crusader HD (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: 1.30.0001 - Firefly Studios)
Stronghold Legends (HKLM-x32\...\{66A405D2-BA14-4594-BF36-B3B544F0754E}) (Version: 1.20.0000 - Firefly Studios)
SWF Opener (HKLM-x32\...\{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1) (Version: 1.3 - UnH Solutions)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Swords and Soldiers HD (HKLM-x32\...\Steam App 63500) (Version: - Ronimo Games)
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version: - )
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.27339 - TeamViewer)
The Whispered World (HKLM-x32\...\{82225685-1513-4975-B624-155C10F3EE16}) (Version: 1.01 - Deep Silver)
Torchlight (HKLM-x32\...\{4F64A46D-67F7-4497-AEA2-313D4305A5F6}) (Version: 1.0.0 - JoWooD)
Torchlight (HKLM-x32\...\Runic Games Torchlight) (Version: 0.0.67.91 - )
Torchlight German Patch (HKLM-x32\...\{27B1B784-67A7-452B-A8FF-467E8ADAA8E9}) (Version: 1.0.0 - JoWooD)
TubeBox (HKLM-x32\...\{cb69ca7b-a22a-4654-b672-94507e0560cf}) (Version: 4.3.0.13 - Freetec)
TubeBox (x32 Version: 4.3.0.13 - Freetec) Hidden
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
VLC media player 2.0.6 (HKLM-x32\...\VLC media player) (Version: 2.0.6 - VideoLAN)
Warcraft III Reign of Chaos & The Frozen Throne (HKLM-x32\...\Warcraft III Reign of Chaos & The Frozen Throne) (Version: - )
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
WinPcap 4.1.1 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.1753 - CACE Technologies)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
==================== Restore Points =========================
02-04-2014 18:56:03 DirectX wurde installiert
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-05-01 00:30 - 00444830 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.10sek.com
127.0.0.1 10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 www.123fporn.info
127.0.0.1 123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
Task: {02AAC139-4008-4A4B-A781-7A8B78E47F21} - System32\Tasks\{D488845A-1B51-4A82-8052-0D7C0DFFA7A8} => C:\Program Files (x86)\LucasArts\Star Wars Battlefront II\Install\uninst.exe [2005-09-26] ()
Task: {1391BF9A-86C9-45F0-A844-8F4343D4BC3D} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe [2013-06-03] (Symantec Corporation)
Task: {184F0B2C-2E07-4674-9442-FECFE2FD8D29} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {278EB529-489A-4CDB-8AD2-85453C6E5B4B} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {34ADD40C-4D59-45F2-A843-CD7A3222A969} - System32\Tasks\{102E8777-177F-411B-82C6-F39C92BBBCDB} => C:\Program Files (x86)\Eidos Interactive\Pyro Studios\Praetorians\Praetorians.exe
Task: {382F762A-606F-4F47-A4E0-553A6A8065A5} - System32\Tasks\{9F74115C-DCAE-476E-B439-53189145229D} => C:\ClonkPlanet\Planet.exe
Task: {389BBD91-EF48-4359-83E3-40AE7540E5D2} - System32\Tasks\{4A6CCFD1-84EC-482B-8E3B-DCE0235E183B} => Firefox.exe hxxp://ui.skype.com/ui/0/5.5.0.124/en/abandoninstall?page=tsPlugin&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {5B21D095-31E5-4ED8-BBED-183DBC4C468B} - \Software Updater No Task File
Task: {72FBFB86-0345-4F44-8977-BF3AFC289464} - \Software Updater Ui No Task File
Task: {7497E44C-5B2A-4006-A4DE-B1966787AC5B} - \BrowserProtect No Task File
Task: {797C6EB8-F159-4AE4-9CB8-2441EF520C4B} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {7C07F8DE-804F-4DEF-8C87-B4EE3A4E3382} - System32\Tasks\{D17563AD-AA27-4865-886D-7F0D4961B04A} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2014-01-14] (Skype Technologies S.A.)
Task: {7CAC7F10-35E7-465E-9769-D5B4C1480049} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: {86E750FB-D40A-4161-B22F-020A06E97497} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe [2013-06-03] (Symantec Corporation)
Task: {9A506F58-C877-4FD9-9C2B-EE89295F22DA} - \CreateChoiceProcessTask No Task File
Task: {9CD19817-D2F4-4CC7-B6A0-6AEDEBDFBD5E} - System32\Tasks\{870D056C-956C-42F7-A850-774088D9DB48} => C:\Program Files (x86)\TmNationsForever\TmForever.exe
Task: {9E4F7462-BA5B-4964-9882-7554C4AABEB1} - System32\Tasks\{A94810EF-B47B-4F72-A8B3-3482D86EB58F} => C:\Program Files (x86)\LucasArts\Star Wars Battlefront II\Install\uninst.exe [2005-09-26] ()
Task: {9F6C5F26-0767-42AD-8B10-031B369E9523} - System32\Tasks\{B3F85FFD-82EE-4A96-A4D4-D222FDD2737F} => C:\ClonkPlanet\Planet.exe
Task: {A6E208CB-0D55-436B-818A-8A9AE411437F} - \Your File Updater No Task File
Task: {BFCAF4DF-540A-4C96-97CD-591914D491CE} - System32\Tasks\{2FCB2BE0-D01A-4D7F-9A12-369EE6FD831D} => E:\AsphaltDuell.exe
Task: {CAF60AE3-BF3F-4455-9426-F8B734F1D748} - System32\Tasks\{18A2673C-D5F3-4266-8FFE-26A2DC4400A7} => C:\ClonkPlanet\Planet.exe
Task: {E2FA3C2F-B329-4D9C-A6F6-1A4080C89ECD} - System32\Tasks\{5D025DE6-3961-4C43-8259-34C9CC00EC20} => E:\AsphaltDuell.exe
Task: {E55B466E-A19F-443E-AC0C-4E0879DF375B} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {EC1B5B25-B08D-4754-8B13-FE6FED11E7FC} - System32\Tasks\GlaryInitialize => C:\Program Files (x86)\Glary Utilities\initialize.exe [2012-06-01] (Glarysoft Ltd)
Task: {EF9AA5E3-A59F-4CAA-A978-DA513CCBB875} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {FC037B59-2C54-4691-A06C-957997297B90} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe [2013-06-03] (Symantec Corporation)
Task: {FDD68CB2-1F66-4472-95F3-E036150BDE7A} - System32\Tasks\{F77EAD80-C502-44E9-BCD4-6F360ECAB3F0} => C:\BlueByte\Siedler3\S3.EXE [1999-11-18] (Blue Byte )
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GlaryInitialize.job => C:\Program Files (x86)\Glary Utilities\initialize.exe
==================== Loaded Modules (whitelisted) =============
2011-04-07 23:19 - 2014-03-04 15:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-06-14 16:51 - 2013-06-14 16:51 - 00114688 _____ () C:\Windows\system32\MSAC3EOC.exe
2010-08-19 22:30 - 2009-05-07 10:51 - 00071680 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2010-08-19 22:30 - 2009-05-07 10:53 - 00379392 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2010-08-19 22:30 - 2008-01-18 08:50 - 00098816 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll
2010-08-19 22:30 - 2009-06-16 08:07 - 47581696 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll
2014-04-03 09:44 - 2013-02-07 12:35 - 00579904 _____ () C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
2013-09-13 19:51 - 2013-09-13 19:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-09-13 19:51 - 2013-09-13 19:51 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-07-14 12:35 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-07-14 12:35 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-07-14 12:35 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-07-14 12:36 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-07-14 12:36 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-08-01 14:40 - 2012-05-30 08:51 - 00699280 ____R () C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY\ENGINE\20.4.0.40\wincfi39.dll
2011-01-31 17:56 - 2009-12-09 22:20 - 00126976 _____ () C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\EnumDevLib.dll
2014-03-30 13:34 - 2014-03-15 10:40 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\User:gs5sys
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\Templates:gs5sys
AlternateDataStreams: C:\ProgramData\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\User\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\User\Cookies:gs5sys
AlternateDataStreams: C:\Users\User\Lokale Einstellungen:gs5sys
AlternateDataStreams: C:\Users\User\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\User\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\User\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\User\AppData\Local\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\User\AppData\Local\Verlauf:gs5sys
AlternateDataStreams: C:\Users\User\Documents\desktop.ini:gs5sys
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/03/2014 00:50:15 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/03/2014 00:50:14 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/03/2014 10:05:47 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/03/2014 10:05:45 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/03/2014 10:01:09 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/03/2014 10:01:07 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/03/2014 09:55:24 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/03/2014 09:55:22 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/03/2014 09:53:42 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/03/2014 09:53:41 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
System errors:
=============
Error: (04/03/2014 09:32:14 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
StarOpen
Error: (04/03/2014 09:32:06 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\tandpl.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (04/03/2014 09:31:40 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (04/02/2014 10:03:08 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error: (04/02/2014 10:03:05 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error: (04/02/2014 06:45:02 PM) (Source: Service Control Manager) (User: )
Description: Dienst "VgaSave Anmeldedienst für" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/02/2014 06:43:35 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
StarOpen
Error: (04/02/2014 06:43:24 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\tandpl.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (04/02/2014 06:42:57 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (04/02/2014 03:01:17 PM) (Source: Service Control Manager) (User: )
Description: Dienst "VgaSave Anmeldedienst für" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office Sessions:
=========================
Error: (04/03/2014 00:50:15 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User\Downloads\esetsmartinstaller_deu.exe
Error: (04/03/2014 00:50:14 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User\Downloads\esetsmartinstaller_deu.exe
Error: (04/03/2014 10:05:47 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User\Downloads\esetsmartinstaller_deu.exe
Error: (04/03/2014 10:05:45 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User\Downloads\esetsmartinstaller_deu.exe
Error: (04/03/2014 10:01:09 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User\Downloads\esetsmartinstaller_deu.exe
Error: (04/03/2014 10:01:07 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User\Downloads\esetsmartinstaller_deu.exe
Error: (04/03/2014 09:55:24 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User\Downloads\esetsmartinstaller_deu.exe
Error: (04/03/2014 09:55:22 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User\Downloads\esetsmartinstaller_deu.exe
Error: (04/03/2014 09:53:42 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User\Downloads\esetsmartinstaller_deu.exe
Error: (04/03/2014 09:53:41 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User\Downloads\esetsmartinstaller_deu.exe
CodeIntegrity Errors:
===================================
Date: 2010-07-20 00:12:29.248
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-07-20 00:12:29.248
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-07-20 00:12:28.047
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-07-20 00:12:28.047
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-07-20 00:12:27.033
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-07-20 00:12:27.033
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-07-20 00:12:26.019
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-07-20 00:12:26.003
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-07-20 00:12:22.010
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-07-20 00:12:21.994
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 58%
Total physical RAM: 4095.12 MB
Available physical RAM: 1710.41 MB
Total Pagefile: 8188.41 MB
Available Pagefile: 5886.11 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:199.12 GB) (Free:4.9 GB) NTFS
Drive d: () (Fixed) (Total:266.54 GB) (Free:216.1 GB) NTFS
Drive e: (DRAKENSANG GOLD EDITION) (CDROM) (Total:4.12 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: EFE115BB)
Partition: GPT Partition Type.
==================== End Of Log ============================
|
|
05.04.2014, 10:38
| #6 |
| /// the machine /// TB-Ausbilder | Download Protect 2.2 im Browser! Dachte ich mir schon, da ist noch mehr im Argen: Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ProxyServer: localhost:21320
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Scan mit Combofix
__________________ --> Download Protect 2.2 im Browser! |
|
06.04.2014, 12:42
| #7 |
| | Download Protect 2.2 im Browser!Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by User at 2014-04-05 17:20:48 Run:1
Running from C:\Users\User\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
ProxyServer: localhost:21320
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
*****************
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
==== End of Fixlog ====
Code:
ATTFilter ComboFix 14-04-05.01 - User 06.04.2014 13:16:46.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4095.2644 [GMT 2:00]
ausgeführt von:: c:\users\User\Downloads\ComboFix.exe
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\assembly\tmp\U
c:\windows\IsUn0407.exe
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-03-06 bis 2014-04-06 ))))))))))))))))))))))))))))))
.
.
2014-04-05 09:45 . 2014-04-05 09:45 -------- d-----w- c:\users\User\AppData\Local\Sony
2014-04-05 09:44 . 2014-04-05 09:44 -------- d-----w- c:\users\User\AppData\Local\Apple
2014-04-04 14:45 . 2014-04-04 14:45 -------- d-----w- c:\users\User\AppData\Local\TubeBox
2014-04-04 14:38 . 2014-04-04 14:38 -------- d-----w- c:\users\User\AppData\Local\CrashDumps
2014-04-04 14:30 . 2014-04-04 14:30 -------- d-----w- c:\users\User\AppData\Local\Macromedia
2014-04-04 14:27 . 2014-04-04 14:27 -------- d-----w- c:\users\User\AppData\Roaming\DiskDefrag
2014-04-04 12:02 . 2014-04-04 12:02 -------- d-----w- c:\programdata\GlarySoft
2014-04-04 12:02 . 2014-04-01 08:03 118048 ----a-w- c:\windows\system32\BootDefrag.exe
2014-04-04 12:02 . 2014-03-31 07:33 17600 ----a-w- c:\windows\system32\drivers\BootDefragDriver.sys
2014-04-04 12:02 . 2014-04-04 14:29 -------- d-----w- c:\program files (x86)\Glary Utilities 4
2014-04-03 11:02 . 2014-04-05 15:30 -------- d-----w- C:\FRST
2014-04-02 16:54 . 2014-04-02 16:54 -------- d-----w- c:\program files (x86)\ESET
2014-03-30 17:23 . 2014-03-30 17:23 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-03-30 11:34 . 2014-03-30 11:34 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2014-03-30 10:57 . 2014-03-30 10:57 -------- d-----w- c:\windows\ERUNT
2014-03-30 10:39 . 2014-02-04 02:32 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-03-30 10:39 . 2014-02-04 02:04 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-03-29 21:02 . 2014-03-29 21:02 -------- d-----w- C:\Games
2014-03-29 20:49 . 2014-03-29 20:49 -------- d-----w- c:\program files (x86)\Common Files\Java
2014-03-29 20:49 . 2013-12-18 20:09 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-03-27 14:54 . 2014-04-03 07:59 -------- d-----w- C:\AdwCleaner
2014-03-22 17:44 . 2014-03-22 17:44 -------- d-----w- c:\users\User\AppData\Local\cache
2014-03-14 14:31 . 2014-02-04 02:32 624128 ----a-w- c:\windows\system32\qedit.dll
2014-03-14 14:31 . 2014-02-04 02:04 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-03-12 18:58 . 2014-03-12 18:58 5777288 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-03-12 14:42 . 2014-03-12 14:42 -------- d-----w- c:\users\User\AppData\Roaming\LucasArts
2014-03-11 16:14 . 2014-03-04 11:32 599840 ----a-w- c:\windows\SysWow64\nvStreaming.exe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-12 18:58 . 2012-04-21 23:28 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-12 18:58 . 2011-08-15 13:25 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-04 14:35 . 2013-05-23 21:33 15783992 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2014-03-04 14:35 . 2013-05-23 21:33 2715264 ----a-w- c:\windows\SysWow64\nvapi.dll
2014-03-04 14:35 . 2013-05-23 21:33 14709720 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2014-03-04 14:35 . 2013-02-25 22:32 3093280 ----a-w- c:\windows\system32\nvapi64.dll
2014-03-04 14:35 . 2013-02-25 22:32 18302384 ----a-w- c:\windows\system32\nvwgf2umx.dll
2014-03-04 13:06 . 2011-04-07 21:19 6714312 ----a-w- c:\windows\system32\nvcpl.dll
2014-03-04 13:06 . 2011-04-07 21:18 3497816 ----a-w- c:\windows\system32\nvsvc64.dll
2014-03-04 13:05 . 2011-04-07 21:19 922968 ----a-w- c:\windows\system32\nvvsvc.exe
2014-03-04 13:05 . 2011-04-07 21:19 2558808 ----a-w- c:\windows\system32\nvsvcr.dll
2014-03-04 13:05 . 2010-10-08 01:20 64968 ----a-w- c:\windows\system32\nvshext.dll
2014-03-04 13:05 . 2011-04-07 21:19 386336 ----a-w- c:\windows\system32\nvmctray.dll
2014-02-17 14:06 . 2010-07-01 17:04 88567024 ----a-w- c:\windows\system32\MRT.exe
2006-12-21 19:22 . 2007-01-26 00:55 217088 ----a-w- c:\program files (x86)\PetroLauncher.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-06-17 2182144]
.
