| |
| |||||||
Log-Analyse und Auswertung: Windows 8.1 Adware , Trojaner verdacht , Websiten werden auf Werbung umgeleitetWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
23.05.2014, 16:21
| #1 |
| |  Windows 8.1 Adware , Trojaner verdacht , Websiten werden auf Werbung umgeleitet Guten Tag liebe Trojaner-board.de Gemeinde. Ich habe heute etwas ziemlich dummes getan , denn ich habe mein Antivirus ausgeschaltet gehabt und zack , da kam schon der erste Virus reingeflattert. Es war so ich öffnete das Programm ( Es war ein Freeware Spiel ) dort bekam ich dann erstmal einen Fetten Error reingeballert was da stand weiß ich nicht mehr. Aufjedenfall wurde vieles Im Hintergrund ausgeführt , mit Panik habe ich alles geschlossen was ging. Aber es wurden zig Programme installiert wie Systweak RegClean Pro und andere solcher Programme. Aufgrund meiner Sorge habe ich erstmal mit Adwcleaner alles gelöscht was ich finden konnte. Daraufhin wollte ich mit Malwarebytes checken , dort ist mir aufgefallen das es auch nicht ging ( Fehlermeldung beim aufrufen External Exception E06D7363.) Auch mein Antivirus kann ich nichtmehr aktiveren "Auf das angegebene gerät bzw. den pfad oder die datei kann nicht zugegriffen werden". Naja so dumm wie ich war habe ich erstmal eine Systemwiederherstellung von gestern eingespielt ( Was aber 0 gebracht hat ) ( Ich weiß ich hätte nicht selber handeln sollen). Aufjedenfall habe ich Logs erstellt. Dannach bin ich auf dieses forum gestoßen und bin nach Anleitung gegangen und hab nun 2 Logdatein Avira Ereignislog Code:
ATTFilter Exportierte Ereignisse:
23.05.2014 16:38 [Echtzeit-Scanner] Echtzeit-Scanner deaktiviert
Echtzeit-Scanner wurde deaktiviert.
23.05.2014 16:20 [Updater] Update erfolgreich durchgeführt
Update von Avira Free Antivirus auf Computer JANNI-GAMERPC (25.169.152.42)
erfolgreich durchgeführt.
Folgende Dateien wurden von "hxxp://84.46.102.137/update" aktualisiert:
aeheur.dll 8.1.4.1084
aescn.dll 8.3.0.4
aeexp.dll 8.4.1.342
aeset.dat 8.3.18.32
vbase031.vdf 7.11.151.64
aevdf.dat 7.11.151.64
webcat1.dat
webcat2.dat
webcat3.dat
webcat4.dat
23.05.2014 16:19 [Planer] Auftrag gestartet
Auftrag "AVImmediateUpdateJobEx"
wurde erfolgreich gestartet.
23.05.2014 16:14 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].
Anzahl Dateien: 1
Anzahl Verzeichnisse: 0
Anzahl Malware: 0
Anzahl Warnungen: 0
23.05.2014 16:14 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].
Anzahl Dateien: 1
Anzahl Verzeichnisse: 0
Anzahl Malware: 0
Anzahl Warnungen: 0
23.05.2014 16:01 [Echtzeit-Scanner] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.4.620
Engine Version:
VDF Version:
23.05.2014 16:01 [Hilfsdienst] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.4.620
Engine Version: 8.3.18.22
VDF Version: 7.11.151.60
23.05.2014 16:01 [Planer] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version 14.0.4.620
23.05.2014 16:00 [Echtzeit-Scanner] Dienst gestoppt
Der Dienst wurde gestoppt.
23.05.2014 16:00 [Planer] Dienst gestoppt
Der Dienst wurde gestoppt.
23.05.2014 15:54 [Echtzeit-Scanner] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.4.620
Engine Version:
VDF Version:
23.05.2014 15:54 [Hilfsdienst] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.4.620
Engine Version: 8.3.18.22
VDF Version: 7.11.151.60
23.05.2014 15:54 [Planer] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version 14.0.4.620
23.05.2014 15:48 [Planer] Dienst gestoppt
Der Dienst wurde gestoppt.
23.05.2014 15:48 [Echtzeit-Scanner] Dienst gestoppt
Der Dienst wurde gestoppt.
23.05.2014 15:46 [System-Scanner] Malware gefunden
Die Datei
'C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Smartbar\Application\Smart
barVersionsHelper.exe.vir'
enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5621fffd.qua'
verschoben!
23.05.2014 15:46 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde abgebrochen!].
Anzahl Dateien: 186783
Anzahl Verzeichnisse: 4656
Anzahl Malware: 1
Anzahl Warnungen: 1
23.05.2014 15:27 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].
Anzahl Dateien: 1171
Anzahl Verzeichnisse: 0
Anzahl Malware: 1
Anzahl Warnungen: 0
23.05.2014 15:27 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '55f4da39.qua'
verschoben!
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\dlr2.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\dlr2.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\dlr2.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\dlr2.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\dlr2.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\dlr2.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:26 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\dlr2.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.05.2014 15:12 [Planer] Auftrag gestartet
Auftrag "ReSystemScan"
wurde erfolgreich gestartet.
23.05.2014 15:08 [Echtzeit-Scanner] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.4.620
Engine Version:
VDF Version:
23.05.2014 15:08 [Hilfsdienst] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.4.620
Engine Version: 8.3.18.22
VDF Version: 7.11.151.60
23.05.2014 15:07 [Planer] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version 14.0.4.620
23.05.2014 15:07 [Echtzeit-Scanner] Dienst gestoppt
Der Dienst wurde gestoppt.
23.05.2014 15:07 [Planer] Dienst gestoppt
Der Dienst wurde gestoppt.
23.05.2014 15:06 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].
Anzahl Dateien: 9815
Anzahl Verzeichnisse: 0
Anzahl Malware: 2
Anzahl Warnungen: 2
23.05.2014 15:04 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\GenesisInstaller.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Kazy.365726.1' [trojan]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
23.05.2014 15:04 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\GenesisInstaller.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Kazy.365726.1' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\MediaPlayer__3936_il31502.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen2' [adware]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\ampn.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Drop.Agent.kpdw' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff erlauben
23.05.2014 15:03 [Echtzeit-Scanner] Echtzeit-Scanner aktiviert
Echtzeit-Scanner wurde aktiviert.
23.05.2014 15:02 [Echtzeit-Scanner] Echtzeit-Scanner deaktiviert
Echtzeit-Scanner wurde deaktiviert.
23.05.2014 15:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\dlr2.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Übergeben an Scanner
23.05.2014 15:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\janni\AppData\Local\Temp\dlr2.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014
Ran by janni (administrator) on JANNI-GAMERPC on 23-05-2014 16:37:55
Running from C:\Users\janni\Desktop
Platform: Windows 8.1 Pro (Update 1) (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
(ICQ) C:\Users\janni\AppData\Roaming\ICQM\icq.exe
(Spotify Ltd) C:\Users\janni\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(ROCCAT GmbH Co., Ltd.) C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Isku Keyboard\IskuMonitor.exe
(Curse, Inc) C:\Users\janni\AppData\Roaming\Curse Client\Bin\Curse.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Spotify Ltd) C:\Users\janni\AppData\Roaming\Spotify\spotify.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\janni\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\janni\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\janni\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\janni\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\janni\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1096480 2013-11-29] (NVIDIA Corporation)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2273056 2013-11-29] (NVIDIA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [RoccatKoneXTD] => C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.EXE [552960 2013-10-25] (ROCCAT GmbH)
HKLM-x32\...\Run: [RoccatIsku] => C:\Program Files (x86)\ROCCAT\Isku Keyboard\IskuMonitor.EXE [536576 2013-10-30] (ROCCAT GmbH)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [819984 2014-03-06] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-05-13] (LogMeIn Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe [35768 2013-12-09] (Overwolf)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.EXE [403568 2014-04-14] (CyberGhost S.R.L.)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [icq] => C:\Users\janni\AppData\Roaming\ICQM\icq.exe [33664344 2014-01-21] (ICQ)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [Spotify Web Helper] => C:\Users\janni\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-14] (Spotify Ltd)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [Spotify] => C:\Users\janni\AppData\Roaming\Spotify\spotify.exe [6170168 2014-05-14] (Spotify Ltd)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [MKLOL] => C:\Program Files (x86)\MKJogo\MKLOL\MK.exe [1277128 2014-04-29] (MK)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22415552 2014-04-25] (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk
ShortcutTarget: LOLRecorder.lnk -> C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (LOL Replay)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Roccat Talk.lnk
ShortcutTarget: Roccat Talk.lnk -> C:\Windows\Installer\{605D671E-1D1E-4840-84D9-BFACE17F160D}\NewShortcut1_38373BA15BEE4DD08E16D3720C304537.exe (Flexera Software LLC)
Startup: C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Curse.lnk
ShortcutTarget: Curse.lnk -> C:\Users\janni\AppData\Roaming\Curse Client\Bin\Curse.exe (Curse, Inc)
==================== Internet (Whitelisted) ====================
ProxyServer: socks=24.166.231.143:19397
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x67337439F549CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default\Extensions\staged [2014-05-15]
FF Extension: Yahoo Community Smartbar - C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default\Extensions\{0a361333-6a9c-4234-8343-281c83896c30} [2014-05-23]
FF Extension: Snap.Do - C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default\Extensions\{89da9d67-afd6-74a8-0e2a-296ea625e2fe} [2014-05-15]
FF Extension: HackBar - C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default\Extensions\{F5DDF39C-9293-4d5e-9AA8-E04E6DD5E9B4}.xpi [2014-01-24]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2013-11-19]
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchKeyword: webssearches
CHR DefaultSearchProvider: webssearches
CHR DefaultSearchURL: hxxp://istart.webssearches.com/web/?type=dspp&ts=1400850505&from=amt&uid=ST1000DM003-1CH162_Z1D7BE0AXXXXZ1D7BE0A&q={searchTerms}
CHR DefaultNewTabURL:
CHR Extension: (Google Docs) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-14]
CHR Extension: (Google Drive) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-14]
CHR Extension: (YouTube) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-14]
CHR Extension: (Adblock Plus) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-20]
CHR Extension: (Google-Suche) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-14]
CHR Extension: (Google Wallet) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-19]
CHR Extension: (Google Mail) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-14]
CHR HKLM-x32\...\Chrome\Extension: [ikgojpdbiniccokkgadmdheobjfdbbcg] - C:\Program Files (x86)\WebSparkle\ikgojpdbiniccokkgadmdheobjfdbbcg.crx [2014-05-14]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1039952 2014-05-15] (Avira Operations GmbH & Co. KG)
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [402192 2014-03-06] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [385808 2014-03-06] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [770832 2014-03-06] (BlueStack Systems, Inc.)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64624 2014-04-14] (CyberGhost S.R.L)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-03-12] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-04-15] (LogMeIn, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1370912 2013-11-29] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15128352 2013-11-29] (NVIDIA Corporation)
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [96184 2013-12-09] (Overwolf)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-04-23] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-11] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130584 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [121616 2014-03-06] (BlueStack Systems)
S1 fanio; C:\Windows\SysWOW64\drivers\fanio.sys [14464 2007-02-16] (Christian Diefer)
R3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [46136 2014-05-13] (LogMeIn Inc.)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
S3 kbldfltr; C:\Windows\System32\drivers\kbldfltr.sys [22272 2013-08-23] (Microsoft Corporation)
S3 libusb0; C:\Windows\system32\DRIVERS\libusb0.sys [52832 2014-05-14] (hxxp://libusb-win32.sourceforge.net)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-10-30] (NVIDIA Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924504 2014-02-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 usbrndis6; C:\Windows\system32\DRIVERS\usb80236.sys [20992 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R0 Wof; C:\Windows\System32\Drivers\Wof.sys [157016 2014-03-13] (Microsoft Corporation)
S3 AsrOcDrv; \??\C:\Windows\SysWOW64\Drivers\AsrOcDrv.sys [X]
S3 AsrSetupDrv; \??\C:\Windows\SysWOW64\Drivers\AsrSetupDrv.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-23 16:36 - 2014-05-23 16:36 - 00380416 _____ () C:\Users\janni\Desktop\Gmer-19357.exe
2014-05-23 16:22 - 2014-05-23 16:23 - 00056693 _____ () C:\Users\janni\Desktop\Addition.txt
2014-05-23 16:21 - 2014-05-23 16:37 - 00022307 _____ () C:\Users\janni\Desktop\FRST.txt
2014-05-23 16:21 - 2014-05-23 16:37 - 00000000 ____D () C:\FRST
2014-05-23 16:20 - 2014-05-23 16:20 - 02067456 _____ (Farbar) C:\Users\janni\Desktop\FRST64.exe
2014-05-23 16:17 - 2014-05-23 16:17 - 00961360 _____ (Chip Digital GmbH) C:\Users\janni\Downloads\HijackThis - CHIP-Downloader.exe
2014-05-23 16:17 - 2014-05-23 16:17 - 00388608 _____ (Trend Micro Inc.) C:\Users\janni\Downloads\hijackthis.exe
2014-05-23 16:16 - 2014-05-23 16:16 - 00961360 _____ (Chip Digital GmbH) C:\Users\janni\Desktop\HijackThis - CHIP-Downloader.exe
2014-05-23 16:06 - 2014-05-23 16:06 - 02209056 _____ () C:\Users\janni\Downloads\avira-eu-cleaner_de.exe
2014-05-23 16:06 - 2014-05-23 16:06 - 00002080 _____ () C:\Users\janni\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-23 16:06 - 2014-05-23 16:06 - 00002024 _____ () C:\Users\janni\Desktop\Avira EU-Cleaner.lnk
2014-05-23 15:59 - 2014-05-23 15:59 - 00940032 _____ () C:\Users\janni\Downloads\speedscan_0.8.exe
2014-05-23 15:59 - 2014-05-23 15:59 - 00004977 _____ () C:\Users\janni\Downloads\reg.txt
2014-05-23 15:59 - 2014-05-23 15:59 - 00000389 _____ () C:\Users\janni\Downloads\SpeedScan.txt
2014-05-23 15:58 - 2014-05-23 15:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-05-23 15:58 - 2014-05-23 15:58 - 01326389 _____ () C:\Users\janni\Downloads\adwcleaner_3.210.exe
2014-05-23 15:58 - 2014-05-23 15:58 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-23 15:57 - 2014-05-23 15:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-23 15:33 - 2014-05-23 15:53 - 00000000 ____D () C:\ Malwarebytes Anti-Malware
2014-05-23 15:17 - 2014-05-23 16:17 - 00013024 _____ () C:\Users\janni\Desktop\hijackthis.log
2014-05-23 15:04 - 2014-05-23 15:04 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-05-23 14:29 - 2014-05-23 15:53 - 00000000 ____D () C:\Users\janni\Downloads\Need.For.Speed.Most.Wanted__PC
2014-05-22 14:35 - 2014-05-22 14:36 - 00295920 _____ () C:\Windows\Minidump\052214-20437-01.dmp
2014-05-21 10:35 - 2014-05-21 10:35 - 00295920 _____ () C:\Windows\Minidump\052114-21281-01.dmp
2014-05-20 23:36 - 2014-05-20 23:36 - 00000000 ____D () C:\Users\janni\Desktop\O2BS2013
2014-05-20 23:30 - 2014-05-20 23:35 - 519716518 _____ () C:\Users\janni\Desktop\O2BS2013.part3.rar
2014-05-20 23:28 - 2014-05-20 23:33 - 536870928 _____ () C:\Users\janni\Desktop\O2BS2013.part1.rar
2014-05-20 23:23 - 2014-05-20 23:23 - 00236952 _____ () C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T (1).exe
2014-05-20 23:21 - 2014-05-20 23:21 - 00236952 _____ () C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T.exe
2014-05-19 11:12 - 2014-05-19 11:13 - 00295920 _____ () C:\Windows\Minidump\051914-26796-01.dmp
2014-05-17 15:07 - 2014-05-17 15:07 - 00295920 _____ () C:\Windows\Minidump\051714-34468-01.dmp
2014-05-17 02:18 - 2014-05-17 02:19 - 00000000 ____D () C:\Users\janni\Desktop\Draven
2014-05-17 02:01 - 2014-05-23 16:01 - 00000000 ___RD () C:\Users\janni\Google Drive
2014-05-17 02:01 - 2014-05-17 02:01 - 00001752 _____ () C:\Users\janni\Desktop\Google Drive.lnk
2014-05-17 01:59 - 2014-05-17 01:59 - 00918672 _____ (Google Inc.) C:\Users\janni\Downloads\googledrivesync.exe
2014-05-17 01:59 - 2014-05-17 01:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-05-17 01:55 - 2014-05-17 01:56 - 00000000 ____D () C:\Users\janni\Desktop\S3 ROOT
2014-05-15 18:27 - 2014-05-15 18:27 - 87080115 _____ () C:\Users\janni\Desktop\League of Legends 05.15.2014 - 18.27.25.98.DVR.mp4
2014-05-15 13:25 - 2014-03-24 04:30 - 00257880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-05-15 13:25 - 2014-03-24 04:30 - 00123224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2014-05-15 13:25 - 2014-03-24 04:27 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-05-15 13:25 - 2014-03-13 09:42 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-05-15 13:25 - 2014-03-13 08:51 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2014-05-15 13:24 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 13:24 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 13:24 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 13:24 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 13:24 - 2014-04-11 12:03 - 00555736 _____ (Microsoft Corporation) C:\Windows\system32\twinapi.appcore.dll
2014-05-15 13:24 - 2014-04-11 12:03 - 00054776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-05-15 13:24 - 2014-04-11 10:25 - 00419928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinapi.appcore.dll
2014-05-15 13:24 - 2014-04-11 08:04 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-05-15 13:24 - 2014-04-11 07:53 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\WSReset.exe
2014-05-15 13:24 - 2014-04-11 07:22 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-05-15 13:24 - 2014-04-11 05:54 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2014-05-15 13:24 - 2014-04-11 05:36 - 11792384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-05-15 13:24 - 2014-04-11 05:24 - 13288960 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-05-15 13:24 - 2014-04-11 05:06 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-05-15 13:24 - 2014-04-11 05:05 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 13:24 - 2014-04-11 05:05 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-05-15 13:24 - 2014-04-11 05:02 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 13:24 - 2014-04-11 05:02 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-05-15 13:24 - 2014-04-11 05:01 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-05-15 13:24 - 2014-04-11 05:00 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-05-15 13:24 - 2014-04-11 04:59 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-05-15 13:24 - 2014-04-11 04:57 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-05-15 13:24 - 2014-04-11 04:56 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-05-15 13:24 - 2014-04-11 04:55 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-05-15 13:24 - 2014-04-11 04:53 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-05-15 13:24 - 2014-04-11 04:52 - 03464192 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-05-15 13:24 - 2014-04-11 04:46 - 01705472 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-05-15 13:24 - 2014-04-11 04:36 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2014-05-15 13:24 - 2014-04-11 04:34 - 00754688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-15 13:24 - 2014-04-11 04:29 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2014-05-15 13:24 - 2014-04-11 04:25 - 00921088 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-15 13:24 - 2014-04-09 00:46 - 00086688 _____ (Microsoft Corporation) C:\Windows\system32\mrt_map.dll
2014-05-15 13:24 - 2014-04-09 00:46 - 00028320 _____ (Microsoft Corporation) C:\Windows\system32\mrt100.dll
2014-05-15 13:24 - 2014-04-08 20:54 - 00080032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mrt_map.dll
2014-05-15 13:24 - 2014-04-08 20:54 - 00026784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mrt100.dll
2014-05-15 13:24 - 2014-03-27 11:12 - 21225584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 13:24 - 2014-03-27 09:48 - 18679728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 13:16 - 2014-05-15 13:16 - 00295864 _____ () C:\Windows\Minidump\051514-18562-01.dmp
2014-05-15 01:19 - 2014-05-23 16:00 - 00000990 _____ () C:\Windows\PFRO.log
2014-05-15 01:18 - 2014-05-23 16:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-15 01:18 - 2014-05-23 15:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-15 01:18 - 2014-05-15 01:21 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-15 01:18 - 2014-05-15 01:18 - 01325827 _____ () C:\Users\janni\Downloads\adwcleaner08.exe
2014-05-15 01:18 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-15 01:17 - 2014-05-15 01:18 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-15 01:17 - 2014-05-15 01:18 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-05-15 01:05 - 2014-05-15 01:23 - 00001374 _____ () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-15 01:05 - 2014-05-15 01:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
2014-05-15 01:04 - 2014-05-15 01:04 - 07080248 _____ () C:\Users\janni\Downloads\MyPhoneExplorer_1.8.5.exe
2014-05-15 00:57 - 2014-05-15 00:57 - 00295920 _____ () C:\Windows\Minidump\051514-22281-01.dmp
2014-05-15 00:16 - 2014-05-15 00:17 - 217316426 _____ () C:\Users\janni\Downloads\cm-11-20140514-NIGHTLY-i9300 (1).zip
2014-05-15 00:02 - 2014-05-15 00:02 - 00000000 ____D () C:\Users\janni\.android
2014-05-14 22:51 - 2014-05-14 22:51 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (5).msi
2014-05-14 22:37 - 2014-05-14 22:37 - 00785992 _____ () C:\Users\janni\Downloads\GT-I5500_OS-Flasher.7z
2014-05-14 22:26 - 2014-05-14 22:26 - 00295920 _____ () C:\Windows\Minidump\051414-27156-01.dmp
2014-05-14 22:24 - 2014-05-14 22:24 - 00074105 _____ () C:\Users\janni\Downloads\UninstallKies.7z
2014-05-14 22:24 - 2014-05-14 22:24 - 00000000 ____D () C:\Program Files\SAMSUNG
2014-05-14 22:20 - 2014-05-14 22:20 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-05-14 22:19 - 2014-05-14 22:20 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\Documents\SelfMV
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\Documents\samsung
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Samsung
2014-05-14 22:19 - 2014-02-03 20:48 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll
2014-05-14 22:18 - 2014-05-14 22:18 - 41315792 _____ (Samsung Electronics Co., Ltd.) C:\Users\janni\Downloads\Kies3Setup.exe
2014-05-14 22:17 - 2014-05-14 22:17 - 26551126 _____ () C:\Users\janni\Downloads\SAMSUNG_USB_Driver_for_Mobile_Phones.zip
2014-05-14 22:17 - 2014-05-14 22:17 - 00000000 ____D () C:\ProgramData\Samsung
2014-05-14 22:11 - 2014-05-14 22:12 - 186168282 _____ () C:\Users\janni\Downloads\cm-10.2.0-i9300.zip
2014-05-14 22:05 - 2014-05-14 22:14 - 00000000 ____D () C:\Users\janni\usb_driver
2014-05-14 22:05 - 2014-05-14 22:05 - 00098400 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusbk.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00076384 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusb0.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00067680 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusb0.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00052832 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\Drivers\libusb0.sys
2014-05-14 22:03 - 2014-05-14 22:03 - 05294304 _____ (akeo.ie) C:\Users\janni\Downloads\zadig_2.1.0.exe
2014-05-14 21:44 - 2014-05-14 21:44 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-05-14 21:42 - 2014-05-14 21:42 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (4).msi
2014-05-14 21:35 - 2014-05-14 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-05-14 21:35 - 2014-05-14 21:35 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-05-14 21:27 - 2014-05-14 23:39 - 00000446 __RSH () C:\ProgramData\ntuser.pol
2014-05-14 21:27 - 2014-05-14 23:39 - 00000000 ____D () C:\usb_driver
2014-05-14 21:27 - 2014-05-14 21:27 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2014-05-14 21:27 - 2014-05-14 21:27 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2014-05-14 21:24 - 2014-05-14 21:24 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (2).msi
2014-05-14 21:24 - 2014-05-14 21:24 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfCoInstaller01007.dll
2014-05-14 21:24 - 2014-05-14 21:24 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WinUSBCoInstaller.dll
2014-05-14 21:20 - 2014-05-14 21:20 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (3).msi
2014-05-14 21:20 - 2014-05-14 21:20 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (1).msi
2014-05-14 20:41 - 2014-05-17 02:04 - 00000000 ____D () C:\Users\janni\Desktop\WallPaper
2014-05-14 20:41 - 2014-05-14 20:42 - 00000000 ____D () C:\Users\janni\Desktop\WhatsApp Video
2014-05-14 20:41 - 2014-05-14 20:41 - 00000000 ____D () C:\Users\janni\Desktop\WhatsApp Profile Photos
2014-05-14 20:26 - 2014-05-15 01:05 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2014-05-14 20:26 - 2014-05-14 20:26 - 07435787 _____ () C:\Users\janni\Downloads\MyPhoneExplorer_Setup_1.8.5_pcwelt.exe
2014-05-14 20:26 - 2014-05-14 20:26 - 00000000 ____D () C:\Users\janni\AppData\Roaming\MyPhoneExplorer
2014-05-14 20:17 - 2014-05-14 20:17 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller.msi
2014-05-14 20:17 - 2014-05-14 20:17 - 00195782 _____ () C:\Users\janni\Downloads\CyanogenModInstaller-1.0.1.4.apk
2014-05-14 20:09 - 2014-05-14 20:09 - 00013507 _____ () C:\Users\janni\Downloads\MemTest4.zip
2014-05-14 20:07 - 2014-05-15 01:27 - 00043983 _____ () C:\Windows\setupact.log
2014-05-14 20:07 - 2014-05-14 20:07 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-14 20:00 - 2014-05-14 20:00 - 73916223 _____ (Mediatronic Pty Ltd) C:\Users\janni\Downloads\MediaCoder-x64-0.8.30.5620.exe
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MediaCoder x64
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Mediatronic
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Program Files\MediaCoder
2014-05-14 19:06 - 2014-05-14 19:06 - 368021806 _____ () C:\Users\janni\Desktop\League of Legends 05.14.2014 - 19.06.26.204.DVR.mp4
2014-05-13 17:40 - 2014-05-13 17:40 - 00295920 _____ () C:\Windows\Minidump\051314-15296-01.dmp
2014-05-13 14:29 - 2014-05-13 14:29 - 00046136 ____H (LogMeIn Inc.) C:\Windows\system32\Drivers\Hamdrv.sys
2014-05-13 14:10 - 2014-05-13 14:10 - 00029128 _____ () C:\Users\janni\Downloads\Outlook.com.zip
2014-05-13 13:17 - 2014-05-13 13:17 - 00295920 _____ () C:\Windows\Minidump\051314-14250-01.dmp
2014-05-12 20:51 - 2014-05-12 20:51 - 00005478 _____ () C:\Users\janni\Downloads\Ioannis Pelechras.odt
2014-05-12 15:10 - 2014-05-12 15:10 - 00994160 _____ () C:\Users\janni\Downloads\setup (1).exe
2014-05-11 22:22 - 2014-05-11 22:22 - 00295920 _____ () C:\Windows\Minidump\051114-15156-01.dmp