c:\users\Privat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-4-19 1199104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk * \0BootDefrag.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys;c:\windows\SYSNATIVE\DRIVERS\ASPI32.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv_x64.sys;c:\windows\SYSNATIVE\DRIVERS\mcvidrv_x64.sys [x]
R3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv_x64.sys;c:\windows\SYSNATIVE\drivers\mcaudrv_x64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S0 BootDefragDriver;BootDefragDriver;c:\windows\System32\drivers\BootDefragDriver.sys;c:\windows\SYSNATIVE\drivers\BootDefragDriver.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1404000.028\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1404000.028\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20140319.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [x]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\ccSetx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20140404.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20140404.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1404000.028\SYMNETS.SYS [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Realtek11nCU;Realtek11nCU;c:\program files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe;c:\program files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
S2 timeoutd;VgaSave Anmeldedienst für;c:\windows\system32\MSAC3EOC.exe;c:\windows\SYSNATIVE\MSAC3EOC.exe [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 nvoclk64;NVIDIA Enthusiasts Platform KDM;c:\windows\system32\DRIVERS\nvoclk64.sys;c:\windows\SYSNATIVE\DRIVERS\nvoclk64.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192cu.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192cu.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 18:58]
.
2014-04-06 c:\windows\Tasks\GlaryInitialize 4.job
- c:\program files (x86)\Glary Utilities 4\Initialize.exe [2014-04-01 08:01]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-08-27 1028896]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{9908A390-79DE-4B21-92BA-FF204DB8FED8}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\
FF - prefs.js: browser.search.selectedEngine - Amazon.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
Notify-SDWinLogon - SDWinLogon.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-S4Uninst - c:\windows\IsUn0407.exe
AddRemove-Siedler3Deinstall - c:\windows\IsUn0407.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1286391921-2359739017-786261735-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:6f,36,e9,c8,d1,fd,33,89,07,c8,ba,2f,fb,df,e2,16,de,5a,3b,a9,e5,89,eb,
5c,42,4c,96,4a,b6,5e,5c,73,e3,00,7a,ed,5d,8e,c5,d4,79,3e,15,23,2e,0f,fe,92,\
"??"=hex:ac,de,45,4f,e6,b0,95,4c,61,21,d8,00,15,de,59,95
.
[HKEY_USERS\S-1-5-21-1286391921-2359739017-786261735-1000\Software\SecuROM\License information*]
"datasecu"=hex:36,6f,85,a6,a0,80,3f,17,c6,e9,56,78,d0,7c,30,25,f0,54,68,20,5b,
b9,ea,18,6f,43,fc,ae,ae,d5,a3,ce,7b,b0,38,2d,87,7f,f8,aa,a8,76,90,5f,ce,d4,\
"rkeysecu"=hex:e1,6a,34,94,6b,6f,7c,fb,be,20,a2,15,02,db,22,c6
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Hama\Wireless LAN RTL8188CU\RtWlan.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-04-06 13:31:20 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-04-06 11:31
.
Vor Suchlauf: 13 Verzeichnis(se), 13.594.247.168 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 12.947.587.072 Bytes frei
.
- - End Of File - - CA1076C38E40A6FE3B1E820F51B6D8D3
A36C5E4F47E84449FF07ED3517B43A31
1) Waren das relevante Daten, die von irgendwelchen Anwendungen benötigt werden? 2) Kannst du mir sagen, womit diese Dateien (möglicherweise) befallen waren? Das gibt immer ein gutes Gefühl zu wissen, welche Art von Virus man gerade vom PC gekickt hat. Und: Vielen Dank für deine Hilfe!! |
|
07.04.2014, 12:09
| #8 |
| /// the machine /// TB-Ausbilder | Download Protect 2.2 im Browser! Dein Rechner hat jede Menge Adware. CF hat was davon gelöscht und Dienste repariert, jetzt hauen wir den Rest raus. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.04.2014, 19:40
| #9 |
| | Download Protect 2.2 im Browser!Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 07.04.2014 Suchlauf-Zeit: 19:57:21 Logdatei: Malwarebytes Anti-Malware .txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.04.07.09 Rootkit Datenbank: v2014.03.27.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: User Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 297004 Verstrichene Zeit: 18 Min, 4 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.023 - Bericht erstellt am 07/04/2014 um 20:15:55
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : User - USER-PC
# Gestartet von : C:\Users\User\AppData\Local\Temp\OCS\Downloads\fc14996dfa99adfc7baae624196888c5\f8b34e3b5e6e337aa6491ee3f713f8f5\adwcleaner3023.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\User\AppData\Local\Temp\OCS
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
-\\ Mozilla Firefox v28.0 (de)
[ Datei : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [9692 octets] - [27/03/2014 16:55:14]
AdwCleaner[R1].txt - [9456 octets] - [30/03/2014 12:25:31]
AdwCleaner[R2].txt - [9575 octets] - [30/03/2014 12:26:49]
AdwCleaner[R3].txt - [1294 octets] - [30/03/2014 12:35:34]
AdwCleaner[R4].txt - [1399 octets] - [30/03/2014 13:06:49]
AdwCleaner[R5].txt - [1453 octets] - [03/04/2014 09:58:27]
AdwCleaner[R6].txt - [1746 octets] - [07/04/2014 20:01:03]
AdwCleaner[S0].txt - [407 octets] - [27/03/2014 16:56:56]
AdwCleaner[S1].txt - [318 octets] - [30/03/2014 12:26:19]
AdwCleaner[S2].txt - [9403 octets] - [30/03/2014 12:28:25]
AdwCleaner[S3].txt - [1356 octets] - [30/03/2014 12:39:13]
AdwCleaner[S4].txt - [1623 octets] - [07/04/2014 20:15:55]
########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1683 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by User on 07.04.2014 at 20:22:32,06
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\zgoi7n2e.default\minidumps [4 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.04.2014 at 20:28:23,19
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by User (administrator) on USER-PC on 07-04-2014 20:37:47
Running from C:\Users\User\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
() C:\Windows\system32\MSAC3EOC.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtWlan.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2182144 2009-06-17] (VIA)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
Startup: C:\Users\Privat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{9908A390-79DE-4B21-92BA-FF204DB8FED8}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default
FF DefaultSearchEngine: Amazon.de
FF SelectedSearchEngine: Amazon.de
FF Homepage: hxxp://www.google.de/webhp
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus Pop-up Addon - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-04-03]
FF Extension: anonymoX - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\client@anonymox.net.xpi [2014-04-02]
FF Extension: YouTube Video and Audio Downloader - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\feca4b87-3be4-43da-a1b1-137c24220968@jetpack.xpi [2014-04-03]
FF Extension: Ghostery - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\firefox@ghostery.com.xpi [2014-04-03]
FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-02]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFF [2013-10-10]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\ []
FF HKLM-x32\...\Firefox\Extensions: [{121C6AF3-6778-4360-AFDB-57BD4E3E4343}] - C:\Program Files\Playzy\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{D7147CE7-24AC-4800-AFBE-AC95185ADD7C}] - C:\Windows\Installer\{B29D5059-C608-4D50-9936-A65984517A6F}\{D7147CE7-24AC-4800-AFBE-AC95185ADD7C}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{45544AB0-68F0-4ADE-8371-844283A04D37}] - C:\Windows\Installer\{44E19A6E-7D08-4D6C-AA35-15CCA59FF785}\{45544AB0-68F0-4ADE-8371-844283A04D37}.xpi
Chrome:
=======
CHR HomePage: hxxp://www.google.de?hl=de&gl=de
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\User\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx []
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx [2014-04-03]
==================== Services (Whitelisted) =================
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 Realtek11nCU; C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe [36864 2010-04-16] (Realtek)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 timeoutd; C:\Windows\system32\MSAC3EOC.exe [114688 2013-06-14] ()
S2 UpdateCenterService; C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe [282728 2009-11-06] (NVIDIA)
==================== Drivers (Whitelisted) ====================
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 ASPI; C:\Windows\SysWOW64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-01-15] ()
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation)
R0 BootDefragDriver; C:\Windows\System32\drivers\BootDefragDriver.sys [17600 2014-03-31] (Glarysoft Ltd)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-01-02] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20140404.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-01-15] ()
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-11] (ManyCam LLC)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] ()
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20140407.003\ENG64.SYS [126040 2014-03-12] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20140407.003\EX64.SYS [2099288 2014-03-12] (Symantec Corporation)
R3 nvoclk64; C:\Windows\System32\DRIVERS\nvoclk64.sys [42088 2009-09-15] (NVIDIA Corp.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation )
R2 SecDrv; C:\Windows\SysWOW64\drivers\SECDRV.SYS [11376 2002-10-21] ()
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-15] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-01-28] (Symantec Corporation)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-20] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-01-30] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-08-01] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [43680 2012-11-15] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2012-11-15] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
S2 tandpl; C:\Windows\SysWOW64\drivers\tandpl.sys [4736 2003-04-19] ()
R1 vmm; C:\Windows\system32\Treiber\vmm.sys [296816 2007-02-18] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 ccEvtMgr;
U2 ccSetMgr;
U3 navapsvc;
U3 SAVRT;
U1 SAVRTPEL;
U3 TlntSvr;
U2 wuaserv;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-07 20:28 - 2014-04-07 20:28 - 00000754 _____ () C:\Users\User\Desktop\JRT.txt
2014-04-07 20:21 - 2014-04-06 08:36 - 01016261 _____ (Thisisu) C:\Users\User\Desktop\JRT_NEW.exe
2014-04-07 20:00 - 2014-04-07 20:00 - 00613200 _____ (Chip Digital GmbH) C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader(1).exe
2014-04-07 19:36 - 2014-04-07 19:38 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-07 19:36 - 2014-04-07 19:36 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-07 19:36 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-07 19:33 - 2014-04-07 19:36 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-06 13:38 - 2014-04-06 13:38 - 00023247 _____ () C:\Users\User\Combofix.txt
2014-04-06 13:31 - 2014-04-06 13:31 - 00023247 _____ () C:\ComboFix.txt
2014-04-06 13:25 - 2014-04-06 13:25 - 00000540 _____ () C:\Windows\PFRO.log
2014-04-06 13:14 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-06 13:14 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-06 13:14 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-06 13:12 - 2014-04-06 13:31 - 00000000 ____D () C:\Qoobox
2014-04-06 13:12 - 2014-04-06 13:29 - 00000000 ____D () C:\Windows\erdnt
2014-04-06 13:10 - 2014-04-06 13:10 - 05193579 ____R (Swearware) C:\Users\User\Downloads\ComboFix.exe
2014-04-05 11:45 - 2014-04-05 11:45 - 00000000 ____D () C:\Users\User\AppData\Local\Sony
2014-04-05 11:44 - 2014-04-05 11:44 - 00000000 ____D () C:\Users\User\AppData\Local\Apple
2014-04-05 11:42 - 2014-04-05 11:44 - 00044996 _____ () C:\Windows\DPINST.LOG
2014-04-04 16:45 - 2014-04-04 16:45 - 00000000 ____D () C:\Users\User\AppData\Local\TubeBox
2014-04-04 16:38 - 2014-04-04 16:38 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2014-04-04 16:30 - 2014-04-04 16:30 - 00000000 ____D () C:\Users\User\AppData\Local\Macromedia
2014-04-04 16:27 - 2014-04-07 20:17 - 00003808 _____ () C:\Windows\setupact.log
2014-04-04 16:27 - 2014-04-04 16:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\DiskDefrag
2014-04-04 16:27 - 2014-04-04 16:27 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-04 14:38 - 2014-04-04 14:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\Macromedia
2014-04-04 14:02 - 2014-04-07 20:18 - 00000332 _____ () C:\Windows\Tasks\GlaryInitialize 4.job
2014-04-04 14:02 - 2014-04-04 16:29 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 4
2014-04-04 14:02 - 2014-04-04 14:02 - 00002624 _____ () C:\Windows\System32\Tasks\GlaryInitialize 4
2014-04-04 14:02 - 2014-04-04 14:02 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-04-04 14:02 - 2014-04-01 10:03 - 00118048 _____ (Glarysoft Ltd) C:\Windows\system32\BootDefrag.exe
2014-04-04 14:02 - 2014-03-31 09:33 - 00017600 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\BootDefragDriver.sys
2014-04-04 13:24 - 2014-04-04 13:28 - 12481320 _____ () C:\Users\User\Downloads\gu4setup.exe
2014-04-03 17:45 - 2014-04-03 17:45 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-03 17:44 - 2014-04-03 17:44 - 04787368 _____ (Piriform Ltd) C:\Users\User\Downloads\ccsetup412.exe
2014-04-03 13:18 - 2014-04-03 13:18 - 00380416 _____ () C:\Users\User\Downloads\k01fg67r.exe
2014-04-03 13:03 - 2014-04-03 13:05 - 00050515 _____ () C:\Users\User\Downloads\Addition.txt
2014-04-03 13:02 - 2014-04-07 20:37 - 00016358 _____ () C:\Users\User\Downloads\FRST.txt
2014-04-03 13:02 - 2014-04-07 20:37 - 00000000 ____D () C:\FRST
2014-04-03 13:02 - 2014-04-03 13:02 - 00380416 _____ () C:\Users\User\Downloads\tyzuwgdb.exe
2014-04-03 13:01 - 2014-04-03 13:01 - 02157056 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-04-03 13:01 - 2014-04-03 13:01 - 01145856 _____ (Farbar) C:\Users\User\Downloads\FRST.exe
2014-04-03 12:43 - 2014-04-03 12:43 - 00448512 _____ (OldTimer Tools) C:\Users\User\Downloads\TFC.exe
2014-04-03 09:43 - 2014-04-03 09:43 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe
2014-04-02 20:55 - 2014-04-02 20:55 - 00001929 _____ () C:\Users\User\Desktop\Drakensang.lnk
2014-04-02 18:54 - 2014-04-02 18:54 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-03-31 15:52 - 2014-03-31 15:52 - 00002088 _____ () C:\{B0B5949C-2666-48DE-BE5B-225AB826C873}
2014-03-31 15:50 - 2014-03-31 15:50 - 00002136 _____ () C:\{8A0B66BD-D375-4BEF-8BA0-E29B7090A54D}
2014-03-31 15:46 - 2014-03-31 15:46 - 00002128 _____ () C:\{C5A3030C-4F69-463E-88FA-5D99EB49E715}
2014-03-31 15:42 - 2014-03-31 15:42 - 00002160 _____ () C:\{B0C8FB38-F1CE-4BBF-911D-D503E8DDF0F0}
2014-03-31 15:38 - 2014-03-31 15:38 - 00002168 _____ () C:\{74D4CF7E-3A62-460D-9F6E-B2EF38998DCA}
2014-03-31 15:35 - 2014-03-31 15:35 - 00002160 _____ () C:\{52081577-7905-4723-AC25-FF9FE65B2A82}
2014-03-31 15:29 - 2014-03-31 15:29 - 00002376 _____ () C:\{F93246E9-18A2-47C4-A90D-6C270A93C915}
2014-03-31 14:53 - 2014-03-31 14:53 - 00002656 _____ () C:\{B113D6B6-CA79-4389-8095-23F62C348123}
2014-03-31 14:51 - 2014-03-31 14:51 - 00002672 _____ () C:\{0713E16E-8D8E-4B10-BC25-1A92B2AA65FE}
2014-03-31 14:49 - 2014-03-31 14:49 - 00002416 _____ () C:\{AD30FAEB-8A15-4D16-9AA6-5B8D62F52837}
2014-03-31 14:47 - 2014-03-31 14:47 - 00002440 _____ () C:\{8E532289-3850-4103-831D-1FD071995237}
2014-03-31 14:28 - 2014-03-31 14:28 - 00002504 _____ () C:\{A0FE26E1-3CA3-432D-BAA8-43C9C96A3FF7}
2014-03-30 21:35 - 2014-03-30 21:36 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_enu.exe
2014-03-30 21:03 - 2014-03-30 21:03 - 00002392 _____ () C:\{CD8A38DB-9CF3-4DCD-BD3E-58D66B98416D}
2014-03-30 21:02 - 2014-03-30 21:02 - 00002248 _____ () C:\{6885A95F-E6E1-4A9D-AB2E-BAE8F9969240}
2014-03-30 20:13 - 2014-03-30 20:13 - 00003544 _____ () C:\{6F8E51E1-8F5D-40D4-ACD4-F1D5F93FC76C}
2014-03-30 20:11 - 2014-03-30 20:11 - 00003384 _____ () C:\{04D80F8C-75E3-4375-992B-22173FECC1B1}
2014-03-30 19:23 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-30 19:23 - 2014-03-30 21:26 - 00000000 ____D () C:\Users\User\Desktop\mbar
2014-03-30 19:20 - 2014-03-30 19:20 - 12589848 _____ (Malwarebytes Corp.) C:\Users\User\Downloads\mbar-1.07.0.1009.exe
2014-03-30 19:09 - 2014-03-30 19:09 - 00002816 _____ () C:\{881B3B77-D330-4BBE-9375-9C18EDE227AE}
2014-03-30 19:05 - 2014-03-30 19:05 - 00002984 _____ () C:\{65756D68-210C-4D18-8FFD-54FE0104AE20}
2014-03-30 13:35 - 2014-03-30 13:35 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-30 13:34 - 2014-04-03 17:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-30 13:34 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 13:18 - 2014-04-04 16:28 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-03-30 13:10 - 2014-03-30 13:10 - 00004051 _____ () C:\Users\User\Desktop\bookmarks-2014-03-30##
2014-03-30 12:57 - 2014-03-30 12:57 - 00000000 ____D () C:\Windows\ERUNT
2014-03-30 12:56 - 2014-03-30 12:56 - 01038974 _____ (Thisisu) C:\Users\User\Downloads\JRT.exe
2014-03-30 12:39 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-30 12:39 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-30 12:33 - 2014-03-30 12:33 - 00230780 _____ () C:\Users\User\Desktop\bookmarks-2014-03-30.json
2014-03-29 23:03 - 2014-03-29 23:03 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2014-03-29 23:02 - 2014-03-29 23:03 - 00283192 _____ (Mozilla) C:\Users\User\Downloads\Firefox Setup Stub 28.0.exe
2014-03-29 23:02 - 2014-03-29 23:02 - 00000000 ____D () C:\Games
2014-03-29 22:49 - 2013-12-18 22:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-03-29 22:49 - 2013-12-18 22:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-03-29 22:49 - 2013-12-18 22:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-03-29 22:49 - 2013-12-18 22:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-03-29 22:47 - 2014-03-29 22:49 - 00005933 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-29 19:25 - 2014-03-29 19:25 - 00045536 _____ () C:\Users\User\Downloads\Minecraft Cracked.rar
2014-03-27 16:54 - 2014-04-07 20:15 - 00000000 ____D () C:\AdwCleaner
2014-03-27 16:54 - 2014-03-27 16:54 - 00613200 ____H (Chip Digital GmbH) C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-26 17:51 - 2014-03-26 17:52 - 38904116 ____H () C:\Users\User\Downloads\YouPorn%20-%20Schnuggie%20s%20SEXperiment.mp4
2014-03-26 17:01 - 2014-03-26 17:01 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 ____D () C:\Users\User\AppData\Local\cache
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 _____ () C:\Users\User\daemonprocess.txt
2014-03-21 18:25 - 2013-10-02 14:59 - 00000000 ____D () C:\Users\User\Desktop\Saltatio Mortis - Das schwarze IXI (2013) [320]
2014-03-21 17:30 - 2014-03-21 18:13 - 128367703 ____H () C:\Users\User\Downloads\Saltatio Mortis - Das schwarze IXI (2013) [320].rar
2014-03-19 17:29 - 2014-03-19 17:30 - 19063005 ____H () C:\Users\User\Downloads\YouPorn%20-%20Junge%20Studentin%20aus%20Halle.mp4
2014-03-19 17:17 - 2014-03-19 17:17 - 21456297 ____H () C:\Users\User\Downloads\YouPorn%20-%20S%20sse%20Berliner%20Studentin.mp4
2014-03-14 16:55 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-14 16:55 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-14 16:55 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-14 16:55 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-14 16:55 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-14 16:55 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-14 16:55 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-14 16:55 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-14 16:55 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-14 16:55 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-14 16:55 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-14 16:55 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-14 16:55 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 16:55 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-14 16:55 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-14 16:55 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 16:55 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-14 16:55 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-14 16:55 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 16:55 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-14 16:55 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 16:55 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 16:55 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 16:55 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-14 16:55 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 16:55 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-14 16:55 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-14 16:55 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-14 16:55 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-14 16:55 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 16:55 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 16:55 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-14 16:55 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 16:55 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-14 16:55 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 16:55 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-14 16:55 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 16:55 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 16:55 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-14 16:55 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-14 16:31 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-14 16:31 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-12 20:58 - 2014-03-12 20:58 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 16:42 - 2014-03-12 16:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\LucasArts
2014-03-11 18:14 - 2014-03-04 13:32 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-03-11 18:10 - 2014-03-04 16:35 - 31474976 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 25255256 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 23716640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 17755424 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 12708128 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-03-11 18:10 - 2014-03-04 16:35 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 03143456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02958792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02783008 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02411976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00877856 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00863064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00846168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
==================== One Month Modified Files and Folders =======
2014-04-07 20:38 - 2014-04-03 13:02 - 00016358 _____ () C:\Users\User\Downloads\FRST.txt
2014-04-07 20:37 - 2014-04-03 13:02 - 00000000 ____D () C:\FRST
2014-04-07 20:28 - 2014-04-07 20:28 - 00000754 _____ () C:\Users\User\Desktop\JRT.txt
2014-04-07 20:26 - 2010-01-07 17:55 - 00000000 ___RD () C:\Users\User\Desktop\Fehlerbehebung
2014-04-07 20:25 - 2009-07-14 06:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-07 20:25 - 2009-07-14 06:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-07 20:21 - 2010-01-07 00:46 - 02063280 _____ () C:\Windows\WindowsUpdate.log
2014-04-07 20:18 - 2014-04-04 14:02 - 00000332 _____ () C:\Windows\Tasks\GlaryInitialize 4.job
2014-04-07 20:17 - 2014-04-04 16:27 - 00003808 _____ () C:\Windows\setupact.log
2014-04-07 20:17 - 2010-07-01 21:58 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-04-07 20:17 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-07 20:15 - 2014-03-27 16:54 - 00000000 ____D () C:\AdwCleaner
2014-04-07 20:00 - 2014-04-07 20:00 - 00613200 _____ (Chip Digital GmbH) C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader(1).exe
2014-04-07 19:56 - 2012-10-23 14:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-07 19:38 - 2014-04-07 19:36 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-07 19:36 - 2014-04-07 19:36 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-07 19:36 - 2014-04-07 19:33 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-07 19:36 - 2013-03-07 23:25 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-06 13:38 - 2014-04-06 13:38 - 00023247 _____ () C:\Users\User\Combofix.txt
2014-04-06 13:31 - 2014-04-06 13:31 - 00023247 _____ () C:\ComboFix.txt
2014-04-06 13:31 - 2014-04-06 13:12 - 00000000 ____D () C:\Qoobox
2014-04-06 13:31 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-06 13:29 - 2014-04-06 13:12 - 00000000 ____D () C:\Windows\erdnt
2014-04-06 13:25 - 2014-04-06 13:25 - 00000540 _____ () C:\Windows\PFRO.log
2014-04-06 13:25 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-06 13:24 - 2009-07-14 04:34 - 79167488 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 22806528 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 04980736 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 00090112 _____ () C:\Windows\system32\config\SAM.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 00032768 _____ () C:\Windows\system32\config\SECURITY.bak
2014-04-06 13:10 - 2014-04-06 13:10 - 05193579 ____R (Swearware) C:\Users\User\Downloads\ComboFix.exe
2014-04-06 08:36 - 2014-04-07 20:21 - 01016261 _____ (Thisisu) C:\Users\User\Desktop\JRT_NEW.exe
2014-04-05 11:49 - 2010-03-31 20:49 - 00000000 ____D () C:\Users\User\AppData\Local\Mozilla
2014-04-05 11:45 - 2014-04-05 11:45 - 00000000 ____D () C:\Users\User\AppData\Local\Sony
2014-04-05 11:44 - 2014-04-05 11:44 - 00000000 ____D () C:\Users\User\AppData\Local\Apple
2014-04-05 11:44 - 2014-04-05 11:42 - 00044996 _____ () C:\Windows\DPINST.LOG
2014-04-05 11:42 - 2010-01-07 17:42 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-04 16:45 - 2014-04-04 16:45 - 00000000 ____D () C:\Users\User\AppData\Local\TubeBox
2014-04-04 16:38 - 2014-04-04 16:38 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2014-04-04 16:34 - 2009-07-14 19:58 - 08170182 _____ () C:\Windows\system32\perfh007.dat
2014-04-04 16:34 - 2009-07-14 19:58 - 02577708 _____ () C:\Windows\system32\perfc007.dat
2014-04-04 16:34 - 2009-07-14 07:13 - 00006260 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-04 16:30 - 2014-04-04 16:30 - 00000000 ____D () C:\Users\User\AppData\Local\Macromedia
2014-04-04 16:29 - 2014-04-04 14:02 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 4
2014-04-04 16:28 - 2014-03-30 13:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-04-04 16:27 - 2014-04-04 16:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\DiskDefrag
2014-04-04 16:27 - 2014-04-04 16:27 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-04 14:38 - 2014-04-04 14:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\Macromedia
2014-04-04 14:38 - 2013-05-12 01:22 - 00000000 ____D () C:\Users\User\Documents\Settlers7
2014-04-04 14:38 - 2013-01-18 15:37 - 00000000 ____D () C:\Users\User\AppData\Roaming\Dropbox
2014-04-04 14:38 - 2012-09-22 15:05 - 00000000 ____D () C:\Users\User\Documents\Stronghold Legends
2014-04-04 14:38 - 2012-02-20 17:19 - 00000000 ____D () C:\Users\User\Documents\DVDVideoSoft
2014-04-04 14:38 - 2012-02-02 22:13 - 00000000 ____D () C:\Users\User\Musik
2014-04-04 14:38 - 2011-08-24 00:08 - 00000000 ____D () C:\Users\User\Documents\Spartan
2014-04-04 14:38 - 2011-04-28 13:52 - 00000000 ____D () C:\Users\User\Documents\FUSSBALL MANAGER 10
2014-04-04 14:38 - 2011-04-02 20:59 - 00000000 ____D () C:\Users\User\Documents\S2
2014-04-04 14:38 - 2011-02-04 22:35 - 00000000 ____D () C:\Users\User\Documents\ICQ
2014-04-04 14:38 - 2010-07-22 20:07 - 00000000 ____D () C:\Users\User\Documents\Stronghold Crusader
2014-04-04 14:38 - 2010-01-10 16:33 - 00000000 ____D () C:\Users\User\Documents\Stronghold 2
2014-04-04 14:38 - 2010-01-07 20:03 - 00000000 ____D () C:\Users\User\Documents\My Games
2014-04-04 14:37 - 2013-09-26 19:58 - 00000000 ____D () C:\Users\User\AppData\Local\Temp852a031645b653b8fd30a8a564b60d0e
2014-04-04 14:37 - 2013-05-10 12:54 - 00000000 ____D () C:\Siedler2
2014-04-04 14:37 - 2012-05-21 21:07 - 00000000 ____D () C:\Users\User\AppData\Roaming\Scribus
2014-04-04 14:37 - 2012-03-31 20:54 - 00000000 ____D () C:\Users\Public\Downloads\Norton
2014-04-04 14:37 - 2011-07-24 17:34 - 00000000 ____D () C:\Users\User\AppData\Roaming\.minecraft
2014-04-04 14:37 - 2010-07-16 03:32 - 00000000 ____D () C:\Users\User\AppData\Roaming\Teeworlds
2014-04-04 14:37 - 2010-04-08 18:44 - 00000000 ____D () C:\Users\User\Documents\DIE SIEDLER - Aufstieg eines Königreichs