2014-05-11 15:35 - 2014-05-11 15:35 - 00295920 _____ () C:\Windows\Minidump\051114-13593-01.dmp
2014-05-10 13:06 - 2014-05-10 13:06 - 00295920 _____ () C:\Windows\Minidump\051014-15484-01.dmp
2014-05-09 18:07 - 2014-02-28 21:46 - 00145076 _____ () C:\Users\janni\Desktop\Minecraft Cracked.jar
2014-05-09 13:29 - 2014-05-09 13:29 - 00295920 _____ () C:\Windows\Minidump\050914-16734-01.dmp
2014-05-08 08:21 - 2014-05-08 08:21 - 00295920 _____ () C:\Windows\Minidump\050814-14562-01.dmp
2014-05-07 21:01 - 2014-05-07 21:01 - 00295920 _____ () C:\Windows\Minidump\050714-15953-01.dmp
2014-05-07 02:11 - 2014-05-07 02:11 - 00295920 _____ () C:\Windows\Minidump\050714-19875-01.dmp
2014-05-06 14:37 - 2014-05-06 14:37 - 00991848 _____ () C:\Users\janni\Downloads\setup.exe
2014-05-06 11:38 - 2014-05-06 11:38 - 00295920 _____ () C:\Windows\Minidump\050614-17968-01.dmp
2014-05-05 15:05 - 2014-05-22 14:35 - 425216876 _____ () C:\Windows\MEMORY.DMP
2014-05-05 15:05 - 2014-05-05 15:05 - 00295920 _____ () C:\Windows\Minidump\050514-17531-01.dmp
2014-05-02 21:36 - 2014-05-07 01:36 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Curse Client
2014-05-02 21:30 - 2014-05-02 21:36 - 00001073 _____ () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse.lnk
2014-05-02 21:30 - 2014-05-02 21:30 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Curse
2014-05-02 21:29 - 2014-05-02 21:29 - 37496016 _____ (Curse) C:\Users\janni\Downloads\CurseClientSetup (1).exe
2014-05-02 20:27 - 2014-05-02 20:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-02 20:27 - 2014-05-02 20:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-02 16:54 - 2014-05-02 16:54 - 00101376 _____ (Curse) C:\Users\janni\Downloads\CurseClientSetup.exe
2014-04-29 22:53 - 2014-04-29 22:57 - 00000000 ____D () C:\Users\janni\Documents\MK-LOL
2014-04-29 22:53 - 2014-04-29 22:53 - 00000054 _____ () C:\Windows\JQHApp.dat
2014-04-29 22:53 - 2014-04-29 22:53 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MKJogo
2014-04-29 22:52 - 2014-04-29 22:52 - 00000000 ____D () C:\Program Files (x86)\MKJogo
2014-04-29 00:27 - 2014-04-29 00:28 - 11570166 _____ () C:\Users\janni\Downloads\bol_studio.rar
2014-04-29 00:24 - 2014-04-29 17:25 - 00000000 ____D () C:\Users\janni\AppData\Roaming\BoL
2014-04-28 23:59 - 2014-04-28 23:59 - 00000000 ____D () C:\LOLHT Configs v2
2014-04-28 23:53 - 2014-04-28 23:54 - 05017092 _____ () C:\Users\janni\Downloads\wQhdLr35+-N.exe
2014-04-23 22:46 - 2014-05-21 22:33 - 00290184 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-04-23 22:46 - 2014-04-23 22:46 - 00000000 ____D () C:\Users\janni\Documents\Battlefield 3
2014-04-23 22:42 - 2014-04-23 22:42 - 00000000 ____D () C:\ProgramData\EA Core
2014-04-23 22:29 - 2014-04-23 22:29 - 00001186 _____ () C:\Users\Public\Desktop\Battlefield 3.lnk
2014-04-23 20:36 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-23 01:02 - 2014-04-23 01:05 - 00001908 _____ () C:\Windows\diagwrn.xml
2014-04-23 01:02 - 2014-04-23 01:05 - 00001908 _____ () C:\Windows\diagerr.xml
2014-04-23 01:02 - 2014-04-23 01:02 - 00000000 ___HD () C:\$WINDOWS.~BT
2014-04-23 00:49 - 2014-04-23 00:49 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 USB DVD Download Tool
2014-04-23 00:49 - 2014-04-23 00:49 - 00000000 ____D () C:\Users\janni\AppData\Local\Apps\Windows 7 USB DVD Download Tool
==================== One Month Modified Files and Folders =======
2014-05-23 16:37 - 2014-05-23 16:21 - 00022307 _____ () C:\Users\janni\Desktop\FRST.txt
2014-05-23 16:37 - 2014-05-23 16:21 - 00000000 ____D () C:\FRST
2014-05-23 16:36 - 2014-05-23 16:36 - 00380416 _____ () C:\Users\janni\Desktop\Gmer-19357.exe
2014-05-23 16:34 - 2014-03-26 14:01 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Spotify
2014-05-23 16:30 - 2014-03-19 00:21 - 01436694 _____ () C:\Windows\WindowsUpdate.log
2014-05-23 16:23 - 2014-05-23 16:22 - 00056693 _____ () C:\Users\janni\Desktop\Addition.txt
2014-05-23 16:20 - 2014-05-23 16:20 - 02067456 _____ (Farbar) C:\Users\janni\Desktop\FRST64.exe
2014-05-23 16:17 - 2014-05-23 16:17 - 00961360 _____ (Chip Digital GmbH) C:\Users\janni\Downloads\HijackThis - CHIP-Downloader.exe
2014-05-23 16:17 - 2014-05-23 16:17 - 00388608 _____ (Trend Micro Inc.) C:\Users\janni\Downloads\hijackthis.exe
2014-05-23 16:17 - 2014-05-23 15:17 - 00013024 _____ () C:\Users\janni\Desktop\hijackthis.log
2014-05-23 16:16 - 2014-05-23 16:16 - 00961360 _____ (Chip Digital GmbH) C:\Users\janni\Desktop\HijackThis - CHIP-Downloader.exe
2014-05-23 16:07 - 2013-11-19 18:07 - 01802982 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-23 16:07 - 2013-08-23 01:24 - 00778714 _____ () C:\Windows\system32\perfh007.dat
2014-05-23 16:07 - 2013-08-23 01:24 - 00163510 _____ () C:\Windows\system32\perfc007.dat
2014-05-23 16:06 - 2014-05-23 16:06 - 02209056 _____ () C:\Users\janni\Downloads\avira-eu-cleaner_de.exe
2014-05-23 16:06 - 2014-05-23 16:06 - 00002080 _____ () C:\Users\janni\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-23 16:06 - 2014-05-23 16:06 - 00002024 _____ () C:\Users\janni\Desktop\Avira EU-Cleaner.lnk
2014-05-23 16:06 - 2014-01-29 00:23 - 00000412 _____ () C:\Windows\Tasks\update-sys.job
2014-05-23 16:06 - 2013-11-19 18:07 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-792214429-3740351277-2917951772-1001
2014-05-23 16:03 - 2014-05-15 01:18 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-23 16:03 - 2013-11-19 18:27 - 00002195 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-23 16:02 - 2014-02-13 02:23 - 00000000 ____D () C:\Users\janni\AppData\Local\CrashDumps
2014-05-23 16:02 - 2014-02-05 01:28 - 00000000 __RDO () C:\Users\janni\SkyDrive
2014-05-23 16:01 - 2014-05-17 02:01 - 00000000 ___RD () C:\Users\janni\Google Drive
2014-05-23 16:01 - 2014-04-06 00:31 - 00000000 ____D () C:\Users\janni\AppData\Local\LogMeIn Hamachi
2014-05-23 16:01 - 2013-11-19 18:26 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-23 16:00 - 2014-05-15 01:19 - 00000990 _____ () C:\Windows\PFRO.log
2014-05-23 16:00 - 2014-04-03 14:41 - 00000000 ____D () C:\AdwCleaner
2014-05-23 16:00 - 2013-11-19 18:06 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-23 16:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2014-05-23 16:00 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-23 15:59 - 2014-05-23 15:59 - 00940032 _____ () C:\Users\janni\Downloads\speedscan_0.8.exe
2014-05-23 15:59 - 2014-05-23 15:59 - 00004977 _____ () C:\Users\janni\Downloads\reg.txt
2014-05-23 15:59 - 2014-05-23 15:59 - 00000389 _____ () C:\Users\janni\Downloads\SpeedScan.txt
2014-05-23 15:58 - 2014-05-23 15:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-05-23 15:58 - 2014-05-23 15:58 - 01326389 _____ () C:\Users\janni\Downloads\adwcleaner_3.210.exe
2014-05-23 15:58 - 2014-05-23 15:58 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-23 15:58 - 2014-05-23 15:57 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-23 15:58 - 2014-05-15 01:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-23 15:55 - 2013-11-19 18:00 - 00000000 ____D () C:\Users\janni
2014-05-23 15:53 - 2014-05-23 15:33 - 00000000 ____D () C:\ Malwarebytes Anti-Malware
2014-05-23 15:53 - 2014-05-23 14:29 - 00000000 ____D () C:\Users\janni\Downloads\Need.For.Speed.Most.Wanted__PC
2014-05-23 15:53 - 2013-11-19 19:37 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-23 15:53 - 2013-11-19 18:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-23 15:50 - 2014-04-19 20:32 - 00000000 ____D () C:\Users\janni\AppData\Roaming\uTorrent
2014-05-23 15:50 - 2013-11-19 19:50 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Skype
2014-05-23 15:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\registration
2014-05-23 15:04 - 2014-05-23 15:04 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-05-23 15:04 - 2013-11-23 22:08 - 02185728 ___SH () C:\Users\janni\Desktop\Thumbs.db
2014-05-23 13:54 - 2013-11-19 21:13 - 00000000 ____D () C:\Users\janni\AppData\Local\PMB Files
2014-05-23 11:08 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-05-22 16:52 - 2013-11-19 18:26 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-22 15:09 - 2014-01-29 00:23 - 00000412 _____ () C:\Windows\Tasks\update-S-1-5-21-792214429-3740351277-2917951772-1001.job
2014-05-22 14:36 - 2014-05-22 14:35 - 00295920 _____ () C:\Windows\Minidump\052214-20437-01.dmp
2014-05-22 14:35 - 2014-05-05 15:05 - 425216876 _____ () C:\Windows\MEMORY.DMP
2014-05-22 14:35 - 2013-11-24 14:11 - 00000000 ____D () C:\Windows\Minidump
2014-05-21 22:33 - 2014-04-23 22:46 - 00290184 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-05-21 22:33 - 2013-11-21 09:57 - 00290184 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-05-21 22:33 - 2013-11-21 09:57 - 00280904 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-05-21 11:12 - 2014-01-08 17:06 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-05-21 10:35 - 2014-05-21 10:35 - 00295920 _____ () C:\Windows\Minidump\052114-21281-01.dmp
2014-05-20 23:36 - 2014-05-20 23:36 - 00000000 ____D () C:\Users\janni\Desktop\O2BS2013
2014-05-20 23:35 - 2014-05-20 23:30 - 519716518 _____ () C:\Users\janni\Desktop\O2BS2013.part3.rar
2014-05-20 23:33 - 2014-05-20 23:28 - 536870928 _____ () C:\Users\janni\Desktop\O2BS2013.part1.rar
2014-05-20 23:23 - 2014-05-20 23:23 - 00236952 _____ () C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T (1).exe
2014-05-20 23:21 - 2014-05-20 23:21 - 00236952 _____ () C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T.exe
2014-05-20 20:51 - 2014-01-08 17:06 - 00000000 ____D () C:\ProgramData\Origin
2014-05-19 23:10 - 2013-11-19 21:13 - 00000000 ____D () C:\ProgramData\PMB Files
2014-05-19 22:25 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-05-19 14:15 - 2014-01-25 22:01 - 00000000 ____D () C:\Users\janni\AppData\Roaming\.minecraft
2014-05-19 11:13 - 2014-05-19 11:12 - 00295920 _____ () C:\Windows\Minidump\051914-26796-01.dmp
2014-05-17 17:25 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2014-05-17 17:24 - 2013-12-10 23:17 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-05-17 17:24 - 2013-12-10 23:15 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-17 15:07 - 2014-05-17 15:07 - 00295920 _____ () C:\Windows\Minidump\051714-34468-01.dmp
2014-05-17 02:19 - 2014-05-17 02:18 - 00000000 ____D () C:\Users\janni\Desktop\Draven
2014-05-17 02:17 - 2014-02-08 02:57 - 00000000 ____D () C:\Users\janni\Documents\Camtasia Studio
2014-05-17 02:04 - 2014-05-14 20:41 - 00000000 ____D () C:\Users\janni\Desktop\WallPaper
2014-05-17 02:01 - 2014-05-17 02:01 - 00001752 _____ () C:\Users\janni\Desktop\Google Drive.lnk
2014-05-17 01:59 - 2014-05-17 01:59 - 00918672 _____ (Google Inc.) C:\Users\janni\Downloads\googledrivesync.exe
2014-05-17 01:59 - 2014-05-17 01:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-05-17 01:59 - 2013-11-19 18:26 - 00000000 ____D () C:\Users\janni\AppData\Local\Google
2014-05-17 01:59 - 2013-11-19 18:26 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-17 01:56 - 2014-05-17 01:55 - 00000000 ____D () C:\Users\janni\Desktop\S3 ROOT
2014-05-17 01:55 - 2014-04-08 13:50 - 00000000 ____D () C:\Users\janni\Desktop\Fotos
2014-05-16 13:55 - 2014-03-26 14:01 - 00000000 ____D () C:\Users\janni\AppData\Local\Spotify
2014-05-16 11:22 - 2013-11-19 18:01 - 00000000 ___RD () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 11:22 - 2013-11-19 18:01 - 00000000 ___RD () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-05-15 18:27 - 2014-05-15 18:27 - 87080115 _____ () C:\Users\janni\Desktop\League of Legends 05.15.2014 - 18.27.25.98.DVR.mp4
2014-05-15 13:36 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-15 13:33 - 2013-11-22 08:32 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 13:32 - 2013-11-22 08:32 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 13:32 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-05-15 13:28 - 2013-08-22 15:25 - 00000190 _____ () C:\Windows\win.ini
2014-05-15 13:22 - 2013-11-23 04:47 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-15 13:22 - 2013-11-23 04:47 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-15 13:16 - 2014-05-15 13:16 - 00295864 _____ () C:\Windows\Minidump\051514-18562-01.dmp
2014-05-15 01:27 - 2014-05-14 20:07 - 00043983 _____ () C:\Windows\setupact.log
2014-05-15 01:23 - 2014-05-15 01:05 - 00001374 _____ () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-15 01:21 - 2014-05-15 01:18 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-15 01:18 - 2014-05-15 01:18 - 01325827 _____ () C:\Users\janni\Downloads\adwcleaner08.exe
2014-05-15 01:18 - 2014-05-15 01:17 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-15 01:18 - 2014-05-15 01:17 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-05-15 01:18 - 2014-03-18 23:45 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Malwarebytes
2014-05-15 01:18 - 2014-03-18 23:45 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-15 01:18 - 2014-01-24 00:42 - 00001073 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-15 01:18 - 2014-01-24 00:42 - 00001061 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-15 01:18 - 2013-11-19 18:01 - 00001007 _____ () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-15 01:05 - 2014-05-15 01:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
2014-05-15 01:05 - 2014-05-14 20:26 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2014-05-15 01:04 - 2014-05-15 01:04 - 07080248 _____ () C:\Users\janni\Downloads\MyPhoneExplorer_1.8.5.exe
2014-05-15 00:57 - 2014-05-15 00:57 - 00295920 _____ () C:\Windows\Minidump\051514-22281-01.dmp
2014-05-15 00:17 - 2014-05-15 00:16 - 217316426 _____ () C:\Users\janni\Downloads\cm-11-20140514-NIGHTLY-i9300 (1).zip
2014-05-15 00:02 - 2014-05-15 00:02 - 00000000 ____D () C:\Users\janni\.android
2014-05-14 23:39 - 2014-05-14 21:27 - 00000446 __RSH () C:\ProgramData\ntuser.pol