2014-04-04 14:37 - 2010-04-01 13:14 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2014-04-04 14:37 - 2010-03-31 23:21 - 00000000 ____D () C:\Users\User\AppData\Roaming\DivX
2014-04-04 14:37 - 2010-03-31 23:16 - 00000000 ____D () C:\Users\User\AppData\Local\Google
2014-04-04 14:37 - 2010-03-31 20:53 - 00000000 ____D () C:\Users\User\AppData\Roaming\ICQ
2014-04-04 14:37 - 2010-03-18 15:52 - 00000000 ____D () C:\Users\User\AppData\Roaming\Adobe
2014-04-04 14:37 - 2010-01-15 21:38 - 00000000 ____D () C:\Users\User\Documents\DIE SIEDLER - DEdK
2014-04-04 14:37 - 2010-01-07 18:39 - 00000000 ____D () C:\Users\User\AppData\Roaming\Meine Der Herr der Ringe™, Aufstieg des Hexenkönigs™-Dateien
2014-04-04 14:37 - 2010-01-07 18:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
2014-04-04 14:34 - 2013-01-18 15:52 - 00000000 ___RD () C:\Users\User\Dropbox
2014-04-04 14:32 - 2013-04-13 00:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-04 14:32 - 2011-05-29 11:47 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-04 14:29 - 2010-01-07 18:23 - 00000000 ____D () C:\Program Files (x86)\CCleaner
2014-04-04 14:27 - 2010-01-07 17:53 - 00000000 ___RD () C:\Users\User\Desktop\Spieleordner
2014-04-04 14:25 - 2010-08-17 09:08 - 00000000 ____D () C:\Windows\Lhsp
2014-04-04 14:02 - 2014-04-04 14:02 - 00002624 _____ () C:\Windows\System32\Tasks\GlaryInitialize 4
2014-04-04 14:02 - 2014-04-04 14:02 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-04-04 14:02 - 2010-01-08 23:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\GlarySoft
2014-04-04 13:28 - 2014-04-04 13:24 - 12481320 _____ () C:\Users\User\Downloads\gu4setup.exe
2014-04-03 17:48 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-03 17:45 - 2014-04-03 17:45 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-03 17:45 - 2010-01-07 00:42 - 00000000 ____D () C:\Windows\Panther
2014-04-03 17:44 - 2014-04-03 17:44 - 04787368 _____ (Piriform Ltd) C:\Users\User\Downloads\ccsetup412.exe
2014-04-03 17:08 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-03 13:18 - 2014-04-03 13:18 - 00380416 _____ () C:\Users\User\Downloads\k01fg67r.exe
2014-04-03 13:05 - 2014-04-03 13:03 - 00050515 _____ () C:\Users\User\Downloads\Addition.txt
2014-04-03 13:02 - 2014-04-03 13:02 - 00380416 _____ () C:\Users\User\Downloads\tyzuwgdb.exe
2014-04-03 13:01 - 2014-04-03 13:01 - 02157056 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-04-03 13:01 - 2014-04-03 13:01 - 01145856 _____ (Farbar) C:\Users\User\Downloads\FRST.exe
2014-04-03 12:43 - 2014-04-03 12:43 - 00448512 _____ (OldTimer Tools) C:\Users\User\Downloads\TFC.exe
2014-04-03 09:51 - 2014-04-07 19:36 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:51 - 2014-03-30 19:23 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:50 - 2013-03-07 23:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 09:43 - 2014-04-03 09:43 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe
2014-04-02 21:16 - 2011-01-14 19:25 - 00000000 ____D () C:\Program Files (x86)\Drakensang
2014-04-02 20:55 - 2014-04-02 20:55 - 00001929 _____ () C:\Users\User\Desktop\Drakensang.lnk
2014-04-02 18:54 - 2014-04-02 18:54 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-01 10:03 - 2014-04-04 14:02 - 00118048 _____ (Glarysoft Ltd) C:\Windows\system32\BootDefrag.exe
2014-03-31 17:59 - 2010-01-07 20:53 - 00089704 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-31 16:22 - 2012-02-20 17:30 - 00000000 ____D () C:\Users\User\AppData\Roaming\DVDVideoSoft
2014-03-31 15:52 - 2014-03-31 15:52 - 00002088 _____ () C:\{B0B5949C-2666-48DE-BE5B-225AB826C873}
2014-03-31 15:50 - 2014-03-31 15:50 - 00002136 _____ () C:\{8A0B66BD-D375-4BEF-8BA0-E29B7090A54D}
2014-03-31 15:46 - 2014-03-31 15:46 - 00002128 _____ () C:\{C5A3030C-4F69-463E-88FA-5D99EB49E715}
2014-03-31 15:42 - 2014-03-31 15:42 - 00002160 _____ () C:\{B0C8FB38-F1CE-4BBF-911D-D503E8DDF0F0}
2014-03-31 15:38 - 2014-03-31 15:38 - 00002168 _____ () C:\{74D4CF7E-3A62-460D-9F6E-B2EF38998DCA}
2014-03-31 15:35 - 2014-03-31 15:35 - 00002160 _____ () C:\{52081577-7905-4723-AC25-FF9FE65B2A82}
2014-03-31 15:29 - 2014-03-31 15:29 - 00002376 _____ () C:\{F93246E9-18A2-47C4-A90D-6C270A93C915}
2014-03-31 14:53 - 2014-03-31 14:53 - 00002656 _____ () C:\{B113D6B6-CA79-4389-8095-23F62C348123}
2014-03-31 14:51 - 2014-03-31 14:51 - 00002672 _____ () C:\{0713E16E-8D8E-4B10-BC25-1A92B2AA65FE}
2014-03-31 14:49 - 2014-03-31 14:49 - 00002416 _____ () C:\{AD30FAEB-8A15-4D16-9AA6-5B8D62F52837}
2014-03-31 14:47 - 2014-03-31 14:47 - 00002440 _____ () C:\{8E532289-3850-4103-831D-1FD071995237}
2014-03-31 14:28 - 2014-03-31 14:28 - 00002504 _____ () C:\{A0FE26E1-3CA3-432D-BAA8-43C9C96A3FF7}
2014-03-31 09:33 - 2014-04-04 14:02 - 00017600 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\BootDefragDriver.sys
2014-03-30 21:36 - 2014-03-30 21:35 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_enu.exe
2014-03-30 21:26 - 2014-03-30 19:23 - 00000000 ____D () C:\Users\User\Desktop\mbar
2014-03-30 21:03 - 2014-03-30 21:03 - 00002392 _____ () C:\{CD8A38DB-9CF3-4DCD-BD3E-58D66B98416D}
2014-03-30 21:02 - 2014-03-30 21:02 - 00002248 _____ () C:\{6885A95F-E6E1-4A9D-AB2E-BAE8F9969240}
2014-03-30 20:13 - 2014-03-30 20:13 - 00003544 _____ () C:\{6F8E51E1-8F5D-40D4-ACD4-F1D5F93FC76C}
2014-03-30 20:11 - 2014-03-30 20:11 - 00003384 _____ () C:\{04D80F8C-75E3-4375-992B-22173FECC1B1}
2014-03-30 19:20 - 2014-03-30 19:20 - 12589848 _____ (Malwarebytes Corp.) C:\Users\User\Downloads\mbar-1.07.0.1009.exe
2014-03-30 19:09 - 2014-03-30 19:09 - 00002816 _____ () C:\{881B3B77-D330-4BBE-9375-9C18EDE227AE}
2014-03-30 19:05 - 2014-03-30 19:05 - 00002984 _____ () C:\{65756D68-210C-4D18-8FFD-54FE0104AE20}
2014-03-30 18:53 - 2009-07-14 06:45 - 00365576 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-30 13:54 - 2013-02-18 16:47 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-03-30 13:35 - 2014-03-30 13:35 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-30 13:34 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 13:10 - 2014-03-30 13:10 - 00004051 _____ () C:\Users\User\Desktop\bookmarks-2014-03-30##
2014-03-30 12:57 - 2014-03-30 12:57 - 00000000 ____D () C:\Windows\ERUNT
2014-03-30 12:56 - 2014-03-30 12:56 - 01038974 _____ (Thisisu) C:\Users\User\Downloads\JRT.exe
2014-03-30 12:33 - 2014-03-30 12:33 - 00230780 _____ () C:\Users\User\Desktop\bookmarks-2014-03-30.json
2014-03-30 03:05 - 2011-10-19 16:03 - 00000000 ____D () C:\Program Files (x86)\Warcraft III Reign of Chaos & The Frozen Throne
2014-03-29 23:03 - 2014-03-29 23:03 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2014-03-29 23:03 - 2014-03-29 23:02 - 00283192 _____ (Mozilla) C:\Users\User\Downloads\Firefox Setup Stub 28.0.exe
2014-03-29 23:02 - 2014-03-29 23:02 - 00000000 ____D () C:\Games
2014-03-29 22:49 - 2014-03-29 22:47 - 00005933 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-29 22:49 - 2011-02-08 14:43 - 00000000 ____D () C:\Program Files (x86)\Java
2014-03-29 19:30 - 2011-12-18 15:48 - 00000000 ____D () C:\ProgramData\EPSON
2014-03-29 19:25 - 2014-03-29 19:25 - 00045536 _____ () C:\Users\User\Downloads\Minecraft Cracked.rar
2014-03-29 19:25 - 2010-01-07 19:53 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-03-27 16:54 - 2014-03-27 16:54 - 00613200 ____H (Chip Digital GmbH) C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-26 17:01 - 2014-03-26 17:01 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-26 17:01 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-03-24 19:03 - 2014-02-08 20:16 - 00000000 ____D () C:\Users\User\Desktop\Ocarina
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 ____D () C:\Users\User\AppData\Local\cache
2014-03-12 20:58 - 2014-03-12 20:58 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 20:58 - 2012-10-23 14:13 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 20:58 - 2012-04-22 01:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 20:58 - 2011-08-15 15:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 16:42 - 2014-03-12 16:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\LucasArts
2014-03-12 16:10 - 2010-01-07 17:42 - 00000000 ____D () C:\Program Files (x86)\LucasArts
2014-03-11 18:14 - 2010-07-19 22:40 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-03-11 17:37 - 2013-07-02 15:12 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA
ZeroAccess:
C:\Users\User\AppData\Local\a2f8192b
C:\Users\User\AppData\Local\a2f8192b\@
Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\drm_dyndata_7390006.dll
C:\Users\User\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-10 15:04
==================== End Of Log ============================
--- --- --- |
|
08.04.2014, 12:04
| #10 |
| /// the machine /// TB-Ausbilder | Download Protect 2.2 im Browser!ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.04.2014, 22:28
| #11 |
| | Download Protect 2.2 im Browser!Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=20ccf40a05f73846a8faf0ff82b484ee
# engine=17733
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-03 07:46:26
# local_time=2014-04-03 09:46:26 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 847 159136570 0 0
# compatibility_mode=5893 16776574 100 94 21219779 148141036 0 0
# scanned=2087
# found=1
# cleaned=0
# scan_time=45
sh=1DCF753C9DEF8F0D249929C0C601B8708168885A ft=1 fh=a4ba58bf71f15260 vn="Variante von Win32/Toolbar.MyWebSearch.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\LocalLow\FunWebProducts\Installr\Cache\0053B423.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=20ccf40a05f73846a8faf0ff82b484ee
# engine=17733
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-03 07:53:26
# local_time=2014-04-03 09:53:26 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 1267 159136990 0 0
# compatibility_mode=5893 16776574 100 94 21220199 148141456 0 0
# scanned=726
# found=1
# cleaned=0
# scan_time=32
sh=1DCF753C9DEF8F0D249929C0C601B8708168885A ft=1 fh=a4ba58bf71f15260 vn="Variante von Win32/Toolbar.MyWebSearch.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\LocalLow\FunWebProducts\Installr\Cache\0053B423.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=20ccf40a05f73846a8faf0ff82b484ee
# engine=17733
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-03 07:55:09
# local_time=2014-04-03 09:55:09 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 1370 159137093 0 0
# compatibility_mode=5893 16776574 100 94 21220302 148141559 0 0
# scanned=4608
# found=0
# cleaned=0
# scan_time=61
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=20ccf40a05f73846a8faf0ff82b484ee
# engine=17733
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-03 07:56:53
# local_time=2014-04-03 09:56:53 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 1474 159137197 0 0
# compatibility_mode=5893 16776574 100 94 21220406 148141663 0 0
# scanned=726
# found=1
# cleaned=0
# scan_time=30
sh=1DCF753C9DEF8F0D249929C0C601B8708168885A ft=1 fh=a4ba58bf71f15260 vn="Variante von Win32/Toolbar.MyWebSearch.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\LocalLow\FunWebProducts\Installr\Cache\0053B423.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=20ccf40a05f73846a8faf0ff82b484ee
# engine=17736
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-03 08:03:13
# local_time=2014-04-03 10:03:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 1854 159137577 0 0
# compatibility_mode=5893 16776574 100 94 21220786 148142043 0 0
# scanned=10412
# found=1
# cleaned=0
# scan_time=74
sh=1DCF753C9DEF8F0D249929C0C601B8708168885A ft=1 fh=a4ba58bf71f15260 vn="Variante von Win32/Toolbar.MyWebSearch.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\LocalLow\FunWebProducts\Installr\Cache\0053B423.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=20ccf40a05f73846a8faf0ff82b484ee
# engine=17736
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-03 10:44:45
# local_time=2014-04-03 12:44:45 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 11546 159147269 0 0
# compatibility_mode=5893 16776574 100 94 21230478 148151735 0 0
# scanned=378214
# found=7
# cleaned=0
# scan_time=9517
sh=08AD69C57119AA8F96473EFB7CECF40D01E8DF11 ft=1 fh=4bcfd7ab1e74fd2e vn="Variante von Win32/Delf.QZL Trojaner" ac=I fn="C:\Program Files (x86)\Warcraft III Reign of Chaos & The Frozen Throne\support\config.exe"
sh=49A1BF915C4D783A4F1E5EE56A42D6E59951F7B5 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H Anwendung" ac=I fn="C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jiaaimgndodennnepmdglhpakpllejma\1\511ff432b65063.55522973.js"
sh=3C152D4E5089A438519E2F76A0266A036F000434 ft=1 fh=afae102d647b9615 vn="Variante von Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="C:\Users\User\Documents\APNSetup.exe"
sh=50671CE02E97D813767263C9B72A4224B0D14CF4 ft=1 fh=366c6191648bd122 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader.exe"
sh=B5B41E946960F17050C00A4891CFF46B08486A4D ft=1 fh=79895fd74f1827db vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\Adobe\Shockwave 12\gt.exe"
sh=B5B41E946960F17050C00A4891CFF46B08486A4D ft=1 fh=79895fd74f1827db vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe"
sh=9F13B495ECECFF907F2389EA95D4F1B5A2013A26 ft=1 fh=fb25267eb59f3971 vn="möglicherweise Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="D:\Speicherstick\Patches\gusetup.exe"
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=20ccf40a05f73846a8faf0ff82b484ee
# engine=17817
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-09 08:30:22
# local_time=2014-04-09 10:30:22 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 470598 159700806 0 0
# compatibility_mode=5893 16776574 100 94 21784015 148705272 0 0
# scanned=335565
# found=4
# cleaned=0
# scan_time=16245
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=AE2BD660B023E4A1BE8892D32D4233763E8450C0 ft=1 fh=780fda91da5300bb vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader(1).exe"
sh=50671CE02E97D813767263C9B72A4224B0D14CF4 ft=1 fh=366c6191648bd122 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader.exe"
sh=C133DB147FA578119F34B675D45B477E110761B2 ft=1 fh=9272027fde077ca7 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Users\User\Downloads\ccsetup412.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.81
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Java(TM) 6 Update 30
Java 7 Update 51
Adobe Flash Player 12.0.0.77
Adobe Reader XI
Mozilla Firefox (28.0)
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Spybot Teatimer.exe is disabled!