2014-05-14 23:39 - 2014-05-14 21:27 - 00000000 ____D () C:\usb_driver
2014-05-14 22:51 - 2014-05-14 22:51 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (5).msi
2014-05-14 22:37 - 2014-05-14 22:37 - 00785992 _____ () C:\Users\janni\Downloads\GT-I5500_OS-Flasher.7z
2014-05-14 22:26 - 2014-05-14 22:26 - 00295920 _____ () C:\Windows\Minidump\051414-27156-01.dmp
2014-05-14 22:24 - 2014-05-14 22:24 - 00074105 _____ () C:\Users\janni\Downloads\UninstallKies.7z
2014-05-14 22:24 - 2014-05-14 22:24 - 00000000 ____D () C:\Program Files\SAMSUNG
2014-05-14 22:20 - 2014-05-14 22:20 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-05-14 22:20 - 2014-05-14 22:19 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\Documents\SelfMV
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\Documents\samsung
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Samsung
2014-05-14 22:19 - 2013-11-19 18:36 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-14 22:18 - 2014-05-14 22:18 - 41315792 _____ (Samsung Electronics Co., Ltd.) C:\Users\janni\Downloads\Kies3Setup.exe
2014-05-14 22:17 - 2014-05-14 22:17 - 26551126 _____ () C:\Users\janni\Downloads\SAMSUNG_USB_Driver_for_Mobile_Phones.zip
2014-05-14 22:17 - 2014-05-14 22:17 - 00000000 ____D () C:\ProgramData\Samsung
2014-05-14 22:14 - 2014-05-14 22:05 - 00000000 ____D () C:\Users\janni\usb_driver
2014-05-14 22:12 - 2014-05-14 22:11 - 186168282 _____ () C:\Users\janni\Downloads\cm-10.2.0-i9300.zip
2014-05-14 22:05 - 2014-05-14 22:05 - 00098400 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusbk.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00076384 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusb0.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00067680 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusb0.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00052832 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\Drivers\libusb0.sys
2014-05-14 22:03 - 2014-05-14 22:03 - 05294304 _____ (akeo.ie) C:\Users\janni\Downloads\zadig_2.1.0.exe
2014-05-14 21:44 - 2014-05-14 21:44 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-05-14 21:42 - 2014-05-14 21:42 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (4).msi
2014-05-14 21:35 - 2014-05-14 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-05-14 21:35 - 2014-05-14 21:35 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-05-14 21:27 - 2014-05-14 21:27 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2014-05-14 21:27 - 2014-05-14 21:27 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2014-05-14 21:27 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-05-14 21:24 - 2014-05-14 21:24 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (2).msi
2014-05-14 21:24 - 2014-05-14 21:24 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfCoInstaller01007.dll
2014-05-14 21:24 - 2014-05-14 21:24 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WinUSBCoInstaller.dll
2014-05-14 21:20 - 2014-05-14 21:20 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (3).msi
2014-05-14 21:20 - 2014-05-14 21:20 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (1).msi
2014-05-14 20:42 - 2014-05-14 20:41 - 00000000 ____D () C:\Users\janni\Desktop\WhatsApp Video
2014-05-14 20:41 - 2014-05-14 20:41 - 00000000 ____D () C:\Users\janni\Desktop\WhatsApp Profile Photos
2014-05-14 20:33 - 2013-11-28 15:24 - 00000000 ____D () C:\Users\janni\Desktop\Temps,OC,Tools
2014-05-14 20:26 - 2014-05-14 20:26 - 07435787 _____ () C:\Users\janni\Downloads\MyPhoneExplorer_Setup_1.8.5_pcwelt.exe
2014-05-14 20:26 - 2014-05-14 20:26 - 00000000 ____D () C:\Users\janni\AppData\Roaming\MyPhoneExplorer
2014-05-14 20:17 - 2014-05-14 20:17 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller.msi
2014-05-14 20:17 - 2014-05-14 20:17 - 00195782 _____ () C:\Users\janni\Downloads\CyanogenModInstaller-1.0.1.4.apk
2014-05-14 20:09 - 2014-05-14 20:09 - 00013507 _____ () C:\Users\janni\Downloads\MemTest4.zip
2014-05-14 20:07 - 2014-05-14 20:07 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-14 20:00 - 2014-05-14 20:00 - 73916223 _____ (Mediatronic Pty Ltd) C:\Users\janni\Downloads\MediaCoder-x64-0.8.30.5620.exe
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MediaCoder x64
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Mediatronic
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Program Files\MediaCoder
2014-05-14 19:06 - 2014-05-14 19:06 - 368021806 _____ () C:\Users\janni\Desktop\League of Legends 05.14.2014 - 19.06.26.204.DVR.mp4
2014-05-13 17:40 - 2014-05-13 17:40 - 00295920 _____ () C:\Windows\Minidump\051314-15296-01.dmp
2014-05-13 14:29 - 2014-05-13 14:29 - 00046136 ____H (LogMeIn Inc.) C:\Windows\system32\Drivers\Hamdrv.sys
2014-05-13 14:10 - 2014-05-13 14:10 - 00029128 _____ () C:\Users\janni\Downloads\Outlook.com.zip
2014-05-13 14:10 - 2013-11-19 18:01 - 00000000 ____D () C:\Users\janni\AppData\Local\Packages
2014-05-13 13:17 - 2014-05-13 13:17 - 00295920 _____ () C:\Windows\Minidump\051314-14250-01.dmp
2014-05-12 20:51 - 2014-05-12 20:51 - 00005478 _____ () C:\Users\janni\Downloads\Ioannis Pelechras.odt
2014-05-12 15:10 - 2014-05-12 15:10 - 00994160 _____ () C:\Users\janni\Downloads\setup (1).exe
2014-05-12 07:26 - 2014-05-15 01:18 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:26 - 2014-03-21 17:00 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:25 - 2014-03-18 23:45 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 22:22 - 2014-05-11 22:22 - 00295920 _____ () C:\Windows\Minidump\051114-15156-01.dmp
2014-05-11 15:35 - 2014-05-11 15:35 - 00295920 _____ () C:\Windows\Minidump\051114-13593-01.dmp
2014-05-10 13:06 - 2014-05-10 13:06 - 00295920 _____ () C:\Windows\Minidump\051014-15484-01.dmp
2014-05-09 13:29 - 2014-05-09 13:29 - 00295920 _____ () C:\Windows\Minidump\050914-16734-01.dmp
2014-05-08 08:21 - 2014-05-08 08:21 - 00295920 _____ () C:\Windows\Minidump\050814-14562-01.dmp
2014-05-07 21:01 - 2014-05-07 21:01 - 00295920 _____ () C:\Windows\Minidump\050714-15953-01.dmp
2014-05-07 02:11 - 2014-05-07 02:11 - 00295920 _____ () C:\Windows\Minidump\050714-19875-01.dmp
2014-05-07 01:36 - 2014-05-02 21:36 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Curse Client
2014-05-06 21:47 - 2013-11-19 18:26 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-06 21:47 - 2013-11-19 18:26 - 00003868 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-06 14:37 - 2014-05-06 14:37 - 00991848 _____ () C:\Users\janni\Downloads\setup.exe
2014-05-06 11:38 - 2014-05-06 11:38 - 00295920 _____ () C:\Windows\Minidump\050614-17968-01.dmp
2014-05-06 06:40 - 2014-05-15 13:24 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:25 - 2014-05-15 13:24 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:00 - 2014-05-15 13:24 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 13:24 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 15:05 - 2014-05-05 15:05 - 00295920 _____ () C:\Windows\Minidump\050514-17531-01.dmp
2014-05-05 11:30 - 2013-12-09 17:36 - 00000000 ____D () C:\Users\janni\AppData\Roaming\TS3Client
2014-05-05 11:30 - 2013-12-04 22:06 - 00000000 ____D () C:\Users\janni\AppData\Roaming\BitTorrent
2014-05-02 21:36 - 2014-05-02 21:30 - 00001073 _____ () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse.lnk
2014-05-02 21:30 - 2014-05-02 21:30 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Curse
2014-05-02 21:29 - 2014-05-02 21:29 - 37496016 _____ (Curse) C:\Users\janni\Downloads\CurseClientSetup (1).exe
2014-05-02 20:27 - 2014-05-02 20:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-02 20:27 - 2014-05-02 20:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-02 16:54 - 2014-05-02 16:54 - 00101376 _____ (Curse) C:\Users\janni\Downloads\CurseClientSetup.exe
2014-05-02 16:28 - 2013-11-19 18:49 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-05-01 22:30 - 2013-08-22 17:38 - 00693240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-01 22:30 - 2013-08-22 17:38 - 00105464 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-29 22:57 - 2014-04-29 22:53 - 00000000 ____D () C:\Users\janni\Documents\MK-LOL
2014-04-29 22:53 - 2014-04-29 22:53 - 00000054 _____ () C:\Windows\JQHApp.dat
2014-04-29 22:53 - 2014-04-29 22:53 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MKJogo
2014-04-29 22:52 - 2014-04-29 22:52 - 00000000 ____D () C:\Program Files (x86)\MKJogo
2014-04-29 17:25 - 2014-04-29 00:24 - 00000000 ____D () C:\Users\janni\AppData\Roaming\BoL
2014-04-29 00:28 - 2014-04-29 00:27 - 11570166 _____ () C:\Users\janni\Downloads\bol_studio.rar
2014-04-28 23:59 - 2014-04-28 23:59 - 00000000 ____D () C:\LOLHT Configs v2
2014-04-28 23:54 - 2014-04-28 23:53 - 05017092 _____ () C:\Users\janni\Downloads\wQhdLr35+-N.exe
2014-04-23 22:50 - 2013-11-21 09:57 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-04-23 22:46 - 2014-04-23 22:46 - 00000000 ____D () C:\Users\janni\Documents\Battlefield 3
2014-04-23 22:46 - 2014-01-08 19:51 - 00000000 ____D () C:\Users\janni\AppData\Local\PunkBuster
2014-04-23 22:42 - 2014-04-23 22:42 - 00000000 ____D () C:\ProgramData\EA Core
2014-04-23 22:29 - 2014-04-23 22:29 - 00001186 _____ () C:\Users\Public\Desktop\Battlefield 3.lnk
2014-04-23 20:57 - 2014-01-08 17:11 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-04-23 01:05 - 2014-04-23 01:02 - 00001908 _____ () C:\Windows\diagwrn.xml
2014-04-23 01:05 - 2014-04-23 01:02 - 00001908 _____ () C:\Windows\diagerr.xml
2014-04-23 01:02 - 2014-04-23 01:02 - 00000000 ___HD () C:\$WINDOWS.~BT
2014-04-23 00:49 - 2014-04-23 00:49 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 USB DVD Download Tool
2014-04-23 00:49 - 2014-04-23 00:49 - 00000000 ____D () C:\Users\janni\AppData\Local\Apps\Windows 7 USB DVD Download Tool
2014-04-23 00:38 - 2014-04-22 19:40 - 00000000 ____D () C:\Users\janni\AppData\Local\JDownloader 2.0
Some content of TEMP:
====================
C:\Users\janni\AppData\Local\Temp\avgnt.exe
C:\Users\janni\AppData\Local\Temp\bitool.dll
C:\Users\janni\AppData\Local\Temp\CMInstaller.exe
C:\Users\janni\AppData\Local\Temp\Execute2App.exe
C:\Users\janni\AppData\Local\Temp\Installer.exe
C:\Users\janni\AppData\Local\Temp\msvcp90.dll
C:\Users\janni\AppData\Local\Temp\msvcr90.dll
C:\Users\janni\AppData\Local\Temp\OptimizerPro.exe
C:\Users\janni\AppData\Local\Temp\PCSpeedMaximizer_new.exe
C:\Users\janni\AppData\Local\Temp\Quarantine.exe
C:\Users\janni\AppData\Local\Temp\smtnew_qone8.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-23 07:23
==================== End Of Log ============================
Ich hoffe ich habe alles richtig gemacht und hoffe auf eine Antwort , Liebe grüße Jan. Ich habe GMER und den Addition log als archiv angehängt da sie für den Text zu lang waren Geändert von Jan96 (23.05.2014 um 16:24 Uhr) Grund: Edit. |
|
23.05.2014, 16:43
| #2 |
| /// TB-Ausbilder   |  Windows 8.1 Adware , Trojaner verdacht , Websiten werden auf Werbung umgeleitet Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Danke für deine Mitarbeit! Schritt 1 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 2 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 3 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 4 Bitte deaktiviere dein Anti-Viren-Programm, da es das Ergebnis beeinflussen oder ggf. die Bereinigung stören kann. Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/ und speichere die Datei auf deinem Desktop.
Schritt 5
Bitte poste mit deiner nächsten Antwort
|
|
23.05.2014, 18:07
| #3 |
| | Windows 8.1 Adware , Trojaner verdacht , Websiten werden auf Werbung umgeleitet Erstmal vielen vielen Dank für deine Antwort . Ich habe jetzt das befolgt was du mir geschrieben hast , konnte alles ausführen außer malwarebytes ( Ich hänge dir Screens von ) . Hier sind die Logdatein die du von mir wolltest .
__________________AdwCleaner Code:
ATTFilter # AdwCleaner v3.210 - Bericht erstellt am 23/05/2014 um 18:27:57
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 8.1 Pro (64 bits)
# Benutzername : janni - JANNI-GAMERPC
# Gestartet von : C:\Users\janni\Desktop\adwcleaner_3.210 (1).exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\janni\AppData\Local\Temp\OCS
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17037
-\\ Mozilla Firefox v27.0.1 (de)
[ Datei : C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default\prefs.js ]
-\\ Google Chrome v34.0.1847.137
[ Datei : C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [2027 octets] - [03/04/2014 14:41:48]
AdwCleaner[R1].txt - [1939 octets] - [23/04/2014 20:36:15]
AdwCleaner[R2].txt - [1160 octets] - [23/04/2014 20:43:08]
AdwCleaner[R3].txt - [16696 octets] - [15/05/2014 01:18:19]
AdwCleaner[R4].txt - [19621 octets] - [23/05/2014 15:18:44]
AdwCleaner[R5].txt - [1673 octets] - [23/05/2014 18:27:35]
AdwCleaner[S0].txt - [1928 octets] - [03/04/2014 14:42:17]
AdwCleaner[S1].txt - [1878 octets] - [23/04/2014 20:37:53]
AdwCleaner[S2].txt - [1222 octets] - [23/04/2014 20:44:11]
AdwCleaner[S3].txt - [12506 octets] - [15/05/2014 01:18:42]
AdwCleaner[S4].txt - [2850 octets] - [23/05/2014 16:00:01]
AdwCleaner[S5].txt - [1548 octets] - [23/05/2014 18:27:57]
########## EOF - C:\AdwCleaner\AdwCleaner[S5].txt - [1608 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8.1 Pro x64
Ran by janni on 23.05.2014 at 18:32:30,59
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Successfully deleted: [Folder] C:\Users\janni\AppData\Roaming\mozilla\firefox\profiles\2op7qtzj.default\extensions\staged
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 23.05.2014 at 18:34:51,87
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Zoek : Code:
ATTFilter Zoek.exe v5.0.0.0 Updated 22-05-2014
Tool run by janni on 23.05.2014 at 18:40:42,25.
Microsoft Windows 8.1 Pro 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\janni\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
23.05.2014 18:41:23 Zoek.exe System Restore Point Created Succesfully.