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 (ATTENTION: ====> FRST version is 27 days old and could be outdated)
Ran by User (administrator) on USER-PC on 09-04-2014 23:24:47
Running from C:\Users\User\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
() C:\Windows\system32\MSAC3EOC.exe
(NVIDIA) C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtWlan.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2182144 2009-06-17] (VIA)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
Startup: C:\Users\Privat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{9908A390-79DE-4B21-92BA-FF204DB8FED8}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default
FF DefaultSearchEngine: Amazon.de
FF SelectedSearchEngine: Amazon.de
FF Homepage: hxxp://www.google.de/webhp
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus Pop-up Addon - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-04-03]
FF Extension: anonymoX - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\client@anonymox.net.xpi [2014-04-02]
FF Extension: YouTube Video and Audio Downloader - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\feca4b87-3be4-43da-a1b1-137c24220968@jetpack.xpi [2014-04-03]
FF Extension: Ghostery - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\firefox@ghostery.com.xpi [2014-04-03]
FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-02]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFF [2013-10-10]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\ []
FF HKLM-x32\...\Firefox\Extensions: [{121C6AF3-6778-4360-AFDB-57BD4E3E4343}] - C:\Program Files\Playzy\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{D7147CE7-24AC-4800-AFBE-AC95185ADD7C}] - C:\Windows\Installer\{B29D5059-C608-4D50-9936-A65984517A6F}\{D7147CE7-24AC-4800-AFBE-AC95185ADD7C}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{45544AB0-68F0-4ADE-8371-844283A04D37}] - C:\Windows\Installer\{44E19A6E-7D08-4D6C-AA35-15CCA59FF785}\{45544AB0-68F0-4ADE-8371-844283A04D37}.xpi
Chrome:
=======
CHR HomePage: hxxp://www.google.de?hl=de&gl=de
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\User\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx []
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx [2014-04-03]
==================== Services (Whitelisted) =================
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 Realtek11nCU; C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe [36864 2010-04-16] (Realtek)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 timeoutd; C:\Windows\system32\MSAC3EOC.exe [114688 2013-06-14] ()
R2 UpdateCenterService; C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe [282728 2009-11-06] (NVIDIA)
==================== Drivers (Whitelisted) ====================
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 ASPI; C:\Windows\SysWOW64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-01-15] ()
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation)
R0 BootDefragDriver; C:\Windows\System32\drivers\BootDefragDriver.sys [17600 2014-03-31] (Glarysoft Ltd)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-01-02] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20140408.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-01-15] ()
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-11] (ManyCam LLC)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] ()
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20140408.025\ENG64.SYS [126040 2014-03-12] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20140408.025\EX64.SYS [2099288 2014-03-12] (Symantec Corporation)
R3 nvoclk64; C:\Windows\System32\DRIVERS\nvoclk64.sys [42088 2009-09-15] (NVIDIA Corp.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation )
R2 SecDrv; C:\Windows\SysWOW64\drivers\SECDRV.SYS [11376 2002-10-21] ()
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-15] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-01-28] (Symantec Corporation)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-20] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-01-30] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-08-01] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [43680 2012-11-15] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2012-11-15] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
S2 tandpl; C:\Windows\SysWOW64\drivers\tandpl.sys [4736 2003-04-19] ()
R1 vmm; C:\Windows\system32\Treiber\vmm.sys [296816 2007-02-18] (Microsoft Corporation)
U2 ccEvtMgr;
U2 ccSetMgr;
U3 navapsvc;
U3 SAVRT;
U1 SAVRTPEL;
U3 TlntSvr;
U2 wuaserv;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-09 23:19 - 2014-04-09 23:24 - 00016671 _____ () C:\Users\User\Downloads\FRST.txt
2014-04-09 22:59 - 2014-04-09 22:59 - 00000000 ____D () C:\Users\User\AppData\Local\Eraser 6
2014-04-09 18:56 - 2014-04-09 18:57 - 00003384 _____ () C:\{6E9EC552-72B6-46EB-9168-B6F946BA7AA5}
2014-04-09 18:56 - 2014-04-09 18:56 - 00020136 _____ () C:\{28799A7E-FDC6-4EEE-8FF7-456F66D2D08D}
2014-04-07 19:36 - 2014-04-07 19:38 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-07 19:36 - 2014-04-07 19:36 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-07 19:36 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-06 13:38 - 2014-04-06 13:38 - 00023247 _____ () C:\Users\User\Combofix.txt
2014-04-06 13:31 - 2014-04-06 13:31 - 00023247 _____ () C:\ComboFix.txt
2014-04-06 13:14 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-06 13:14 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-06 13:14 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-06 13:12 - 2014-04-06 13:31 - 00000000 ____D () C:\Qoobox
2014-04-06 13:12 - 2014-04-06 13:29 - 00000000 ____D () C:\Windows\erdnt
2014-04-05 11:45 - 2014-04-05 11:45 - 00000000 ____D () C:\Users\User\AppData\Local\Sony
2014-04-05 11:44 - 2014-04-05 11:44 - 00000000 ____D () C:\Users\User\AppData\Local\Apple
2014-04-04 16:45 - 2014-04-04 16:45 - 00000000 ____D () C:\Users\User\AppData\Local\TubeBox
2014-04-04 16:38 - 2014-04-04 16:38 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2014-04-04 16:30 - 2014-04-04 16:30 - 00000000 ____D () C:\Users\User\AppData\Local\Macromedia
2014-04-04 16:27 - 2014-04-04 16:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\DiskDefrag
2014-04-04 14:38 - 2014-04-04 14:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\Macromedia
2014-04-04 14:02 - 2014-04-09 23:05 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 4
2014-04-04 14:02 - 2014-04-09 23:04 - 00000332 _____ () C:\Windows\Tasks\GlaryInitialize 4.job
2014-04-04 14:02 - 2014-04-04 14:02 - 00002624 _____ () C:\Windows\System32\Tasks\GlaryInitialize 4
2014-04-04 14:02 - 2014-04-04 14:02 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-04-04 14:02 - 2014-04-01 10:03 - 00118048 _____ (Glarysoft Ltd) C:\Windows\system32\BootDefrag.exe
2014-04-04 14:02 - 2014-03-31 09:33 - 00017600 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\BootDefragDriver.sys
2014-04-03 17:45 - 2014-04-03 17:45 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-03 13:02 - 2014-04-09 23:24 - 00000000 ____D () C:\FRST
2014-04-03 13:01 - 2014-04-03 13:01 - 02157056 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-04-02 20:55 - 2014-04-02 20:55 - 00001929 _____ () C:\Users\User\Desktop\Drakensang.lnk
2014-03-31 15:52 - 2014-03-31 15:52 - 00002088 _____ () C:\{B0B5949C-2666-48DE-BE5B-225AB826C873}
2014-03-31 15:50 - 2014-03-31 15:50 - 00002136 _____ () C:\{8A0B66BD-D375-4BEF-8BA0-E29B7090A54D}
2014-03-31 15:46 - 2014-03-31 15:46 - 00002128 _____ () C:\{C5A3030C-4F69-463E-88FA-5D99EB49E715}
2014-03-31 15:42 - 2014-03-31 15:42 - 00002160 _____ () C:\{B0C8FB38-F1CE-4BBF-911D-D503E8DDF0F0}
2014-03-31 15:38 - 2014-03-31 15:38 - 00002168 _____ () C:\{74D4CF7E-3A62-460D-9F6E-B2EF38998DCA}
2014-03-31 15:35 - 2014-03-31 15:35 - 00002160 _____ () C:\{52081577-7905-4723-AC25-FF9FE65B2A82}
2014-03-31 15:29 - 2014-03-31 15:29 - 00002376 _____ () C:\{F93246E9-18A2-47C4-A90D-6C270A93C915}
2014-03-31 14:53 - 2014-03-31 14:53 - 00002656 _____ () C:\{B113D6B6-CA79-4389-8095-23F62C348123}
2014-03-31 14:51 - 2014-03-31 14:51 - 00002672 _____ () C:\{0713E16E-8D8E-4B10-BC25-1A92B2AA65FE}
2014-03-31 14:49 - 2014-03-31 14:49 - 00002416 _____ () C:\{AD30FAEB-8A15-4D16-9AA6-5B8D62F52837}
2014-03-31 14:47 - 2014-03-31 14:47 - 00002440 _____ () C:\{8E532289-3850-4103-831D-1FD071995237}
2014-03-31 14:28 - 2014-03-31 14:28 - 00002504 _____ () C:\{A0FE26E1-3CA3-432D-BAA8-43C9C96A3FF7}
2014-03-30 21:03 - 2014-03-30 21:03 - 00002392 _____ () C:\{CD8A38DB-9CF3-4DCD-BD3E-58D66B98416D}
2014-03-30 21:02 - 2014-03-30 21:02 - 00002248 _____ () C:\{6885A95F-E6E1-4A9D-AB2E-BAE8F9969240}
2014-03-30 20:13 - 2014-03-30 20:13 - 00003544 _____ () C:\{6F8E51E1-8F5D-40D4-ACD4-F1D5F93FC76C}
2014-03-30 20:11 - 2014-03-30 20:11 - 00003384 _____ () C:\{04D80F8C-75E3-4375-992B-22173FECC1B1}
2014-03-30 19:23 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-30 19:23 - 2014-03-30 21:26 - 00000000 ____D () C:\Users\User\Desktop\mbar
2014-03-30 19:09 - 2014-03-30 19:09 - 00002816 _____ () C:\{881B3B77-D330-4BBE-9375-9C18EDE227AE}
2014-03-30 19:05 - 2014-03-30 19:05 - 00002984 _____ () C:\{65756D68-210C-4D18-8FFD-54FE0104AE20}
2014-03-30 13:35 - 2014-03-30 13:35 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-30 13:34 - 2014-04-03 17:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-30 13:34 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 13:18 - 2014-04-04 16:28 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-03-30 12:57 - 2014-03-30 12:57 - 00000000 ____D () C:\Windows\ERUNT
2014-03-30 12:39 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-30 12:39 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-29 23:03 - 2014-03-29 23:03 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2014-03-29 23:02 - 2014-03-29 23:02 - 00000000 ____D () C:\Games
2014-03-29 22:49 - 2013-12-18 22:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-03-29 22:49 - 2013-12-18 22:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-03-29 22:49 - 2013-12-18 22:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-03-29 22:49 - 2013-12-18 22:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-03-29 22:47 - 2014-03-29 22:49 - 00005933 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 16:54 - 2014-04-07 20:15 - 00000000 ____D () C:\AdwCleaner
2014-03-27 16:54 - 2014-03-27 16:54 - 00613200 ____H (Chip Digital GmbH) C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-26 17:51 - 2014-03-26 17:52 - 38904116 ____H () C:\Users\User\Downloads\YouPorn%20-%20Schnuggie%20s%20SEXperiment.mp4
2014-03-26 17:01 - 2014-03-26 17:01 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 ____D () C:\Users\User\AppData\Local\cache
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 _____ () C:\Users\User\daemonprocess.txt
2014-03-21 18:25 - 2013-10-02 14:59 - 00000000 ____D () C:\Users\User\Desktop\Saltatio Mortis - Das schwarze IXI (2013) [320]
2014-03-21 17:30 - 2014-03-21 18:13 - 128367703 ____H () C:\Users\User\Downloads\Saltatio Mortis - Das schwarze IXI (2013) [320].rar
2014-03-19 17:29 - 2014-03-19 17:30 - 19063005 ____H () C:\Users\User\Downloads\YouPorn%20-%20Junge%20Studentin%20aus%20Halle.mp4
2014-03-19 17:17 - 2014-03-19 17:17 - 21456297 ____H () C:\Users\User\Downloads\YouPorn%20-%20S%20sse%20Berliner%20Studentin.mp4
2014-03-14 16:55 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-14 16:55 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-14 16:55 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-14 16:55 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-14 16:55 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-14 16:55 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-14 16:55 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-14 16:55 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-14 16:55 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-14 16:55 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-14 16:55 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-14 16:55 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-14 16:55 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 16:55 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-14 16:55 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-14 16:55 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 16:55 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-14 16:55 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-14 16:55 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 16:55 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-14 16:55 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 16:55 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 16:55 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 16:55 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-14 16:55 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 16:55 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-14 16:55 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-14 16:55 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-14 16:55 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-14 16:55 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 16:55 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 16:55 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-14 16:55 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 16:55 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-14 16:55 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 16:55 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-14 16:55 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 16:55 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 16:55 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-14 16:55 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-14 16:31 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-14 16:31 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-12 20:58 - 2014-03-12 20:58 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 16:42 - 2014-03-12 16:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\LucasArts
2014-03-11 18:14 - 2014-03-04 13:32 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-03-11 18:10 - 2014-03-04 16:35 - 31474976 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 25255256 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 23716640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 17755424 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 12708128 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-03-11 18:10 - 2014-03-04 16:35 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 03143456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02958792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02783008 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02411976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00877856 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00863064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00846168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
==================== One Month Modified Files and Folders =======
2014-04-09 23:24 - 2014-04-09 23:19 - 00016671 _____ () C:\Users\User\Downloads\FRST.txt
2014-04-09 23:24 - 2014-04-03 13:02 - 00000000 ____D () C:\FRST
2014-04-09 23:05 - 2014-04-04 14:02 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 4
2014-04-09 23:04 - 2014-04-04 14:02 - 00000332 _____ () C:\Windows\Tasks\GlaryInitialize 4.job
2014-04-09 23:04 - 2010-01-07 00:46 - 01078494 _____ () C:\Windows\WindowsUpdate.log
2014-04-09 22:59 - 2014-04-09 22:59 - 00000000 ____D () C:\Users\User\AppData\Local\Eraser 6
2014-04-09 22:56 - 2012-10-23 14:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-09 18:57 - 2014-04-09 18:56 - 00003384 _____ () C:\{6E9EC552-72B6-46EB-9168-B6F946BA7AA5}
2014-04-09 18:56 - 2014-04-09 18:56 - 00020136 _____ () C:\{28799A7E-FDC6-4EEE-8FF7-456F66D2D08D}
2014-04-09 16:46 - 2009-07-14 06:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-09 16:46 - 2009-07-14 06:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-09 16:39 - 2010-07-01 21:58 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-04-09 16:39 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-09 08:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-07 20:26 - 2010-01-07 17:55 - 00000000 ___RD () C:\Users\User\Desktop\Fehlerbehebung
2014-04-07 20:15 - 2014-03-27 16:54 - 00000000 ____D () C:\AdwCleaner
2014-04-07 19:38 - 2014-04-07 19:36 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-07 19:36 - 2014-04-07 19:36 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-07 19:36 - 2013-03-07 23:25 - 00000000 ____D () C:\Users\User\AppData\Roaming\Malwarebytes
2014-04-07 19:36 - 2013-03-07 23:25 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-06 13:38 - 2014-04-06 13:38 - 00023247 _____ () C:\Users\User\Combofix.txt
2014-04-06 13:31 - 2014-04-06 13:31 - 00023247 _____ () C:\ComboFix.txt
2014-04-06 13:31 - 2014-04-06 13:12 - 00000000 ____D () C:\Qoobox
2014-04-06 13:31 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-06 13:29 - 2014-04-06 13:12 - 00000000 ____D () C:\Windows\erdnt
2014-04-06 13:25 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-06 13:24 - 2009-07-14 04:34 - 79167488 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 22806528 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 04980736 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 00090112 _____ () C:\Windows\system32\config\SAM.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 00032768 _____ () C:\Windows\system32\config\SECURITY.bak
2014-04-05 11:49 - 2010-03-31 20:49 - 00000000 ____D () C:\Users\User\AppData\Local\Mozilla
2014-04-05 11:45 - 2014-04-05 11:45 - 00000000 ____D () C:\Users\User\AppData\Local\Sony
2014-04-05 11:44 - 2014-04-05 11:44 - 00000000 ____D () C:\Users\User\AppData\Local\Apple
2014-04-05 11:42 - 2010-01-07 17:42 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-04 16:45 - 2014-04-04 16:45 - 00000000 ____D () C:\Users\User\AppData\Local\TubeBox
2014-04-04 16:38 - 2014-04-04 16:38 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2014-04-04 16:34 - 2009-07-14 19:58 - 08170182 _____ () C:\Windows\system32\perfh007.dat
2014-04-04 16:34 - 2009-07-14 19:58 - 02577708 _____ () C:\Windows\system32\perfc007.dat
2014-04-04 16:34 - 2009-07-14 07:13 - 00006260 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-04 16:30 - 2014-04-04 16:30 - 00000000 ____D () C:\Users\User\AppData\Local\Macromedia
2014-04-04 16:28 - 2014-03-30 13:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-04-04 16:27 - 2014-04-04 16:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\DiskDefrag
2014-04-04 14:38 - 2014-04-04 14:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\Macromedia
2014-04-04 14:38 - 2013-05-12 01:22 - 00000000 ____D () C:\Users\User\Documents\Settlers7
2014-04-04 14:38 - 2013-01-18 15:37 - 00000000 ____D () C:\Users\User\AppData\Roaming\Dropbox
2014-04-04 14:38 - 2012-09-22 15:05 - 00000000 ____D () C:\Users\User\Documents\Stronghold Legends
2014-04-04 14:38 - 2012-02-20 17:19 - 00000000 ____D () C:\Users\User\Documents\DVDVideoSoft
2014-04-04 14:38 - 2012-02-02 22:13 - 00000000 ____D () C:\Users\User\Musik
2014-04-04 14:38 - 2011-08-24 00:08 - 00000000 ____D () C:\Users\User\Documents\Spartan
2014-04-04 14:38 - 2011-04-28 13:52 - 00000000 ____D () C:\Users\User\Documents\FUSSBALL MANAGER 10
2014-04-04 14:38 - 2011-04-02 20:59 - 00000000 ____D () C:\Users\User\Documents\S2
2014-04-04 14:38 - 2011-02-04 22:35 - 00000000 ____D () C:\Users\User\Documents\ICQ
2014-04-04 14:38 - 2010-07-22 20:07 - 00000000 ____D () C:\Users\User\Documents\Stronghold Crusader
2014-04-04 14:38 - 2010-01-10 16:33 - 00000000 ____D () C:\Users\User\Documents\Stronghold 2
2014-04-04 14:38 - 2010-01-07 20:03 - 00000000 ____D () C:\Users\User\Documents\My Games
2014-04-04 14:37 - 2013-09-26 19:58 - 00000000 ____D () C:\Users\User\AppData\Local\Temp852a031645b653b8fd30a8a564b60d0e
2014-04-04 14:37 - 2013-05-10 12:54 - 00000000 ____D () C:\Siedler2
2014-04-04 14:37 - 2012-05-21 21:07 - 00000000 ____D () C:\Users\User\AppData\Roaming\Scribus
2014-04-04 14:37 - 2012-03-31 20:54 - 00000000 ____D () C:\Users\Public\Downloads\Norton
2014-04-04 14:37 - 2011-07-24 17:34 - 00000000 ____D () C:\Users\User\AppData\Roaming\.minecraft
2014-04-04 14:37 - 2010-07-16 03:32 - 00000000 ____D () C:\Users\User\AppData\Roaming\Teeworlds
2014-04-04 14:37 - 2010-04-08 18:44 - 00000000 ____D () C:\Users\User\Documents\DIE SIEDLER - Aufstieg eines Königreichs
2014-04-04 14:37 - 2010-04-01 13:14 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2014-04-04 14:37 - 2010-03-31 23:21 - 00000000 ____D () C:\Users\User\AppData\Roaming\DivX
2014-04-04 14:37 - 2010-03-31 23:16 - 00000000 ____D () C:\Users\User\AppData\Local\Google
2014-04-04 14:37 - 2010-03-31 20:53 - 00000000 ____D () C:\Users\User\AppData\Roaming\ICQ
2014-04-04 14:37 - 2010-03-18 15:52 - 00000000 ____D () C:\Users\User\AppData\Roaming\Adobe
2014-04-04 14:37 - 2010-01-15 21:38 - 00000000 ____D () C:\Users\User\Documents\DIE SIEDLER - DEdK
2014-04-04 14:37 - 2010-01-07 18:39 - 00000000 ____D () C:\Users\User\AppData\Roaming\Meine Der Herr der Ringe™, Aufstieg des Hexenkönigs™-Dateien
2014-04-04 14:37 - 2010-01-07 18:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
2014-04-04 14:34 - 2013-01-18 15:52 - 00000000 ___RD () C:\Users\User\Dropbox
2014-04-04 14:32 - 2013-04-13 00:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-04 14:32 - 2011-05-29 11:47 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-04 14:29 - 2010-01-07 18:23 - 00000000 ____D () C:\Program Files (x86)\CCleaner
2014-04-04 14:27 - 2010-01-07 17:53 - 00000000 ___RD () C:\Users\User\Desktop\Spieleordner
2014-04-04 14:25 - 2010-08-17 09:08 - 00000000 ____D () C:\Windows\Lhsp
2014-04-04 14:02 - 2014-04-04 14:02 - 00002624 _____ () C:\Windows\System32\Tasks\GlaryInitialize 4
2014-04-04 14:02 - 2014-04-04 14:02 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-04-04 14:02 - 2010-01-08 23:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\GlarySoft
2014-04-03 17:48 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-03 17:45 - 2014-04-03 17:45 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-03 17:45 - 2010-01-07 00:42 - 00000000 ____D () C:\Windows\Panther
2014-04-03 13:01 - 2014-04-03 13:01 - 02157056 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-04-03 09:51 - 2014-04-07 19:36 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:51 - 2014-03-30 19:23 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:50 - 2013-03-07 23:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-02 21:16 - 2011-01-14 19:25 - 00000000 ____D () C:\Program Files (x86)\Drakensang
2014-04-02 20:55 - 2014-04-02 20:55 - 00001929 _____ () C:\Users\User\Desktop\Drakensang.lnk
2014-04-01 10:03 - 2014-04-04 14:02 - 00118048 _____ (Glarysoft Ltd) C:\Windows\system32\BootDefrag.exe
2014-03-31 17:59 - 2010-01-07 20:53 - 00089704 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-31 16:22 - 2012-02-20 17:30 - 00000000 ____D () C:\Users\User\AppData\Roaming\DVDVideoSoft
2014-03-31 15:52 - 2014-03-31 15:52 - 00002088 _____ () C:\{B0B5949C-2666-48DE-BE5B-225AB826C873}
2014-03-31 15:50 - 2014-03-31 15:50 - 00002136 _____ () C:\{8A0B66BD-D375-4BEF-8BA0-E29B7090A54D}
2014-03-31 15:46 - 2014-03-31 15:46 - 00002128 _____ () C:\{C5A3030C-4F69-463E-88FA-5D99EB49E715}
2014-03-31 15:42 - 2014-03-31 15:42 - 00002160 _____ () C:\{B0C8FB38-F1CE-4BBF-911D-D503E8DDF0F0}
2014-03-31 15:38 - 2014-03-31 15:38 - 00002168 _____ () C:\{74D4CF7E-3A62-460D-9F6E-B2EF38998DCA}
2014-03-31 15:35 - 2014-03-31 15:35 - 00002160 _____ () C:\{52081577-7905-4723-AC25-FF9FE65B2A82}
2014-03-31 15:29 - 2014-03-31 15:29 - 00002376 _____ () C:\{F93246E9-18A2-47C4-A90D-6C270A93C915}
2014-03-31 14:53 - 2014-03-31 14:53 - 00002656 _____ () C:\{B113D6B6-CA79-4389-8095-23F62C348123}
2014-03-31 14:51 - 2014-03-31 14:51 - 00002672 _____ () C:\{0713E16E-8D8E-4B10-BC25-1A92B2AA65FE}
2014-03-31 14:49 - 2014-03-31 14:49 - 00002416 _____ () C:\{AD30FAEB-8A15-4D16-9AA6-5B8D62F52837}
2014-03-31 14:47 - 2014-03-31 14:47 - 00002440 _____ () C:\{8E532289-3850-4103-831D-1FD071995237}
2014-03-31 14:28 - 2014-03-31 14:28 - 00002504 _____ () C:\{A0FE26E1-3CA3-432D-BAA8-43C9C96A3FF7}
2014-03-31 09:33 - 2014-04-04 14:02 - 00017600 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\BootDefragDriver.sys
2014-03-30 21:26 - 2014-03-30 19:23 - 00000000 ____D () C:\Users\User\Desktop\mbar
2014-03-30 21:03 - 2014-03-30 21:03 - 00002392 _____ () C:\{CD8A38DB-9CF3-4DCD-BD3E-58D66B98416D}
2014-03-30 21:02 - 2014-03-30 21:02 - 00002248 _____ () C:\{6885A95F-E6E1-4A9D-AB2E-BAE8F9969240}
2014-03-30 20:13 - 2014-03-30 20:13 - 00003544 _____ () C:\{6F8E51E1-8F5D-40D4-ACD4-F1D5F93FC76C}
2014-03-30 20:11 - 2014-03-30 20:11 - 00003384 _____ () C:\{04D80F8C-75E3-4375-992B-22173FECC1B1}
2014-03-30 19:09 - 2014-03-30 19:09 - 00002816 _____ () C:\{881B3B77-D330-4BBE-9375-9C18EDE227AE}
2014-03-30 19:05 - 2014-03-30 19:05 - 00002984 _____ () C:\{65756D68-210C-4D18-8FFD-54FE0104AE20}
2014-03-30 18:53 - 2009-07-14 06:45 - 00365576 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-30 13:54 - 2013-02-18 16:47 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-03-30 13:35 - 2014-03-30 13:35 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-30 13:34 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 12:57 - 2014-03-30 12:57 - 00000000 ____D () C:\Windows\ERUNT
2014-03-30 03:05 - 2011-10-19 16:03 - 00000000 ____D () C:\Program Files (x86)\Warcraft III Reign of Chaos & The Frozen Throne
2014-03-29 23:03 - 2014-03-29 23:03 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2014-03-29 23:02 - 2014-03-29 23:02 - 00000000 ____D () C:\Games
2014-03-29 22:49 - 2014-03-29 22:47 - 00005933 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-29 22:49 - 2011-02-08 14:43 - 00000000 ____D () C:\Program Files (x86)\Java
2014-03-29 19:30 - 2011-12-18 15:48 - 00000000 ____D () C:\ProgramData\EPSON
2014-03-29 19:25 - 2010-01-07 19:53 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-03-27 16:54 - 2014-03-27 16:54 - 00613200 ____H (Chip Digital GmbH) C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-26 17:01 - 2014-03-26 17:01 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-26 17:01 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-03-24 19:03 - 2014-02-08 20:16 - 00000000 ____D () C:\Users\User\Desktop\Ocarina
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 ____D () C:\Users\User\AppData\Local\cache
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 _____ () C:\Users\User\daemonprocess.txt
2014-03-21 18:13 - 2014-03-21 17:30 - 128367703 ____H () C:\Users\User\Downloads\Saltatio Mortis - Das schwarze IXI (2013) [320].rar
2014-03-12 20:58 - 2014-03-12 20:58 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 20:58 - 2012-10-23 14:13 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 20:58 - 2012-04-22 01:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 20:58 - 2011-08-15 15:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 16:42 - 2014-03-12 16:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\LucasArts
2014-03-12 16:10 - 2010-01-07 17:42 - 00000000 ____D () C:\Program Files (x86)\LucasArts
2014-03-11 18:14 - 2010-07-19 22:40 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-03-11 17:37 - 2013-07-02 15:12 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA
ZeroAccess:
C:\Users\User\AppData\Local\a2f8192b
C:\Users\User\AppData\Local\a2f8192b\@
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-10 15:04
==================== End Of Log ============================
--- --- --- Darf ich noch kurz fragen, was es da mit der "Playzy"-Extension bei Firefox auf sich hat? |
|
10.04.2014, 20:35
| #12 |
| /// the machine /// TB-Ausbilder | Download Protect 2.2 im Browser! Die fliegt jetzt. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
FF HKLM-x32\...\Firefox\Extensions: [{121C6AF3-6778-4360-AFDB-57BD4E3E4343}] - C:\Program Files\Playzy\Firefox
ZeroAccess:
C:\Users\User\AppData\Local\a2f8192b
C:\Users\User\AppData\Local\a2f8192b\@
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.04.2014, 22:39
| #13 |
| | Download Protect 2.2 im Browser!Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by User at 2014-04-10 23:29:06 Run:2
Running from C:\Users\User\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
FF HKLM-x32\...\Firefox\Extensions: [{121C6AF3-6778-4360-AFDB-57BD4E3E4343}] - C:\Program Files\Playzy\Firefox
ZeroAccess:
C:\Users\User\AppData\Local\a2f8192b
C:\Users\User\AppData\Local\a2f8192b\@
*****************
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 (ATTENTION: ====> FRST version is 28 days old and could be outdated)
Ran by User (administrator) on USER-PC on 10-04-2014 23:35:54