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== FireFox Fix ======================
Deleted from C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default\prefs.js:
Added to C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);
==== Deleting Files \ Folders ======================
C:\Users\janni\.android deleted
C:\Windows\sysWoW64\config\systemprofile\.android deleted
C:\Users\janni\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Search.lnk deleted
C:\Users\janni\AppData\Roaming\version.ini deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\Users\janni\Desktop\HijackThis - CHIP-Downloader.exe deleted
"C:\Users\janni\AppData\Roaming\Windows" deleted
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{F003DA68-8256-4b37-A6C4-350FA04494DF}"="C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt" [19.11.2013 18:23]
==== Firefox Extensions ======================
ProfilePath: C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default
- Yahoo Community Smartbar - %ProfilePath%\extensions\{0a361333-6a9c-4234-8343-281c83896c30}
- Snap.Do - %ProfilePath%\extensions\{89da9d67-afd6-74a8-0e2a-296ea625e2fe}
- HackBar - %ProfilePath%\extensions\{F5DDF39C-9293-4d5e-9AA8-E04E6DD5E9B4}.xpi
AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==== Firefox Plugins ======================
==== Deleted Firefox Extensions ======================
C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default\extensions\{89da9d67-afd6-74a8-0e2a-296ea625e2fe} deleted
==== Chrome Look ======================
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
ikgojpdbiniccokkgadmdheobjfdbbcg - C:\Program Files (x86)\WebSparkle\ikgojpdbiniccokkgadmdheobjfdbbcg.crx[]
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com"
"Use Search Asst"="yes"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://www.google.com"
"SearchAssistant"="hxxp://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://www.google.com"
"Use Search Asst"="no"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
==== Reset Google Chrome ======================
C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\ikgojpdbiniccokkgadmdheobjfdbbcg deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AB65D81D-303A-4DDB-AC7C-12C9CD9F67FB} deleted successfully
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{969956a8-8c0e-48f1-9bcd-1f7163c62d57} deleted successfully
HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\D18D56BAA303BDD4CAC7219CDCF976BF deleted successfully
==== Empty IE Cache ======================
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\janni\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\janni\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
C:\Users\janni\AppData\Local\Mozilla\Firefox\Profiles\2op7qtzj.default\Cache emptied successfully
==== Empty Chrome Cache ======================
C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== C:\zoek_backup content ======================
C:\zoek_backup (files=81 folders=19 6628093 bytes)
==== Empty Temp Folders ======================
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\janni\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\Windows\Temp successfully emptied
C:\Users\janni\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on 23.05.2014 at 18:49:41,58 ======================
FRST : FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014
Ran by janni (administrator) on JANNI-GAMERPC on 23-05-2014 18:55:13
Running from C:\Users\janni\Desktop
Platform: Windows 8.1 Pro (Update 1) (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Spotify Ltd) C:\Users\janni\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(ROCCAT GmbH Co., Ltd.) C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Isku Keyboard\IskuMonitor.exe
(Curse, Inc) C:\Users\janni\AppData\Roaming\Curse Client\Bin\Curse.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1096480 2013-11-29] (NVIDIA Corporation)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2273056 2013-11-29] (NVIDIA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [RoccatKoneXTD] => C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.EXE [552960 2013-10-25] (ROCCAT GmbH)
HKLM-x32\...\Run: [RoccatIsku] => C:\Program Files (x86)\ROCCAT\Isku Keyboard\IskuMonitor.EXE [536576 2013-10-30] (ROCCAT GmbH)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [819984 2014-03-06] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-05-13] (LogMeIn Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe [35768 2013-12-09] (Overwolf)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.EXE [403568 2014-04-14] (CyberGhost S.R.L.)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [icq] => C:\Users\janni\AppData\Roaming\ICQM\icq.exe [33664344 2014-01-21] (ICQ)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [Spotify Web Helper] => C:\Users\janni\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-14] (Spotify Ltd)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [Spotify] => C:\Users\janni\AppData\Roaming\Spotify\spotify.exe [6170168 2014-05-14] (Spotify Ltd)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [MKLOL] => C:\Program Files (x86)\MKJogo\MKLOL\MK.exe [1277128 2014-04-29] (MK)
HKU\S-1-5-21-792214429-3740351277-2917951772-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22415552 2014-04-25] (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk
ShortcutTarget: LOLRecorder.lnk -> C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (LOL Replay)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Roccat Talk.lnk
ShortcutTarget: Roccat Talk.lnk -> C:\Windows\Installer\{605D671E-1D1E-4840-84D9-BFACE17F160D}\NewShortcut1_38373BA15BEE4DD08E16D3720C304537.exe (Flexera Software LLC)
Startup: C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Curse.lnk
ShortcutTarget: Curse.lnk -> C:\Users\janni\AppData\Roaming\Curse Client\Bin\Curse.exe (Curse, Inc)
==================== Internet (Whitelisted) ====================
ProxyServer: socks=24.166.231.143:19397
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x67337439F549CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default
FF NewTab: hxxp://www.google.com/
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Yahoo Community Smartbar - C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default\Extensions\{0a361333-6a9c-4234-8343-281c83896c30} [2014-05-23]
FF Extension: HackBar - C:\Users\janni\AppData\Roaming\Mozilla\Firefox\Profiles\2op7qtzj.default\Extensions\{F5DDF39C-9293-4d5e-9AA8-E04E6DD5E9B4}.xpi [2014-01-24]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2013-11-19]
Chrome:
=======
CHR Extension: (Google Docs) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-14]
CHR Extension: (Google Drive) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-14]
CHR Extension: (YouTube) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-14]
CHR Extension: (Google-Suche) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-14]
CHR Extension: (Google Wallet) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-19]
CHR Extension: (Google Mail) - C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-14]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-15] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1039952 2014-05-15] (Avira Operations GmbH & Co. KG)
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [402192 2014-03-06] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [385808 2014-03-06] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [770832 2014-03-06] (BlueStack Systems, Inc.)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64624 2014-04-14] (CyberGhost S.R.L)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-03-12] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-04-15] (LogMeIn, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1370912 2013-11-29] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15128352 2013-11-29] (NVIDIA Corporation)
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [96184 2013-12-09] (Overwolf)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-04-23] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-11] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130584 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [121616 2014-03-06] (BlueStack Systems)
S1 fanio; C:\Windows\SysWOW64\drivers\fanio.sys [14464 2007-02-16] (Christian Diefer)
R3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [46136 2014-05-13] (LogMeIn Inc.)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
S3 kbldfltr; C:\Windows\System32\drivers\kbldfltr.sys [22272 2013-08-23] (Microsoft Corporation)
S3 libusb0; C:\Windows\system32\DRIVERS\libusb0.sys [52832 2014-05-14] (hxxp://libusb-win32.sourceforge.net)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-10-30] (NVIDIA Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924504 2014-02-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 usbrndis6; C:\Windows\system32\DRIVERS\usb80236.sys [20992 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R0 Wof; C:\Windows\System32\Drivers\Wof.sys [157016 2014-03-13] (Microsoft Corporation)
S3 AsrOcDrv; \??\C:\Windows\SysWOW64\Drivers\AsrOcDrv.sys [X]
S3 AsrSetupDrv; \??\C:\Windows\SysWOW64\Drivers\AsrSetupDrv.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-23 18:53 - 2014-05-23 18:53 - 02067456 _____ (Farbar) C:\Users\janni\Desktop\FRST64.exe
2014-05-23 18:52 - 2014-05-23 18:52 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-23 18:52 - 2014-05-23 18:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-23 18:52 - 2014-05-23 18:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-23 18:52 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-23 18:52 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-23 18:52 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-23 18:50 - 2014-05-23 18:50 - 00009614 _____ () C:\Users\janni\Desktop\zoek-results.txt
2014-05-23 18:45 - 2014-05-23 18:40 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-05-23 18:41 - 2014-05-23 18:49 - 00009614 _____ () C:\zoek-results.log
2014-05-23 18:40 - 2014-05-23 18:44 - 00000000 ____D () C:\zoek_backup
2014-05-23 18:40 - 2014-05-23 18:40 - 01285120 _____ () C:\Users\janni\Desktop\zoek.exe
2014-05-23 18:37 - 2014-05-23 18:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Desktop\mbam-setup-2.0.2.1012 (3).exe
2014-05-23 18:34 - 2014-05-23 18:34 - 00000762 _____ () C:\Users\janni\Desktop\JRT.txt
2014-05-23 18:32 - 2014-05-23 18:32 - 00000000 ____D () C:\Windows\ERUNT
2014-05-23 18:31 - 2014-05-23 18:32 - 01016261 _____ (Thisisu) C:\Users\janni\Desktop\JRT.exe
2014-05-23 18:30 - 2014-05-23 18:30 - 00001688 _____ () C:\Users\janni\Desktop\AdwCleaner[S5].txt
2014-05-23 18:27 - 2014-05-23 18:27 - 01326389 _____ () C:\Users\janni\Desktop\adwcleaner_3.210 (1).exe
2014-05-23 17:12 - 2014-05-23 17:12 - 00034138 _____ () C:\Users\janni\Desktop\Ereignisse.txt
2014-05-23 17:06 - 2014-05-23 17:06 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.2.1012 (2).exe
2014-05-23 16:21 - 2014-05-23 18:55 - 00020602 _____ () C:\Users\janni\Desktop\FRST.txt
2014-05-23 16:21 - 2014-05-23 18:55 - 00000000 ____D () C:\FRST
2014-05-23 16:17 - 2014-05-23 16:17 - 00961360 _____ (Chip Digital GmbH) C:\Users\janni\Downloads\HijackThis - CHIP-Downloader.exe
2014-05-23 16:17 - 2014-05-23 16:17 - 00388608 _____ (Trend Micro Inc.) C:\Users\janni\Downloads\hijackthis.exe
2014-05-23 16:06 - 2014-05-23 16:06 - 02209056 _____ () C:\Users\janni\Downloads\avira-eu-cleaner_de.exe
2014-05-23 15:59 - 2014-05-23 15:59 - 00940032 _____ () C:\Users\janni\Downloads\speedscan_0.8.exe
2014-05-23 15:59 - 2014-05-23 15:59 - 00004977 _____ () C:\Users\janni\Downloads\reg.txt
2014-05-23 15:59 - 2014-05-23 15:59 - 00000389 _____ () C:\Users\janni\Downloads\SpeedScan.txt
2014-05-23 15:58 - 2014-05-23 15:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-05-23 15:58 - 2014-05-23 15:58 - 01326389 _____ () C:\Users\janni\Downloads\adwcleaner_3.210.exe
2014-05-23 15:57 - 2014-05-23 15:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-23 15:04 - 2014-05-23 15:04 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-05-23 14:29 - 2014-05-23 15:53 - 00000000 ____D () C:\Users\janni\Downloads\Need.For.Speed.Most.Wanted__PC
2014-05-22 14:35 - 2014-05-22 14:36 - 00295920 _____ () C:\Windows\Minidump\052214-20437-01.dmp
2014-05-21 10:35 - 2014-05-21 10:35 - 00295920 _____ () C:\Windows\Minidump\052114-21281-01.dmp
2014-05-20 23:36 - 2014-05-20 23:36 - 00000000 ____D () C:\Users\janni\Desktop\O2BS2013
2014-05-20 23:30 - 2014-05-20 23:35 - 519716518 _____ () C:\Users\janni\Desktop\O2BS2013.part3.rar
2014-05-20 23:28 - 2014-05-20 23:33 - 536870928 _____ () C:\Users\janni\Desktop\O2BS2013.part1.rar
2014-05-20 23:23 - 2014-05-20 23:23 - 00236952 _____ () C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T (1).exe
2014-05-20 23:21 - 2014-05-20 23:21 - 00236952 _____ () C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T.exe
2014-05-19 11:12 - 2014-05-19 11:13 - 00295920 _____ () C:\Windows\Minidump\051914-26796-01.dmp
2014-05-17 15:07 - 2014-05-17 15:07 - 00295920 _____ () C:\Windows\Minidump\051714-34468-01.dmp
2014-05-17 02:18 - 2014-05-17 02:19 - 00000000 ____D () C:\Users\janni\Desktop\Draven
2014-05-17 02:01 - 2014-05-23 18:50 - 00000000 ___RD () C:\Users\janni\Google Drive
2014-05-17 02:01 - 2014-05-17 02:01 - 00001752 _____ () C:\Users\janni\Desktop\Google Drive.lnk
2014-05-17 01:59 - 2014-05-17 01:59 - 00918672 _____ (Google Inc.) C:\Users\janni\Downloads\googledrivesync.exe
2014-05-17 01:59 - 2014-05-17 01:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-05-17 01:55 - 2014-05-17 01:56 - 00000000 ____D () C:\Users\janni\Desktop\S3 ROOT
2014-05-15 18:27 - 2014-05-15 18:27 - 87080115 _____ () C:\Users\janni\Desktop\League of Legends 05.15.2014 - 18.27.25.98.DVR.mp4
2014-05-15 13:25 - 2014-03-24 04:30 - 00257880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-05-15 13:25 - 2014-03-24 04:30 - 00123224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2014-05-15 13:25 - 2014-03-24 04:27 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-05-15 13:25 - 2014-03-13 09:42 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-05-15 13:25 - 2014-03-13 08:51 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2014-05-15 13:24 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 13:24 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 13:24 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 13:24 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 13:24 - 2014-04-11 12:03 - 00555736 _____ (Microsoft Corporation) C:\Windows\system32\twinapi.appcore.dll
2014-05-15 13:24 - 2014-04-11 12:03 - 00054776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-05-15 13:24 - 2014-04-11 10:25 - 00419928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinapi.appcore.dll
2014-05-15 13:24 - 2014-04-11 08:04 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-05-15 13:24 - 2014-04-11 07:53 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\WSReset.exe
2014-05-15 13:24 - 2014-04-11 07:22 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-05-15 13:24 - 2014-04-11 05:54 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2014-05-15 13:24 - 2014-04-11 05:36 - 11792384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-05-15 13:24 - 2014-04-11 05:24 - 13288960 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-05-15 13:24 - 2014-04-11 05:06 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-05-15 13:24 - 2014-04-11 05:05 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 13:24 - 2014-04-11 05:05 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-05-15 13:24 - 2014-04-11 05:02 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 13:24 - 2014-04-11 05:02 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-05-15 13:24 - 2014-04-11 05:01 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-05-15 13:24 - 2014-04-11 05:00 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-05-15 13:24 - 2014-04-11 04:59 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-05-15 13:24 - 2014-04-11 04:57 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-05-15 13:24 - 2014-04-11 04:56 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-05-15 13:24 - 2014-04-11 04:55 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-05-15 13:24 - 2014-04-11 04:53 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-05-15 13:24 - 2014-04-11 04:52 - 03464192 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-05-15 13:24 - 2014-04-11 04:46 - 01705472 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-05-15 13:24 - 2014-04-11 04:36 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2014-05-15 13:24 - 2014-04-11 04:34 - 00754688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-15 13:24 - 2014-04-11 04:29 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2014-05-15 13:24 - 2014-04-11 04:25 - 00921088 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-15 13:24 - 2014-04-09 00:46 - 00086688 _____ (Microsoft Corporation) C:\Windows\system32\mrt_map.dll
2014-05-15 13:24 - 2014-04-09 00:46 - 00028320 _____ (Microsoft Corporation) C:\Windows\system32\mrt100.dll
2014-05-15 13:24 - 2014-04-08 20:54 - 00080032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mrt_map.dll
2014-05-15 13:24 - 2014-04-08 20:54 - 00026784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mrt100.dll
2014-05-15 13:24 - 2014-03-27 11:12 - 21225584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 13:24 - 2014-03-27 09:48 - 18679728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 13:16 - 2014-05-15 13:16 - 00295864 _____ () C:\Windows\Minidump\051514-18562-01.dmp
2014-05-15 01:19 - 2014-05-23 18:48 - 00001862 _____ () C:\Windows\PFRO.log
2014-05-15 01:18 - 2014-05-15 01:18 - 01325827 _____ () C:\Users\janni\Downloads\adwcleaner08.exe
2014-05-15 01:17 - 2014-05-15 01:18 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-15 01:17 - 2014-05-15 01:18 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-05-15 01:05 - 2014-05-15 01:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
2014-05-15 01:04 - 2014-05-15 01:04 - 07080248 _____ () C:\Users\janni\Downloads\MyPhoneExplorer_1.8.5.exe
2014-05-15 00:57 - 2014-05-15 00:57 - 00295920 _____ () C:\Windows\Minidump\051514-22281-01.dmp
2014-05-15 00:16 - 2014-05-15 00:17 - 217316426 _____ () C:\Users\janni\Downloads\cm-11-20140514-NIGHTLY-i9300 (1).zip
2014-05-14 22:51 - 2014-05-14 22:51 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (5).msi
2014-05-14 22:37 - 2014-05-14 22:37 - 00785992 _____ () C:\Users\janni\Downloads\GT-I5500_OS-Flasher.7z
2014-05-14 22:26 - 2014-05-14 22:26 - 00295920 _____ () C:\Windows\Minidump\051414-27156-01.dmp
2014-05-14 22:24 - 2014-05-14 22:24 - 00074105 _____ () C:\Users\janni\Downloads\UninstallKies.7z
2014-05-14 22:24 - 2014-05-14 22:24 - 00000000 ____D () C:\Program Files\SAMSUNG
2014-05-14 22:20 - 2014-05-14 22:20 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-05-14 22:19 - 2014-05-14 22:20 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\Documents\SelfMV
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\Documents\samsung
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Samsung
2014-05-14 22:19 - 2014-02-03 20:48 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll
2014-05-14 22:18 - 2014-05-14 22:18 - 41315792 _____ (Samsung Electronics Co., Ltd.) C:\Users\janni\Downloads\Kies3Setup.exe
2014-05-14 22:17 - 2014-05-14 22:17 - 26551126 _____ () C:\Users\janni\Downloads\SAMSUNG_USB_Driver_for_Mobile_Phones.zip
2014-05-14 22:17 - 2014-05-14 22:17 - 00000000 ____D () C:\ProgramData\Samsung
2014-05-14 22:11 - 2014-05-14 22:12 - 186168282 _____ () C:\Users\janni\Downloads\cm-10.2.0-i9300.zip
2014-05-14 22:05 - 2014-05-14 22:14 - 00000000 ____D () C:\Users\janni\usb_driver
2014-05-14 22:05 - 2014-05-14 22:05 - 00098400 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusbk.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00076384 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusb0.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00067680 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusb0.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00052832 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\Drivers\libusb0.sys
2014-05-14 22:03 - 2014-05-14 22:03 - 05294304 _____ (akeo.ie) C:\Users\janni\Downloads\zadig_2.1.0.exe
2014-05-14 21:44 - 2014-05-14 21:44 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-05-14 21:42 - 2014-05-14 21:42 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (4).msi
2014-05-14 21:35 - 2014-05-14 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-05-14 21:35 - 2014-05-14 21:35 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-05-14 21:27 - 2014-05-14 23:39 - 00000446 __RSH () C:\ProgramData\ntuser.pol
2014-05-14 21:27 - 2014-05-14 23:39 - 00000000 ____D () C:\usb_driver
2014-05-14 21:27 - 2014-05-14 21:27 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2014-05-14 21:27 - 2014-05-14 21:27 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2014-05-14 21:24 - 2014-05-14 21:24 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (2).msi
2014-05-14 21:24 - 2014-05-14 21:24 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfCoInstaller01007.dll
2014-05-14 21:24 - 2014-05-14 21:24 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WinUSBCoInstaller.dll
2014-05-14 21:20 - 2014-05-14 21:20 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (3).msi
2014-05-14 21:20 - 2014-05-14 21:20 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (1).msi
2014-05-14 20:41 - 2014-05-17 02:04 - 00000000 ____D () C:\Users\janni\Desktop\WallPaper
2014-05-14 20:41 - 2014-05-14 20:42 - 00000000 ____D () C:\Users\janni\Desktop\WhatsApp Video
2014-05-14 20:41 - 2014-05-14 20:41 - 00000000 ____D () C:\Users\janni\Desktop\WhatsApp Profile Photos
2014-05-14 20:26 - 2014-05-15 01:05 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2014-05-14 20:26 - 2014-05-14 20:26 - 07435787 _____ () C:\Users\janni\Downloads\MyPhoneExplorer_Setup_1.8.5_pcwelt.exe
2014-05-14 20:26 - 2014-05-14 20:26 - 00000000 ____D () C:\Users\janni\AppData\Roaming\MyPhoneExplorer
2014-05-14 20:17 - 2014-05-14 20:17 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller.msi
2014-05-14 20:17 - 2014-05-14 20:17 - 00195782 _____ () C:\Users\janni\Downloads\CyanogenModInstaller-1.0.1.4.apk
2014-05-14 20:09 - 2014-05-14 20:09 - 00013507 _____ () C:\Users\janni\Downloads\MemTest4.zip
2014-05-14 20:07 - 2014-05-15 01:27 - 00043983 _____ () C:\Windows\setupact.log
2014-05-14 20:07 - 2014-05-14 20:07 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-14 20:00 - 2014-05-14 20:00 - 73916223 _____ (Mediatronic Pty Ltd) C:\Users\janni\Downloads\MediaCoder-x64-0.8.30.5620.exe
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MediaCoder x64
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Mediatronic
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Program Files\MediaCoder
2014-05-14 19:06 - 2014-05-14 19:06 - 368021806 _____ () C:\Users\janni\Desktop\League of Legends 05.14.2014 - 19.06.26.204.DVR.mp4
2014-05-13 17:40 - 2014-05-13 17:40 - 00295920 _____ () C:\Windows\Minidump\051314-15296-01.dmp
2014-05-13 14:29 - 2014-05-13 14:29 - 00046136 ____H (LogMeIn Inc.) C:\Windows\system32\Drivers\Hamdrv.sys
2014-05-13 14:10 - 2014-05-13 14:10 - 00029128 _____ () C:\Users\janni\Downloads\Outlook.com.zip
2014-05-13 13:17 - 2014-05-13 13:17 - 00295920 _____ () C:\Windows\Minidump\051314-14250-01.dmp
2014-05-12 20:51 - 2014-05-12 20:51 - 00005478 _____ () C:\Users\janni\Downloads\Ioannis Pelechras.odt
2014-05-12 15:10 - 2014-05-12 15:10 - 00994160 _____ () C:\Users\janni\Downloads\setup (1).exe
2014-05-11 22:22 - 2014-05-11 22:22 - 00295920 _____ () C:\Windows\Minidump\051114-15156-01.dmp
2014-05-11 15:35 - 2014-05-11 15:35 - 00295920 _____ () C:\Windows\Minidump\051114-13593-01.dmp
2014-05-10 13:06 - 2014-05-10 13:06 - 00295920 _____ () C:\Windows\Minidump\051014-15484-01.dmp
2014-05-09 18:07 - 2014-02-28 21:46 - 00145076 _____ () C:\Users\janni\Desktop\Minecraft Cracked.jar
2014-05-09 13:29 - 2014-05-09 13:29 - 00295920 _____ () C:\Windows\Minidump\050914-16734-01.dmp
2014-05-08 08:21 - 2014-05-08 08:21 - 00295920 _____ () C:\Windows\Minidump\050814-14562-01.dmp
2014-05-07 21:01 - 2014-05-07 21:01 - 00295920 _____ () C:\Windows\Minidump\050714-15953-01.dmp
2014-05-07 02:11 - 2014-05-07 02:11 - 00295920 _____ () C:\Windows\Minidump\050714-19875-01.dmp
2014-05-06 14:37 - 2014-05-06 14:37 - 00991848 _____ () C:\Users\janni\Downloads\setup.exe
2014-05-06 11:38 - 2014-05-06 11:38 - 00295920 _____ () C:\Windows\Minidump\050614-17968-01.dmp
2014-05-05 15:05 - 2014-05-22 14:35 - 425216876 _____ () C:\Windows\MEMORY.DMP
2014-05-05 15:05 - 2014-05-05 15:05 - 00295920 _____ () C:\Windows\Minidump\050514-17531-01.dmp
2014-05-02 21:36 - 2014-05-07 01:36 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Curse Client
2014-05-02 21:30 - 2014-05-02 21:36 - 00001073 _____ () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse.lnk
2014-05-02 21:30 - 2014-05-02 21:30 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Curse
2014-05-02 21:29 - 2014-05-02 21:29 - 37496016 _____ (Curse) C:\Users\janni\Downloads\CurseClientSetup (1).exe
2014-05-02 20:27 - 2014-05-02 20:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-02 20:27 - 2014-05-02 20:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-02 16:54 - 2014-05-02 16:54 - 00101376 _____ (Curse) C:\Users\janni\Downloads\CurseClientSetup.exe
2014-04-29 22:53 - 2014-04-29 22:57 - 00000000 ____D () C:\Users\janni\Documents\MK-LOL
2014-04-29 22:53 - 2014-04-29 22:53 - 00000054 _____ () C:\Windows\JQHApp.dat
2014-04-29 22:53 - 2014-04-29 22:53 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MKJogo
2014-04-29 22:52 - 2014-04-29 22:52 - 00000000 ____D () C:\Program Files (x86)\MKJogo
2014-04-29 00:27 - 2014-04-29 00:28 - 11570166 _____ () C:\Users\janni\Downloads\bol_studio.rar
2014-04-29 00:24 - 2014-04-29 17:25 - 00000000 ____D () C:\Users\janni\AppData\Roaming\BoL
2014-04-28 23:59 - 2014-04-28 23:59 - 00000000 ____D () C:\LOLHT Configs v2
2014-04-28 23:53 - 2014-04-28 23:54 - 05017092 _____ () C:\Users\janni\Downloads\wQhdLr35+-N.exe
2014-04-23 22:46 - 2014-05-21 22:33 - 00290184 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-04-23 22:46 - 2014-04-23 22:46 - 00000000 ____D () C:\Users\janni\Documents\Battlefield 3
2014-04-23 22:42 - 2014-04-23 22:42 - 00000000 ____D () C:\ProgramData\EA Core
2014-04-23 22:29 - 2014-04-23 22:29 - 00001186 _____ () C:\Users\Public\Desktop\Battlefield 3.lnk
2014-04-23 20:36 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-23 01:02 - 2014-04-23 01:05 - 00001908 _____ () C:\Windows\diagwrn.xml
2014-04-23 01:02 - 2014-04-23 01:05 - 00001908 _____ () C:\Windows\diagerr.xml
2014-04-23 01:02 - 2014-04-23 01:02 - 00000000 ___HD () C:\$WINDOWS.~BT
2014-04-23 00:49 - 2014-04-23 00:49 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 USB DVD Download Tool
2014-04-23 00:49 - 2014-04-23 00:49 - 00000000 ____D () C:\Users\janni\AppData\Local\Apps\Windows 7 USB DVD Download Tool
==================== One Month Modified Files and Folders =======
2014-05-23 18:55 - 2014-05-23 16:21 - 00020602 _____ () C:\Users\janni\Desktop\FRST.txt
2014-05-23 18:55 - 2014-05-23 16:21 - 00000000 ____D () C:\FRST
2014-05-23 18:54 - 2013-11-19 18:07 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-792214429-3740351277-2917951772-1001
2014-05-23 18:53 - 2014-05-23 18:53 - 02067456 _____ (Farbar) C:\Users\janni\Desktop\FRST64.exe
2014-05-23 18:52 - 2014-05-23 18:52 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-23 18:52 - 2014-05-23 18:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-23 18:52 - 2014-05-23 18:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-23 18:52 - 2014-02-13 02:23 - 00000000 ____D () C:\Users\janni\AppData\Local\CrashDumps
2014-05-23 18:52 - 2014-02-05 01:28 - 00000000 __RDO () C:\Users\janni\SkyDrive
2014-05-23 18:52 - 2013-11-19 18:26 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-23 18:51 - 2013-11-19 18:27 - 00002195 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-23 18:50 - 2014-05-23 18:50 - 00009614 _____ () C:\Users\janni\Desktop\zoek-results.txt
2014-05-23 18:50 - 2014-05-17 02:01 - 00000000 ___RD () C:\Users\janni\Google Drive
2014-05-23 18:50 - 2014-04-06 00:31 - 00000000 ____D () C:\Users\janni\AppData\Local\LogMeIn Hamachi
2014-05-23 18:49 - 2014-05-23 18:41 - 00009614 _____ () C:\zoek-results.log
2014-05-23 18:49 - 2014-03-19 00:21 - 01551631 _____ () C:\Windows\WindowsUpdate.log
2014-05-23 18:49 - 2013-11-19 18:26 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-23 18:48 - 2014-05-15 01:19 - 00001862 _____ () C:\Windows\PFRO.log
2014-05-23 18:48 - 2013-11-19 18:06 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-23 18:48 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-23 18:48 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-05-23 18:44 - 2014-05-23 18:40 - 00000000 ____D () C:\zoek_backup
2014-05-23 18:44 - 2013-11-19 18:00 - 00000000 ____D () C:\Users\janni
2014-05-23 18:40 - 2014-05-23 18:45 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-05-23 18:40 - 2014-05-23 18:40 - 01285120 _____ () C:\Users\janni\Desktop\zoek.exe
2014-05-23 18:39 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-05-23 18:37 - 2014-05-23 18:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Desktop\mbam-setup-2.0.2.1012 (3).exe
2014-05-23 18:34 - 2014-05-23 18:34 - 00000762 _____ () C:\Users\janni\Desktop\JRT.txt
2014-05-23 18:32 - 2014-05-23 18:32 - 00000000 ____D () C:\Windows\ERUNT
2014-05-23 18:32 - 2014-05-23 18:31 - 01016261 _____ (Thisisu) C:\Users\janni\Desktop\JRT.exe
2014-05-23 18:30 - 2014-05-23 18:30 - 00001688 _____ () C:\Users\janni\Desktop\AdwCleaner[S5].txt
2014-05-23 18:28 - 2014-04-03 14:41 - 00000000 ____D () C:\AdwCleaner
2014-05-23 18:27 - 2014-05-23 18:27 - 01326389 _____ () C:\Users\janni\Desktop\adwcleaner_3.210 (1).exe
2014-05-23 18:27 - 2014-03-26 14:01 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Spotify
2014-05-23 18:22 - 2013-11-19 19:50 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Skype
2014-05-23 18:02 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2014-05-23 17:12 - 2014-05-23 17:12 - 00034138 _____ () C:\Users\janni\Desktop\Ereignisse.txt
2014-05-23 17:06 - 2014-05-23 17:06 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.2.1012 (2).exe
2014-05-23 16:17 - 2014-05-23 16:17 - 00961360 _____ (Chip Digital GmbH) C:\Users\janni\Downloads\HijackThis - CHIP-Downloader.exe
2014-05-23 16:17 - 2014-05-23 16:17 - 00388608 _____ (Trend Micro Inc.) C:\Users\janni\Downloads\hijackthis.exe