Running from C:\Users\User\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
() C:\Windows\system32\MSAC3EOC.exe
(NVIDIA) C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtWlan.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2182144 2009-06-17] (VIA)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
Startup: C:\Users\Privat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{9908A390-79DE-4B21-92BA-FF204DB8FED8}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default
FF DefaultSearchEngine: Amazon.de
FF SelectedSearchEngine: Amazon.de
FF Homepage: hxxp://www.google.de/webhp
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus Pop-up Addon - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-04-03]
FF Extension: anonymoX - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\client@anonymox.net.xpi [2014-04-02]
FF Extension: YouTube Video and Audio Downloader - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\feca4b87-3be4-43da-a1b1-137c24220968@jetpack.xpi [2014-04-03]
FF Extension: Ghostery - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\firefox@ghostery.com.xpi [2014-04-03]
FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\zgoi7n2e.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-02]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFF [2013-10-10]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\ []
FF HKLM-x32\...\Firefox\Extensions: [{D7147CE7-24AC-4800-AFBE-AC95185ADD7C}] - C:\Windows\Installer\{B29D5059-C608-4D50-9936-A65984517A6F}\{D7147CE7-24AC-4800-AFBE-AC95185ADD7C}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{45544AB0-68F0-4ADE-8371-844283A04D37}] - C:\Windows\Installer\{44E19A6E-7D08-4D6C-AA35-15CCA59FF785}\{45544AB0-68F0-4ADE-8371-844283A04D37}.xpi
Chrome:
=======
CHR HomePage: hxxp://www.google.de?hl=de&gl=de
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\User\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx []
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx [2014-04-03]
==================== Services (Whitelisted) =================
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 Realtek11nCU; C:\Program Files (x86)\Hama\Wireless LAN RTL8188CU\RtlService.exe [36864 2010-04-16] (Realtek)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 timeoutd; C:\Windows\system32\MSAC3EOC.exe [114688 2013-06-14] ()
R2 UpdateCenterService; C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe [282728 2009-11-06] (NVIDIA)
==================== Drivers (Whitelisted) ====================
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 ASPI; C:\Windows\SysWOW64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-01-15] ()
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation)
R0 BootDefragDriver; C:\Windows\System32\drivers\BootDefragDriver.sys [17600 2014-03-31] (Glarysoft Ltd)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-01-02] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-03-12] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20140409.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-01-15] ()
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-11] (ManyCam LLC)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] ()
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20140410.001\ENG64.SYS [126040 2014-03-12] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20140410.001\EX64.SYS [2099288 2014-03-12] (Symantec Corporation)
R3 nvoclk64; C:\Windows\System32\DRIVERS\nvoclk64.sys [42088 2009-09-15] (NVIDIA Corp.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation )
R2 SecDrv; C:\Windows\SysWOW64\drivers\SECDRV.SYS [11376 2002-10-21] ()
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-15] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-01-28] (Symantec Corporation)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-20] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-01-30] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-08-01] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [43680 2012-11-15] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2012-11-15] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
S2 tandpl; C:\Windows\SysWOW64\drivers\tandpl.sys [4736 2003-04-19] ()
R1 vmm; C:\Windows\system32\Treiber\vmm.sys [296816 2007-02-18] (Microsoft Corporation)
U2 ccEvtMgr;
U2 ccSetMgr;
U3 navapsvc;
U3 SAVRT;
U1 SAVRTPEL;
U3 TlntSvr;
U2 wuaserv;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-10 11:41 - 2014-04-10 11:42 - 32696705 _____ () C:\Users\User\Downloads\YouPorn%20-%20Chubby%20busty%20cutie%20Annas%20vibes%20pussy.mp4
2014-04-10 11:31 - 2014-04-10 23:31 - 00001456 _____ () C:\Windows\setupact.log
2014-04-10 11:31 - 2014-04-10 11:31 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-10 11:30 - 2014-04-10 11:30 - 00002112 _____ () C:\Windows\PFRO.log
2014-04-10 11:29 - 2014-04-10 11:29 - 00003424 ____N () C:\bootsqm.dat
2014-04-09 23:19 - 2014-04-10 23:35 - 00016314 _____ () C:\Users\User\Downloads\FRST.txt
2014-04-09 22:59 - 2014-04-09 22:59 - 00000000 ____D () C:\Users\User\AppData\Local\Eraser 6
2014-04-09 18:56 - 2014-04-09 18:57 - 00003384 _____ () C:\{6E9EC552-72B6-46EB-9168-B6F946BA7AA5}
2014-04-09 18:56 - 2014-04-09 18:56 - 00020136 _____ () C:\{28799A7E-FDC6-4EEE-8FF7-456F66D2D08D}
2014-04-07 19:36 - 2014-04-07 19:38 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-07 19:36 - 2014-04-07 19:36 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-07 19:36 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-06 13:38 - 2014-04-06 13:38 - 00023247 _____ () C:\Users\User\Combofix.txt
2014-04-06 13:31 - 2014-04-06 13:31 - 00023247 _____ () C:\ComboFix.txt
2014-04-06 13:14 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-06 13:14 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-06 13:14 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-06 13:14 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-06 13:12 - 2014-04-06 13:31 - 00000000 ____D () C:\Qoobox
2014-04-06 13:12 - 2014-04-06 13:29 - 00000000 ____D () C:\Windows\erdnt
2014-04-05 11:45 - 2014-04-05 11:45 - 00000000 ____D () C:\Users\User\AppData\Local\Sony
2014-04-05 11:44 - 2014-04-05 11:44 - 00000000 ____D () C:\Users\User\AppData\Local\Apple
2014-04-04 16:45 - 2014-04-04 16:45 - 00000000 ____D () C:\Users\User\AppData\Local\TubeBox
2014-04-04 16:38 - 2014-04-04 16:38 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2014-04-04 16:30 - 2014-04-04 16:30 - 00000000 ____D () C:\Users\User\AppData\Local\Macromedia
2014-04-04 16:27 - 2014-04-04 16:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\DiskDefrag
2014-04-04 14:38 - 2014-04-04 14:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\Macromedia
2014-04-04 14:02 - 2014-04-10 23:31 - 00000332 _____ () C:\Windows\Tasks\GlaryInitialize 4.job
2014-04-04 14:02 - 2014-04-09 23:05 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 4
2014-04-04 14:02 - 2014-04-04 14:02 - 00002624 _____ () C:\Windows\System32\Tasks\GlaryInitialize 4
2014-04-04 14:02 - 2014-04-04 14:02 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-04-04 14:02 - 2014-04-01 10:03 - 00118048 _____ (Glarysoft Ltd) C:\Windows\system32\BootDefrag.exe
2014-04-04 14:02 - 2014-03-31 09:33 - 00017600 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\BootDefragDriver.sys
2014-04-03 17:45 - 2014-04-03 17:45 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-03 13:02 - 2014-04-10 23:35 - 00000000 ____D () C:\FRST
2014-04-03 13:01 - 2014-04-03 13:01 - 02157056 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-04-02 20:55 - 2014-04-02 20:55 - 00001929 _____ () C:\Users\User\Desktop\Drakensang.lnk
2014-03-31 15:52 - 2014-03-31 15:52 - 00002088 _____ () C:\{B0B5949C-2666-48DE-BE5B-225AB826C873}
2014-03-31 15:50 - 2014-03-31 15:50 - 00002136 _____ () C:\{8A0B66BD-D375-4BEF-8BA0-E29B7090A54D}
2014-03-31 15:46 - 2014-03-31 15:46 - 00002128 _____ () C:\{C5A3030C-4F69-463E-88FA-5D99EB49E715}
2014-03-31 15:42 - 2014-03-31 15:42 - 00002160 _____ () C:\{B0C8FB38-F1CE-4BBF-911D-D503E8DDF0F0}
2014-03-31 15:38 - 2014-03-31 15:38 - 00002168 _____ () C:\{74D4CF7E-3A62-460D-9F6E-B2EF38998DCA}
2014-03-31 15:35 - 2014-03-31 15:35 - 00002160 _____ () C:\{52081577-7905-4723-AC25-FF9FE65B2A82}
2014-03-31 15:29 - 2014-03-31 15:29 - 00002376 _____ () C:\{F93246E9-18A2-47C4-A90D-6C270A93C915}
2014-03-31 14:53 - 2014-03-31 14:53 - 00002656 _____ () C:\{B113D6B6-CA79-4389-8095-23F62C348123}
2014-03-31 14:51 - 2014-03-31 14:51 - 00002672 _____ () C:\{0713E16E-8D8E-4B10-BC25-1A92B2AA65FE}
2014-03-31 14:49 - 2014-03-31 14:49 - 00002416 _____ () C:\{AD30FAEB-8A15-4D16-9AA6-5B8D62F52837}
2014-03-31 14:47 - 2014-03-31 14:47 - 00002440 _____ () C:\{8E532289-3850-4103-831D-1FD071995237}
2014-03-31 14:28 - 2014-03-31 14:28 - 00002504 _____ () C:\{A0FE26E1-3CA3-432D-BAA8-43C9C96A3FF7}
2014-03-30 21:03 - 2014-03-30 21:03 - 00002392 _____ () C:\{CD8A38DB-9CF3-4DCD-BD3E-58D66B98416D}
2014-03-30 21:02 - 2014-03-30 21:02 - 00002248 _____ () C:\{6885A95F-E6E1-4A9D-AB2E-BAE8F9969240}
2014-03-30 20:13 - 2014-03-30 20:13 - 00003544 _____ () C:\{6F8E51E1-8F5D-40D4-ACD4-F1D5F93FC76C}
2014-03-30 20:11 - 2014-03-30 20:11 - 00003384 _____ () C:\{04D80F8C-75E3-4375-992B-22173FECC1B1}
2014-03-30 19:23 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-30 19:23 - 2014-03-30 21:26 - 00000000 ____D () C:\Users\User\Desktop\mbar
2014-03-30 19:09 - 2014-03-30 19:09 - 00002816 _____ () C:\{881B3B77-D330-4BBE-9375-9C18EDE227AE}
2014-03-30 19:05 - 2014-03-30 19:05 - 00002984 _____ () C:\{65756D68-210C-4D18-8FFD-54FE0104AE20}
2014-03-30 13:35 - 2014-03-30 13:35 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-30 13:34 - 2014-04-03 17:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-30 13:34 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 13:18 - 2014-04-04 16:28 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-03-30 12:57 - 2014-03-30 12:57 - 00000000 ____D () C:\Windows\ERUNT
2014-03-30 12:39 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-30 12:39 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-29 23:03 - 2014-03-29 23:03 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2014-03-29 23:02 - 2014-03-29 23:02 - 00000000 ____D () C:\Games
2014-03-29 22:49 - 2013-12-18 22:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-03-29 22:49 - 2013-12-18 22:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-03-29 22:49 - 2013-12-18 22:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-03-29 22:49 - 2013-12-18 22:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-03-29 22:47 - 2014-03-29 22:49 - 00005933 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 16:54 - 2014-04-07 20:15 - 00000000 ____D () C:\AdwCleaner
2014-03-27 16:54 - 2014-03-27 16:54 - 00613200 ____H (Chip Digital GmbH) C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-26 17:01 - 2014-04-10 23:31 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 ____D () C:\Users\User\AppData\Local\cache
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 _____ () C:\Users\User\daemonprocess.txt
2014-03-21 18:25 - 2013-10-02 14:59 - 00000000 ____D () C:\Users\User\Desktop\Saltatio Mortis - Das schwarze IXI (2013) [320]
2014-03-21 17:30 - 2014-03-21 18:13 - 128367703 ____H () C:\Users\User\Downloads\Saltatio Mortis - Das schwarze IXI (2013) [320].rar
2014-03-14 16:55 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-14 16:55 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-14 16:55 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-14 16:55 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-14 16:55 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-14 16:55 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-14 16:55 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-14 16:55 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-14 16:55 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-14 16:55 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-14 16:55 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-14 16:55 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-14 16:55 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 16:55 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-14 16:55 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-14 16:55 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 16:55 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-14 16:55 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-14 16:55 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 16:55 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-14 16:55 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 16:55 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 16:55 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 16:55 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-14 16:55 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 16:55 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-14 16:55 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-14 16:55 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-14 16:55 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-14 16:55 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 16:55 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 16:55 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-14 16:55 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 16:55 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-14 16:55 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 16:55 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-14 16:55 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 16:55 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 16:55 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-14 16:55 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-14 16:31 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-14 16:31 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-12 20:58 - 2014-03-12 20:58 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 16:42 - 2014-03-12 16:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\LucasArts