2014-05-23 16:07 - 2013-11-19 18:07 - 01802982 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-23 16:07 - 2013-08-23 01:24 - 00778714 _____ () C:\Windows\system32\perfh007.dat
2014-05-23 16:07 - 2013-08-23 01:24 - 00163510 _____ () C:\Windows\system32\perfc007.dat
2014-05-23 16:06 - 2014-05-23 16:06 - 02209056 _____ () C:\Users\janni\Downloads\avira-eu-cleaner_de.exe
2014-05-23 16:06 - 2014-01-29 00:23 - 00000412 _____ () C:\Windows\Tasks\update-sys.job
2014-05-23 15:59 - 2014-05-23 15:59 - 00940032 _____ () C:\Users\janni\Downloads\speedscan_0.8.exe
2014-05-23 15:59 - 2014-05-23 15:59 - 00004977 _____ () C:\Users\janni\Downloads\reg.txt
2014-05-23 15:59 - 2014-05-23 15:59 - 00000389 _____ () C:\Users\janni\Downloads\SpeedScan.txt
2014-05-23 15:58 - 2014-05-23 15:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-05-23 15:58 - 2014-05-23 15:58 - 01326389 _____ () C:\Users\janni\Downloads\adwcleaner_3.210.exe
2014-05-23 15:58 - 2014-05-23 15:57 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-23 15:53 - 2014-05-23 14:29 - 00000000 ____D () C:\Users\janni\Downloads\Need.For.Speed.Most.Wanted__PC
2014-05-23 15:53 - 2013-11-19 19:37 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-23 15:53 - 2013-11-19 18:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-23 15:50 - 2014-04-19 20:32 - 00000000 ____D () C:\Users\janni\AppData\Roaming\uTorrent
2014-05-23 15:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\registration
2014-05-23 15:04 - 2014-05-23 15:04 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-05-23 15:04 - 2013-11-23 22:08 - 02185728 ___SH () C:\Users\janni\Desktop\Thumbs.db
2014-05-23 13:54 - 2013-11-19 21:13 - 00000000 ____D () C:\Users\janni\AppData\Local\PMB Files
2014-05-22 15:09 - 2014-01-29 00:23 - 00000412 _____ () C:\Windows\Tasks\update-S-1-5-21-792214429-3740351277-2917951772-1001.job
2014-05-22 14:36 - 2014-05-22 14:35 - 00295920 _____ () C:\Windows\Minidump\052214-20437-01.dmp
2014-05-22 14:35 - 2014-05-05 15:05 - 425216876 _____ () C:\Windows\MEMORY.DMP
2014-05-22 14:35 - 2013-11-24 14:11 - 00000000 ____D () C:\Windows\Minidump
2014-05-21 22:33 - 2014-04-23 22:46 - 00290184 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-05-21 22:33 - 2013-11-21 09:57 - 00290184 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-05-21 22:33 - 2013-11-21 09:57 - 00280904 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-05-21 11:12 - 2014-01-08 17:06 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-05-21 10:35 - 2014-05-21 10:35 - 00295920 _____ () C:\Windows\Minidump\052114-21281-01.dmp
2014-05-20 23:36 - 2014-05-20 23:36 - 00000000 ____D () C:\Users\janni\Desktop\O2BS2013
2014-05-20 23:35 - 2014-05-20 23:30 - 519716518 _____ () C:\Users\janni\Desktop\O2BS2013.part3.rar
2014-05-20 23:33 - 2014-05-20 23:28 - 536870928 _____ () C:\Users\janni\Desktop\O2BS2013.part1.rar
2014-05-20 23:23 - 2014-05-20 23:23 - 00236952 _____ () C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T (1).exe
2014-05-20 23:21 - 2014-05-20 23:21 - 00236952 _____ () C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T.exe
2014-05-20 20:51 - 2014-01-08 17:06 - 00000000 ____D () C:\ProgramData\Origin
2014-05-19 23:10 - 2013-11-19 21:13 - 00000000 ____D () C:\ProgramData\PMB Files
2014-05-19 14:15 - 2014-01-25 22:01 - 00000000 ____D () C:\Users\janni\AppData\Roaming\.minecraft
2014-05-19 11:13 - 2014-05-19 11:12 - 00295920 _____ () C:\Windows\Minidump\051914-26796-01.dmp
2014-05-17 17:25 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2014-05-17 17:24 - 2013-12-10 23:17 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-05-17 17:24 - 2013-12-10 23:15 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-17 15:07 - 2014-05-17 15:07 - 00295920 _____ () C:\Windows\Minidump\051714-34468-01.dmp
2014-05-17 02:19 - 2014-05-17 02:18 - 00000000 ____D () C:\Users\janni\Desktop\Draven
2014-05-17 02:17 - 2014-02-08 02:57 - 00000000 ____D () C:\Users\janni\Documents\Camtasia Studio
2014-05-17 02:04 - 2014-05-14 20:41 - 00000000 ____D () C:\Users\janni\Desktop\WallPaper
2014-05-17 02:01 - 2014-05-17 02:01 - 00001752 _____ () C:\Users\janni\Desktop\Google Drive.lnk
2014-05-17 01:59 - 2014-05-17 01:59 - 00918672 _____ (Google Inc.) C:\Users\janni\Downloads\googledrivesync.exe
2014-05-17 01:59 - 2014-05-17 01:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-05-17 01:59 - 2013-11-19 18:26 - 00000000 ____D () C:\Users\janni\AppData\Local\Google
2014-05-17 01:59 - 2013-11-19 18:26 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-17 01:56 - 2014-05-17 01:55 - 00000000 ____D () C:\Users\janni\Desktop\S3 ROOT
2014-05-17 01:55 - 2014-04-08 13:50 - 00000000 ____D () C:\Users\janni\Desktop\Fotos
2014-05-16 13:55 - 2014-03-26 14:01 - 00000000 ____D () C:\Users\janni\AppData\Local\Spotify
2014-05-16 11:22 - 2013-11-19 18:01 - 00000000 ___RD () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 11:22 - 2013-11-19 18:01 - 00000000 ___RD () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-15 23:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-05-15 18:27 - 2014-05-15 18:27 - 87080115 _____ () C:\Users\janni\Desktop\League of Legends 05.15.2014 - 18.27.25.98.DVR.mp4
2014-05-15 13:36 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-15 13:33 - 2013-11-22 08:32 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 13:32 - 2013-11-22 08:32 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 13:32 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-05-15 13:28 - 2013-08-22 15:25 - 00000190 _____ () C:\Windows\win.ini
2014-05-15 13:22 - 2013-11-23 04:47 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-15 13:22 - 2013-11-23 04:47 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-15 13:16 - 2014-05-15 13:16 - 00295864 _____ () C:\Windows\Minidump\051514-18562-01.dmp
2014-05-15 01:27 - 2014-05-14 20:07 - 00043983 _____ () C:\Windows\setupact.log
2014-05-15 01:18 - 2014-05-15 01:18 - 01325827 _____ () C:\Users\janni\Downloads\adwcleaner08.exe
2014-05-15 01:18 - 2014-05-15 01:17 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-15 01:18 - 2014-05-15 01:17 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\janni\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-05-15 01:18 - 2014-03-18 23:45 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Malwarebytes
2014-05-15 01:18 - 2014-03-18 23:45 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-15 01:18 - 2014-01-24 00:42 - 00001073 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-15 01:18 - 2014-01-24 00:42 - 00001061 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-15 01:18 - 2013-11-19 18:01 - 00001007 _____ () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-15 01:05 - 2014-05-15 01:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
2014-05-15 01:05 - 2014-05-14 20:26 - 00000000 ____D () C:\Program Files (x86)\MyPhoneExplorer
2014-05-15 01:04 - 2014-05-15 01:04 - 07080248 _____ () C:\Users\janni\Downloads\MyPhoneExplorer_1.8.5.exe
2014-05-15 00:57 - 2014-05-15 00:57 - 00295920 _____ () C:\Windows\Minidump\051514-22281-01.dmp
2014-05-15 00:17 - 2014-05-15 00:16 - 217316426 _____ () C:\Users\janni\Downloads\cm-11-20140514-NIGHTLY-i9300 (1).zip
2014-05-14 23:39 - 2014-05-14 21:27 - 00000446 __RSH () C:\ProgramData\ntuser.pol
2014-05-14 23:39 - 2014-05-14 21:27 - 00000000 ____D () C:\usb_driver
2014-05-14 22:51 - 2014-05-14 22:51 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (5).msi
2014-05-14 22:37 - 2014-05-14 22:37 - 00785992 _____ () C:\Users\janni\Downloads\GT-I5500_OS-Flasher.7z
2014-05-14 22:26 - 2014-05-14 22:26 - 00295920 _____ () C:\Windows\Minidump\051414-27156-01.dmp
2014-05-14 22:24 - 2014-05-14 22:24 - 00074105 _____ () C:\Users\janni\Downloads\UninstallKies.7z
2014-05-14 22:24 - 2014-05-14 22:24 - 00000000 ____D () C:\Program Files\SAMSUNG
2014-05-14 22:20 - 2014-05-14 22:20 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2014-05-14 22:20 - 2014-05-14 22:19 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\Documents\SelfMV
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\Documents\samsung
2014-05-14 22:19 - 2014-05-14 22:19 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Samsung
2014-05-14 22:19 - 2013-11-19 18:36 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-14 22:18 - 2014-05-14 22:18 - 41315792 _____ (Samsung Electronics Co., Ltd.) C:\Users\janni\Downloads\Kies3Setup.exe
2014-05-14 22:17 - 2014-05-14 22:17 - 26551126 _____ () C:\Users\janni\Downloads\SAMSUNG_USB_Driver_for_Mobile_Phones.zip
2014-05-14 22:17 - 2014-05-14 22:17 - 00000000 ____D () C:\ProgramData\Samsung
2014-05-14 22:14 - 2014-05-14 22:05 - 00000000 ____D () C:\Users\janni\usb_driver
2014-05-14 22:12 - 2014-05-14 22:11 - 186168282 _____ () C:\Users\janni\Downloads\cm-10.2.0-i9300.zip
2014-05-14 22:05 - 2014-05-14 22:05 - 00098400 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusbk.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00076384 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusb0.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00067680 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusb0.dll
2014-05-14 22:05 - 2014-05-14 22:05 - 00052832 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\Drivers\libusb0.sys
2014-05-14 22:03 - 2014-05-14 22:03 - 05294304 _____ (akeo.ie) C:\Users\janni\Downloads\zadig_2.1.0.exe
2014-05-14 21:44 - 2014-05-14 21:44 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-05-14 21:42 - 2014-05-14 21:42 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (4).msi
2014-05-14 21:35 - 2014-05-14 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-05-14 21:35 - 2014-05-14 21:35 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-05-14 21:27 - 2014-05-14 21:27 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2014-05-14 21:27 - 2014-05-14 21:27 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2014-05-14 21:27 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-05-14 21:24 - 2014-05-14 21:24 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (2).msi
2014-05-14 21:24 - 2014-05-14 21:24 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfCoInstaller01007.dll
2014-05-14 21:24 - 2014-05-14 21:24 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WinUSBCoInstaller.dll
2014-05-14 21:20 - 2014-05-14 21:20 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (3).msi
2014-05-14 21:20 - 2014-05-14 21:20 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller (1).msi
2014-05-14 20:42 - 2014-05-14 20:41 - 00000000 ____D () C:\Users\janni\Desktop\WhatsApp Video
2014-05-14 20:41 - 2014-05-14 20:41 - 00000000 ____D () C:\Users\janni\Desktop\WhatsApp Profile Photos
2014-05-14 20:33 - 2013-11-28 15:24 - 00000000 ____D () C:\Users\janni\Desktop\Temps,OC,Tools
2014-05-14 20:26 - 2014-05-14 20:26 - 07435787 _____ () C:\Users\janni\Downloads\MyPhoneExplorer_Setup_1.8.5_pcwelt.exe
2014-05-14 20:26 - 2014-05-14 20:26 - 00000000 ____D () C:\Users\janni\AppData\Roaming\MyPhoneExplorer
2014-05-14 20:17 - 2014-05-14 20:17 - 02056192 _____ () C:\Users\janni\Downloads\CMInstaller.msi
2014-05-14 20:17 - 2014-05-14 20:17 - 00195782 _____ () C:\Users\janni\Downloads\CyanogenModInstaller-1.0.1.4.apk
2014-05-14 20:09 - 2014-05-14 20:09 - 00013507 _____ () C:\Users\janni\Downloads\MemTest4.zip
2014-05-14 20:07 - 2014-05-14 20:07 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-14 20:00 - 2014-05-14 20:00 - 73916223 _____ (Mediatronic Pty Ltd) C:\Users\janni\Downloads\MediaCoder-x64-0.8.30.5620.exe
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MediaCoder x64
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Mediatronic
2014-05-14 20:00 - 2014-05-14 20:00 - 00000000 ____D () C:\Program Files\MediaCoder
2014-05-14 19:06 - 2014-05-14 19:06 - 368021806 _____ () C:\Users\janni\Desktop\League of Legends 05.14.2014 - 19.06.26.204.DVR.mp4
2014-05-13 17:40 - 2014-05-13 17:40 - 00295920 _____ () C:\Windows\Minidump\051314-15296-01.dmp
2014-05-13 14:29 - 2014-05-13 14:29 - 00046136 ____H (LogMeIn Inc.) C:\Windows\system32\Drivers\Hamdrv.sys
2014-05-13 14:10 - 2014-05-13 14:10 - 00029128 _____ () C:\Users\janni\Downloads\Outlook.com.zip
2014-05-13 14:10 - 2013-11-19 18:01 - 00000000 ____D () C:\Users\janni\AppData\Local\Packages
2014-05-13 13:17 - 2014-05-13 13:17 - 00295920 _____ () C:\Windows\Minidump\051314-14250-01.dmp
2014-05-12 20:51 - 2014-05-12 20:51 - 00005478 _____ () C:\Users\janni\Downloads\Ioannis Pelechras.odt
2014-05-12 15:10 - 2014-05-12 15:10 - 00994160 _____ () C:\Users\janni\Downloads\setup (1).exe
2014-05-12 07:26 - 2014-05-23 18:52 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-05-23 18:52 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-05-23 18:52 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 22:22 - 2014-05-11 22:22 - 00295920 _____ () C:\Windows\Minidump\051114-15156-01.dmp
2014-05-11 15:35 - 2014-05-11 15:35 - 00295920 _____ () C:\Windows\Minidump\051114-13593-01.dmp
2014-05-10 13:06 - 2014-05-10 13:06 - 00295920 _____ () C:\Windows\Minidump\051014-15484-01.dmp
2014-05-09 13:29 - 2014-05-09 13:29 - 00295920 _____ () C:\Windows\Minidump\050914-16734-01.dmp
2014-05-08 08:21 - 2014-05-08 08:21 - 00295920 _____ () C:\Windows\Minidump\050814-14562-01.dmp
2014-05-07 21:01 - 2014-05-07 21:01 - 00295920 _____ () C:\Windows\Minidump\050714-15953-01.dmp
2014-05-07 02:11 - 2014-05-07 02:11 - 00295920 _____ () C:\Windows\Minidump\050714-19875-01.dmp
2014-05-07 01:36 - 2014-05-02 21:36 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Curse Client
2014-05-06 21:47 - 2013-11-19 18:26 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-06 21:47 - 2013-11-19 18:26 - 00003868 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-06 14:37 - 2014-05-06 14:37 - 00991848 _____ () C:\Users\janni\Downloads\setup.exe
2014-05-06 11:38 - 2014-05-06 11:38 - 00295920 _____ () C:\Windows\Minidump\050614-17968-01.dmp
2014-05-06 06:40 - 2014-05-15 13:24 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:25 - 2014-05-15 13:24 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:00 - 2014-05-15 13:24 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 13:24 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 15:05 - 2014-05-05 15:05 - 00295920 _____ () C:\Windows\Minidump\050514-17531-01.dmp
2014-05-05 11:30 - 2013-12-09 17:36 - 00000000 ____D () C:\Users\janni\AppData\Roaming\TS3Client
2014-05-05 11:30 - 2013-12-04 22:06 - 00000000 ____D () C:\Users\janni\AppData\Roaming\BitTorrent
2014-05-02 21:36 - 2014-05-02 21:30 - 00001073 _____ () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse.lnk
2014-05-02 21:30 - 2014-05-02 21:30 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Curse
2014-05-02 21:29 - 2014-05-02 21:29 - 37496016 _____ (Curse) C:\Users\janni\Downloads\CurseClientSetup (1).exe
2014-05-02 20:27 - 2014-05-02 20:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-02 20:27 - 2014-05-02 20:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-02 16:54 - 2014-05-02 16:54 - 00101376 _____ (Curse) C:\Users\janni\Downloads\CurseClientSetup.exe
2014-05-02 16:28 - 2013-11-19 18:49 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-05-01 22:30 - 2013-08-22 17:38 - 00693240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-01 22:30 - 2013-08-22 17:38 - 00105464 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-29 22:57 - 2014-04-29 22:53 - 00000000 ____D () C:\Users\janni\Documents\MK-LOL
2014-04-29 22:53 - 2014-04-29 22:53 - 00000054 _____ () C:\Windows\JQHApp.dat