2014-03-11 18:14 - 2014-03-04 13:32 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-03-11 18:10 - 2014-03-04 16:35 - 31474976 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 25255256 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 23716640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 17755424 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 12708128 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-03-11 18:10 - 2014-03-04 16:35 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 03143456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02958792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02783008 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 02411976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00877856 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00863064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-03-11 18:10 - 2014-03-04 16:35 - 00846168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
==================== One Month Modified Files and Folders =======
2014-04-10 23:36 - 2014-04-09 23:19 - 00016314 _____ () C:\Users\User\Downloads\FRST.txt
2014-04-10 23:35 - 2014-04-03 13:02 - 00000000 ____D () C:\FRST
2014-04-10 23:34 - 2010-01-07 00:46 - 01107629 _____ () C:\Windows\WindowsUpdate.log
2014-04-10 23:31 - 2014-04-10 11:31 - 00001456 _____ () C:\Windows\setupact.log
2014-04-10 23:31 - 2014-04-04 14:02 - 00000332 _____ () C:\Windows\Tasks\GlaryInitialize 4.job
2014-04-10 23:31 - 2014-03-26 17:01 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-04-10 23:30 - 2010-07-01 21:58 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-04-10 23:30 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-10 23:29 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-04-10 22:56 - 2012-10-23 14:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-10 18:19 - 2009-07-14 06:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-10 18:19 - 2009-07-14 06:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-10 11:38 - 2009-07-14 19:58 - 08186620 _____ () C:\Windows\system32\perfh007.dat
2014-04-10 11:38 - 2009-07-14 19:58 - 02583162 _____ () C:\Windows\system32\perfc007.dat
2014-04-10 11:38 - 2009-07-14 07:13 - 00006260 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-10 11:31 - 2014-04-10 11:31 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-10 11:30 - 2014-04-10 11:30 - 00002112 _____ () C:\Windows\PFRO.log
2014-04-10 11:29 - 2014-04-10 11:29 - 00003424 ____N () C:\bootsqm.dat
2014-04-09 23:05 - 2014-04-04 14:02 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 4
2014-04-09 22:59 - 2014-04-09 22:59 - 00000000 ____D () C:\Users\User\AppData\Local\Eraser 6
2014-04-09 18:57 - 2014-04-09 18:56 - 00003384 _____ () C:\{6E9EC552-72B6-46EB-9168-B6F946BA7AA5}
2014-04-09 18:56 - 2014-04-09 18:56 - 00020136 _____ () C:\{28799A7E-FDC6-4EEE-8FF7-456F66D2D08D}
2014-04-09 08:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-07 20:26 - 2010-01-07 17:55 - 00000000 ___RD () C:\Users\User\Desktop\Fehlerbehebung
2014-04-07 20:15 - 2014-03-27 16:54 - 00000000 ____D () C:\AdwCleaner
2014-04-07 19:38 - 2014-04-07 19:36 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-07 19:36 - 2014-04-07 19:36 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-07 19:36 - 2013-03-07 23:25 - 00000000 ____D () C:\Users\User\AppData\Roaming\Malwarebytes
2014-04-07 19:36 - 2013-03-07 23:25 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-06 13:38 - 2014-04-06 13:38 - 00023247 _____ () C:\Users\User\Combofix.txt
2014-04-06 13:31 - 2014-04-06 13:31 - 00023247 _____ () C:\ComboFix.txt
2014-04-06 13:31 - 2014-04-06 13:12 - 00000000 ____D () C:\Qoobox
2014-04-06 13:31 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-06 13:29 - 2014-04-06 13:12 - 00000000 ____D () C:\Windows\erdnt
2014-04-06 13:25 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-06 13:24 - 2009-07-14 04:34 - 79167488 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 22806528 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 04980736 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 00090112 _____ () C:\Windows\system32\config\SAM.bak
2014-04-06 13:24 - 2009-07-14 04:34 - 00032768 _____ () C:\Windows\system32\config\SECURITY.bak
2014-04-05 11:49 - 2010-03-31 20:49 - 00000000 ____D () C:\Users\User\AppData\Local\Mozilla
2014-04-05 11:45 - 2014-04-05 11:45 - 00000000 ____D () C:\Users\User\AppData\Local\Sony
2014-04-05 11:44 - 2014-04-05 11:44 - 00000000 ____D () C:\Users\User\AppData\Local\Apple
2014-04-05 11:42 - 2010-01-07 17:42 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-04 16:45 - 2014-04-04 16:45 - 00000000 ____D () C:\Users\User\AppData\Local\TubeBox
2014-04-04 16:38 - 2014-04-04 16:38 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2014-04-04 16:30 - 2014-04-04 16:30 - 00000000 ____D () C:\Users\User\AppData\Local\Macromedia
2014-04-04 16:28 - 2014-03-30 13:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-04-04 16:27 - 2014-04-04 16:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\DiskDefrag
2014-04-04 14:38 - 2014-04-04 14:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\Macromedia
2014-04-04 14:38 - 2013-05-12 01:22 - 00000000 ____D () C:\Users\User\Documents\Settlers7
2014-04-04 14:38 - 2013-01-18 15:37 - 00000000 ____D () C:\Users\User\AppData\Roaming\Dropbox
2014-04-04 14:38 - 2012-09-22 15:05 - 00000000 ____D () C:\Users\User\Documents\Stronghold Legends
2014-04-04 14:38 - 2012-02-20 17:19 - 00000000 ____D () C:\Users\User\Documents\DVDVideoSoft
2014-04-04 14:38 - 2012-02-02 22:13 - 00000000 ____D () C:\Users\User\Musik
2014-04-04 14:38 - 2011-08-24 00:08 - 00000000 ____D () C:\Users\User\Documents\Spartan
2014-04-04 14:38 - 2011-04-28 13:52 - 00000000 ____D () C:\Users\User\Documents\FUSSBALL MANAGER 10
2014-04-04 14:38 - 2011-04-02 20:59 - 00000000 ____D () C:\Users\User\Documents\S2
2014-04-04 14:38 - 2011-02-04 22:35 - 00000000 ____D () C:\Users\User\Documents\ICQ
2014-04-04 14:38 - 2010-07-22 20:07 - 00000000 ____D () C:\Users\User\Documents\Stronghold Crusader
2014-04-04 14:38 - 2010-01-10 16:33 - 00000000 ____D () C:\Users\User\Documents\Stronghold 2
2014-04-04 14:38 - 2010-01-07 20:03 - 00000000 ____D () C:\Users\User\Documents\My Games
2014-04-04 14:37 - 2013-09-26 19:58 - 00000000 ____D () C:\Users\User\AppData\Local\Temp852a031645b653b8fd30a8a564b60d0e
2014-04-04 14:37 - 2013-05-10 12:54 - 00000000 ____D () C:\Siedler2
2014-04-04 14:37 - 2012-05-21 21:07 - 00000000 ____D () C:\Users\User\AppData\Roaming\Scribus
2014-04-04 14:37 - 2012-03-31 20:54 - 00000000 ____D () C:\Users\Public\Downloads\Norton
2014-04-04 14:37 - 2011-07-24 17:34 - 00000000 ____D () C:\Users\User\AppData\Roaming\.minecraft
2014-04-04 14:37 - 2010-07-16 03:32 - 00000000 ____D () C:\Users\User\AppData\Roaming\Teeworlds
2014-04-04 14:37 - 2010-04-08 18:44 - 00000000 ____D () C:\Users\User\Documents\DIE SIEDLER - Aufstieg eines Königreichs
2014-04-04 14:37 - 2010-04-01 13:14 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2014-04-04 14:37 - 2010-03-31 23:21 - 00000000 ____D () C:\Users\User\AppData\Roaming\DivX
2014-04-04 14:37 - 2010-03-31 23:16 - 00000000 ____D () C:\Users\User\AppData\Local\Google
2014-04-04 14:37 - 2010-03-31 20:53 - 00000000 ____D () C:\Users\User\AppData\Roaming\ICQ
2014-04-04 14:37 - 2010-03-18 15:52 - 00000000 ____D () C:\Users\User\AppData\Roaming\Adobe
2014-04-04 14:37 - 2010-01-15 21:38 - 00000000 ____D () C:\Users\User\Documents\DIE SIEDLER - DEdK
2014-04-04 14:37 - 2010-01-07 18:39 - 00000000 ____D () C:\Users\User\AppData\Roaming\Meine Der Herr der Ringe™, Aufstieg des Hexenkönigs™-Dateien
2014-04-04 14:37 - 2010-01-07 18:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
2014-04-04 14:34 - 2013-01-18 15:52 - 00000000 ___RD () C:\Users\User\Dropbox
2014-04-04 14:32 - 2013-04-13 00:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-04 14:32 - 2011-05-29 11:47 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-04 14:29 - 2010-01-07 18:23 - 00000000 ____D () C:\Program Files (x86)\CCleaner
2014-04-04 14:27 - 2010-01-07 17:53 - 00000000 ___RD () C:\Users\User\Desktop\Spieleordner
2014-04-04 14:25 - 2010-08-17 09:08 - 00000000 ____D () C:\Windows\Lhsp
2014-04-04 14:02 - 2014-04-04 14:02 - 00002624 _____ () C:\Windows\System32\Tasks\GlaryInitialize 4
2014-04-04 14:02 - 2014-04-04 14:02 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-04-04 14:02 - 2010-01-08 23:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\GlarySoft
2014-04-03 17:48 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-03 17:45 - 2014-04-03 17:45 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-04-03 17:45 - 2010-01-07 00:42 - 00000000 ____D () C:\Windows\Panther
2014-04-03 13:01 - 2014-04-03 13:01 - 02157056 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-04-03 09:51 - 2014-04-07 19:36 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:51 - 2014-03-30 19:23 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:50 - 2013-03-07 23:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-02 21:16 - 2011-01-14 19:25 - 00000000 ____D () C:\Program Files (x86)\Drakensang
2014-04-02 20:55 - 2014-04-02 20:55 - 00001929 _____ () C:\Users\User\Desktop\Drakensang.lnk
2014-04-01 10:03 - 2014-04-04 14:02 - 00118048 _____ (Glarysoft Ltd) C:\Windows\system32\BootDefrag.exe
2014-03-31 17:59 - 2010-01-07 20:53 - 00089704 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-31 16:22 - 2012-02-20 17:30 - 00000000 ____D () C:\Users\User\AppData\Roaming\DVDVideoSoft
2014-03-31 15:52 - 2014-03-31 15:52 - 00002088 _____ () C:\{B0B5949C-2666-48DE-BE5B-225AB826C873}
2014-03-31 15:50 - 2014-03-31 15:50 - 00002136 _____ () C:\{8A0B66BD-D375-4BEF-8BA0-E29B7090A54D}
2014-03-31 15:46 - 2014-03-31 15:46 - 00002128 _____ () C:\{C5A3030C-4F69-463E-88FA-5D99EB49E715}
2014-03-31 15:42 - 2014-03-31 15:42 - 00002160 _____ () C:\{B0C8FB38-F1CE-4BBF-911D-D503E8DDF0F0}
2014-03-31 15:38 - 2014-03-31 15:38 - 00002168 _____ () C:\{74D4CF7E-3A62-460D-9F6E-B2EF38998DCA}
2014-03-31 15:35 - 2014-03-31 15:35 - 00002160 _____ () C:\{52081577-7905-4723-AC25-FF9FE65B2A82}
2014-03-31 15:29 - 2014-03-31 15:29 - 00002376 _____ () C:\{F93246E9-18A2-47C4-A90D-6C270A93C915}
2014-03-31 14:53 - 2014-03-31 14:53 - 00002656 _____ () C:\{B113D6B6-CA79-4389-8095-23F62C348123}
2014-03-31 14:51 - 2014-03-31 14:51 - 00002672 _____ () C:\{0713E16E-8D8E-4B10-BC25-1A92B2AA65FE}
2014-03-31 14:49 - 2014-03-31 14:49 - 00002416 _____ () C:\{AD30FAEB-8A15-4D16-9AA6-5B8D62F52837}
2014-03-31 14:47 - 2014-03-31 14:47 - 00002440 _____ () C:\{8E532289-3850-4103-831D-1FD071995237}
2014-03-31 14:28 - 2014-03-31 14:28 - 00002504 _____ () C:\{A0FE26E1-3CA3-432D-BAA8-43C9C96A3FF7}
2014-03-31 09:33 - 2014-04-04 14:02 - 00017600 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\BootDefragDriver.sys
2014-03-30 21:26 - 2014-03-30 19:23 - 00000000 ____D () C:\Users\User\Desktop\mbar
2014-03-30 21:03 - 2014-03-30 21:03 - 00002392 _____ () C:\{CD8A38DB-9CF3-4DCD-BD3E-58D66B98416D}
2014-03-30 21:02 - 2014-03-30 21:02 - 00002248 _____ () C:\{6885A95F-E6E1-4A9D-AB2E-BAE8F9969240}
2014-03-30 20:13 - 2014-03-30 20:13 - 00003544 _____ () C:\{6F8E51E1-8F5D-40D4-ACD4-F1D5F93FC76C}
2014-03-30 20:11 - 2014-03-30 20:11 - 00003384 _____ () C:\{04D80F8C-75E3-4375-992B-22173FECC1B1}
2014-03-30 19:09 - 2014-03-30 19:09 - 00002816 _____ () C:\{881B3B77-D330-4BBE-9375-9C18EDE227AE}
2014-03-30 19:05 - 2014-03-30 19:05 - 00002984 _____ () C:\{65756D68-210C-4D18-8FFD-54FE0104AE20}
2014-03-30 18:53 - 2009-07-14 06:45 - 00365576 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-30 13:54 - 2013-02-18 16:47 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-03-30 13:35 - 2014-03-30 13:35 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-30 13:34 - 2014-03-30 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 12:57 - 2014-03-30 12:57 - 00000000 ____D () C:\Windows\ERUNT
2014-03-30 03:05 - 2011-10-19 16:03 - 00000000 ____D () C:\Program Files (x86)\Warcraft III Reign of Chaos & The Frozen Throne
2014-03-29 23:03 - 2014-03-29 23:03 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2014-03-29 23:02 - 2014-03-29 23:02 - 00000000 ____D () C:\Games
2014-03-29 22:49 - 2014-03-29 22:47 - 00005933 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-29 22:49 - 2011-02-08 14:43 - 00000000 ____D () C:\Program Files (x86)\Java
2014-03-29 19:30 - 2011-12-18 15:48 - 00000000 ____D () C:\ProgramData\EPSON
2014-03-29 19:25 - 2010-01-07 19:53 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-03-27 16:54 - 2014-03-27 16:54 - 00613200 ____H (Chip Digital GmbH) C:\Users\User\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-24 19:03 - 2014-02-08 20:16 - 00000000 ____D () C:\Users\User\Desktop\Ocarina
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 ____D () C:\Users\User\AppData\Local\cache
2014-03-22 19:44 - 2014-03-22 19:44 - 00000000 _____ () C:\Users\User\daemonprocess.txt
2014-03-21 18:13 - 2014-03-21 17:30 - 128367703 ____H () C:\Users\User\Downloads\Saltatio Mortis - Das schwarze IXI (2013) [320].rar
2014-03-12 20:58 - 2014-03-12 20:58 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 20:58 - 2012-10-23 14:13 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 20:58 - 2012-04-22 01:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 20:58 - 2011-08-15 15:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-12 16:42 - 2014-03-12 16:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\LucasArts
2014-03-12 16:10 - 2010-01-07 17:42 - 00000000 ____D () C:\Program Files (x86)\LucasArts
2014-03-11 18:14 - 2010-07-19 22:40 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-03-11 17:37 - 2013-07-02 15:12 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA
Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\drm_dyndata_7390006.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-10 15:04
==================== End Of Log ============================
--- --- --- |
|
13.04.2014, 13:48
| #14 |
| /// the machine /// TB-Ausbilder | Download Protect 2.2 im Browser! Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.04.2014, 20:49
| #15 |
| | Download Protect 2.2 im Browser! Ich hab mich mit der Antwort zurückgehalten, um mal ein bisschen abzuwarten. Allerdings habe ich nichts mehr feststellen können, was auf irgendeine Art von Virus hindeutet. Ich bedanke mich für den wirklich netten und kompetenten Support!  |
|
| Themen zu Download Protect 2.2 im Browser! |
| abstürze, abstürzen, anderem, browser, dankbar, download, download protect, eset, freue, gesamte, gesamten, häufig, installier, installiert, löschen, malwarebytes, minute, minuten, protect, scan, scanner, versucht, vieles, wirklich, woche, wochen |
WARNUNG an die MITLESER: 
Linear-Darstellung