2014-04-29 22:53 - 2014-04-29 22:53 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MKJogo
2014-04-29 22:52 - 2014-04-29 22:52 - 00000000 ____D () C:\Program Files (x86)\MKJogo
2014-04-29 17:25 - 2014-04-29 00:24 - 00000000 ____D () C:\Users\janni\AppData\Roaming\BoL
2014-04-29 00:28 - 2014-04-29 00:27 - 11570166 _____ () C:\Users\janni\Downloads\bol_studio.rar
2014-04-28 23:59 - 2014-04-28 23:59 - 00000000 ____D () C:\LOLHT Configs v2
2014-04-28 23:54 - 2014-04-28 23:53 - 05017092 _____ () C:\Users\janni\Downloads\wQhdLr35+-N.exe
2014-04-23 22:50 - 2013-11-21 09:57 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-04-23 22:46 - 2014-04-23 22:46 - 00000000 ____D () C:\Users\janni\Documents\Battlefield 3
2014-04-23 22:46 - 2014-01-08 19:51 - 00000000 ____D () C:\Users\janni\AppData\Local\PunkBuster
2014-04-23 22:42 - 2014-04-23 22:42 - 00000000 ____D () C:\ProgramData\EA Core
2014-04-23 22:29 - 2014-04-23 22:29 - 00001186 _____ () C:\Users\Public\Desktop\Battlefield 3.lnk
2014-04-23 20:57 - 2014-01-08 17:11 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-04-23 01:05 - 2014-04-23 01:02 - 00001908 _____ () C:\Windows\diagwrn.xml
2014-04-23 01:05 - 2014-04-23 01:02 - 00001908 _____ () C:\Windows\diagerr.xml
2014-04-23 01:02 - 2014-04-23 01:02 - 00000000 ___HD () C:\$WINDOWS.~BT
2014-04-23 00:49 - 2014-04-23 00:49 - 00000000 ____D () C:\Users\janni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 USB DVD Download Tool
2014-04-23 00:49 - 2014-04-23 00:49 - 00000000 ____D () C:\Users\janni\AppData\Local\Apps\Windows 7 USB DVD Download Tool
2014-04-23 00:38 - 2014-04-22 19:40 - 00000000 ____D () C:\Users\janni\AppData\Local\JDownloader 2.0
Some content of TEMP:
====================
C:\Users\janni\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-23 07:23
==================== End Of Log ============================
Addition häng ich noch als anhang rein. Malwarebytes log konnte ich wie geschrieben leider nicht erstellen . Ich danke dir schomal für deine Antwort. LG. Jan |
|
23.05.2014, 19:41
| #4 |
| /// TB-Ausbilder | Windows 8.1 Adware , Trojaner verdacht , Websiten werden auf Werbung umgeleitet Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 3 h) dauern. Im Anschluss entfernen wir alle verwendeten Tools und ich gebe dir noch ein paar Tipps mit auf den Weg. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
Task: {CD52C461-4D2E-43B9-8D7A-417192108056} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2013-09-27] ()
Task: {D42E5CFF-82B5-4FD6-A768-2EAC2D26C0CA} - System32\Tasks\update-S-1-5-21-792214429-3740351277-2917951772-1001 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2013-09-27] ()
Task: C:\Windows\Tasks\update-S-1-5-21-792214429-3740351277-2917951772-1001.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\Windows\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
C:\Program Files (x86)\Skillbrains
Reboot:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit) | SystemLook (64 bit)
Schritt 3 ESET Online Scanner
Schritt 4 Downloade Dir bitte  SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
|
24.05.2014, 01:19
| #5 |
| | Windows 8.1 Adware , Trojaner verdacht , Websiten werden auf Werbung umgeleitet So da bin ich nun wieder , du hattest recht mit den >3 H  , insgesamt hat der ESET Scan 4H gedauert hat.Ich habe aber nun alle LogDatein die du brauchst. Eset SCAN : Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=2f856e2d3ed35845851cb1469718a27f
# engine=18387
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-23 11:55:05
# local_time=2014-05-24 01:55:05 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode=1799 16775165 100 94 24094 17648987 16877 0
# compatibility_mode=5893 16776574 100 94 699957 9215626 0 0
# scanned=272816
# found=52
# cleaned=0
# scan_time=14141
sh=97566EFC7EA49FABD17E2B059365DCFCEBFF8724 ft=1 fh=d28dc60fa0e472fd vn="Variante von Win32/SpeedingUpMyPC Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe.vir"
sh=A5D4D1472CD365B05C10F2A324048A339FCE483A ft=1 fh=a001a55405d17196 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=0295D35699B2140BBB9587B6628DDB394847F15D ft=1 fh=e16bddca39b92870 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir"
sh=CD1C24A1EEBA7BF42ACAE7BB816BA4CB44248EA7 ft=1 fh=fbc6405e97975547 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=B8E13BA427AD7DA77629A1D280A44F16564BBA3F ft=1 fh=206045b78442ee8f vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=BAFB304CFCFCA21BBFE37B69725C732D4133752A ft=1 fh=72ec2f035966a73c vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir"
sh=90809E3D95CBE0CAD03FD031B7C2A21ACBB09C65 ft=1 fh=e0e2f26ba48b3fbb vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir"
sh=CE3FEE449AE8F548152E3DEE5EBE6885C8DDC8B0 ft=1 fh=52bfba53a8df10b3 vn="Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir"
sh=15B12AE8233A6E3B4806C081D34159E76C92C67D ft=1 fh=53d4432bf5a930f9 vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=C7C0F42A23562AA6DCCD60326FD8CC2AA41B5448 ft=1 fh=c053642cee9f3def vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"
sh=125B1C393F2104CBA08183E495C0907BFF7EDA22 ft=1 fh=ea25908c8365106f vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir"
sh=8E85792765D0E0BF52107CFF4A6620995DB19BB0 ft=1 fh=627da500ea2e265f vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterfacef32.dll.vir"
sh=6043D1ACD51FD373472020FBB748C405AAF22397 ft=1 fh=4c716dbbae6c21b9 vn="Win32/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect32.dll.vir"
sh=FF431CD8693F4045BD7BD87DBCE54B820F000FC0 ft=1 fh=16c2e1bd3fd6b7e2 vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect64.dll.vir"
sh=9DC13DB9C123270C2356ED410128E11D5ADF7C6E ft=1 fh=023ab782f0a9b07d vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir"
sh=56659F7FF1F1FA7906A77228E315F65F38BCEF73 ft=1 fh=0ff759dfc352fd03 vn="Variante von Win32/ELEX.AD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\IePluginServices\PluginService.exe.vir"
sh=A70C63312CBCD0D975236E48372A5F3275A01554 ft=1 fh=b3500ac9ac48c1c9 vn="Variante von Win32/ELEX.AE evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\WPM\wprotectmanager.exe.vir"
sh=B2AC265EEC4EED9029B2971C4B42A3CA0117CE3B ft=1 fh=c9e1d0648e2c6dec vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll.vir"
sh=B2AC265EEC4EED9029B2971C4B42A3CA0117CE3B ft=1 fh=c9e1d0648e2c6dec vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll.vir"
sh=CD050DC163422C58EED7FA8F8942D861BD9ED6B5 ft=1 fh=73cadc4c7328be1d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"
sh=6AFD48E209016E5B0928DA35A0F383206629542E ft=1 fh=800e2df4756163bc vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_24.dll.vir"
sh=9D6A05550D4EDAAE21426963E1D7E29B1128E6A3 ft=1 fh=03f53be6abe181a5 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_25.dll.vir"
sh=359650C7CEBE8C147CC3A52B9746AB33F546D259 ft=1 fh=bc065b51744671b9 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll.vir"
sh=AF8E4B402FDD1252B8AD1A6F392E01CE017FCC2D ft=1 fh=1b562d08d2c329d2 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll.vir"
sh=2900AFF2E6279E11CFA1C94202C993EF0999F8E9 ft=1 fh=05be29e2431ae2cc vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_28.dll.vir"
sh=ADC5A8D352C6B68C69F1999C71B39F546E0B6A59 ft=1 fh=6a51156b8cffa57a vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_29.dll.vir"
sh=31CE21FE36C11E107A6E315EFE1875743809B4CC ft=1 fh=48abcfa6ce4a4014 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\janni\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=6B92ACCB15C567805BFC60AE0D77180A094F72A3 ft=1 fh=72f79de567122609 vn="Variante von Win32/Packed.VMProtect.ABD Trojaner" ac=I fn="C:\Program Files (x86)\S.G Games\Free Farm Simulator\nfs14.3dm.dll"
sh=9F0FA3A07F3B6799C7FDE125D3C0264129212E54 ft=1 fh=a770de0281068b8c vn="Win32/Somoto.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\AppData\Local\Google\Chrome\User Data\Default\File System\018\t\00\00000000"
sh=A5EECED5D0A893334F8B79F5A6FD7BFA01005860 ft=1 fh=16ed0088e5a650a1 vn="Win32/Somoto.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\AppData\Local\Microsoft\Windows\INetCache\IE\FSTVFR5A\setup[1].exe"
sh=40CE0A58E99858007E5DCD0BB5BF6A122686A917 ft=1 fh=f92770b35775886c vn="Win32/Somoto.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\AppData\Local\Microsoft\Windows\INetCache\IE\RB568B0G\BiTool[1].dll"
sh=A5EECED5D0A893334F8B79F5A6FD7BFA01005860 ft=1 fh=16ed0088e5a650a1 vn="Win32/Somoto.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\AppData\Local\Microsoft\Windows\INetCache\IE\WQ62VOSA\setup[1].exe"
sh=37E68A5134B9980E163F4527D715EA3532EBD226 ft=0 fh=0000000000000000 vn="Win32/SuspLibLoad.A Trojaner" ac=I fn="C:\Users\janni\Desktop\O2BS2013DEMO.part1.rar"
sh=AD4E50C7007C9E47A3A2D5EC0483464196DB2A85 ft=1 fh=5e89ef3fcbfecd06 vn="Win32/Toolbar.Conduit.AE evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\Desktop\SpeedFan_TSA33T6OP.exe"
sh=3F7144E397CB89F851E939CBDAD680AA7BD4A9DF ft=1 fh=3957a5ebe12b210e vn="Win32/SuspLibLoad.A Trojaner" ac=I fn="C:\Users\janni\Desktop\O2BS2013DEMO\OMSI 2 Bus Simulator free Demo 2013\d3dx9.dll"
sh=9F0FA3A07F3B6799C7FDE125D3C0264129212E54 ft=1 fh=a770de0281068b8c vn="Win32/Somoto.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T (1).exe"
sh=2464C962D9E5BDE6B30389D6342BF73744DC5C44 ft=1 fh=59ad47b881068b8c vn="Win32/Somoto.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T.exe"
sh=1CB929FD44B2E68B82BBF2F79EA639F81F9A7B82 ft=1 fh=16fefb6da4871550 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\Downloads\HijackThis - CHIP-Downloader.exe"
sh=EAE2784C9115FE9CFA44A116B74E72C1BCCFA7F6 ft=1 fh=2e79e77116fe19c4 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\Downloads\MyPhoneExplorer_1.8.5.exe"
sh=CB2944AE1A1977A899538F1065F9D1211C2AEA03 ft=1 fh=013aeab0cb55a839 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\Downloads\MyPhoneExplorer_Setup_1.8.5_pcwelt.exe"
sh=9A0B153E25E9D2D541493384A540E927D764F04B ft=1 fh=4142ccc65f36d42c vn="Win32/OutBrowse.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\Downloads\setup (1).exe"
sh=6224A6B1BB4167C37DC0B41BF3DDA5EF776C13EA ft=1 fh=15cfab4a422d821b vn="Win32/OutBrowse.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\Downloads\setup.exe"
sh=B89059D6915C1CE24FD385DB3394550306CB970B ft=1 fh=85c227cf7df43ed9 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\janni\Downloads\SpeedFan - CHIP-Installer.exe"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="Variante von Win32/TrojanDownloader.VB.QLS Trojaner" ac=I fn="C:\Users\janni\Downloads\Free CD-Burner\CD-Burner.iso"
sh=5DE3C90FFD48803B4E3924FF37DC7EB6E5FC3285 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\7c11e.msi"
sh=5AD2D071CA9B66BDB95599B64CA5179B77BFB9BD ft=1 fh=1fac643410a3debd vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\zoek_backup\C_Users_janni_Desktop_HijackThis - CHIP-Downloader.exe.vir"
sh=6AFD48E209016E5B0928DA35A0F383206629542E ft=1 fh=800e2df4756163bc vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\zoek_backup\C_Users_janni_AppData_Roaming_Mozilla_Firefox_Profiles_2op7qtzj.default_extensions_{89da9d67-afd6-74a8-0e2a-296ea625e2fe}\components\SmartbarFireFoxRemotePlugin_24.dll"
sh=9D6A05550D4EDAAE21426963E1D7E29B1128E6A3 ft=1 fh=03f53be6abe181a5 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\zoek_backup\C_Users_janni_AppData_Roaming_Mozilla_Firefox_Profiles_2op7qtzj.default_extensions_{89da9d67-afd6-74a8-0e2a-296ea625e2fe}\components\SmartbarFireFoxRemotePlugin_25.dll"
sh=359650C7CEBE8C147CC3A52B9746AB33F546D259 ft=1 fh=bc065b51744671b9 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\zoek_backup\C_Users_janni_AppData_Roaming_Mozilla_Firefox_Profiles_2op7qtzj.default_extensions_{89da9d67-afd6-74a8-0e2a-296ea625e2fe}\components\SmartbarFireFoxRemotePlugin_26.dll"
sh=AF8E4B402FDD1252B8AD1A6F392E01CE017FCC2D ft=1 fh=1b562d08d2c329d2 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\zoek_backup\C_Users_janni_AppData_Roaming_Mozilla_Firefox_Profiles_2op7qtzj.default_extensions_{89da9d67-afd6-74a8-0e2a-296ea625e2fe}\components\SmartbarFireFoxRemotePlugin_27.dll"
sh=2900AFF2E6279E11CFA1C94202C993EF0999F8E9 ft=1 fh=05be29e2431ae2cc vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\zoek_backup\C_Users_janni_AppData_Roaming_Mozilla_Firefox_Profiles_2op7qtzj.default_extensions_{89da9d67-afd6-74a8-0e2a-296ea625e2fe}\components\SmartbarFireFoxRemotePlugin_28.dll"
sh=ADC5A8D352C6B68C69F1999C71B39F546E0B6A59 ft=1 fh=6a51156b8cffa57a vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\zoek_backup\C_Users_janni_AppData_Roaming_Mozilla_Firefox_Profiles_2op7qtzj.default_extensions_{89da9d67-afd6-74a8-0e2a-296ea625e2fe}\components\SmartbarFireFoxRemotePlugin_29.dll"
checkup : Code:
ATTFilter Results of screen317's Security Check version 0.99.83
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Windows Defender
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Call of Duty: Ghosts - Multiplayer
Java 7 Update 51
Java version out of Date!
Mozilla Firefox 27.0.1 Firefox out of Date!
Google Chrome 34.0.1847.137
Google Chrome 35.0.1916.114
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FIXLOG : Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-05-2014
Ran by janni at 2014-05-23 21:48:11 Run:1
Running from C:\Users\janni\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
Task: {CD52C461-4D2E-43B9-8D7A-417192108056} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2013-09-27] ()
Task: {D42E5CFF-82B5-4FD6-A768-2EAC2D26C0CA} - System32\Tasks\update-S-1-5-21-792214429-3740351277-2917951772-1001 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2013-09-27] ()
Task: C:\Windows\Tasks\update-S-1-5-21-792214429-3740351277-2917951772-1001.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\Windows\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
C:\Program Files (x86)\Skillbrains
Reboot:
end
*****************
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CD52C461-4D2E-43B9-8D7A-417192108056} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CD52C461-4D2E-43B9-8D7A-417192108056} => Key deleted successfully.
C:\Windows\System32\Tasks\update-sys => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\update-sys => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D42E5CFF-82B5-4FD6-A768-2EAC2D26C0CA} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D42E5CFF-82B5-4FD6-A768-2EAC2D26C0CA} => Key deleted successfully.
C:\Windows\System32\Tasks\update-S-1-5-21-792214429-3740351277-2917951772-1001 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\update-S-1-5-21-792214429-3740351277-2917951772-1001 => Key deleted successfully.
C:\Windows\Tasks\update-S-1-5-21-792214429-3740351277-2917951772-1001.job => Moved successfully.
C:\Windows\Tasks\update-sys.job => Moved successfully.
C:\Program Files (x86)\Skillbrains => Moved successfully.
The system needed a reboot.
==== End of Fixlog ====
Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff
Log created at 21:51 on 23/05/2014 by janni
Administrator - Elevation successful
========== dir ==========
========== folderfind ==========
Searching for "*Skillbrains*"
C:\FRST\Quarantine\C\Program Files (x86)\Skillbrains d------ [22:23 28/01/2014]
C:\Users\janni\AppData\Local\Skillbrains d------ [22:23 28/01/2014]
========== regfind ==========
Searching for "Skillbrains"
[HKEY_CURRENT_USER\Software\SkillBrains]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1]
"Inno Setup: App Path"="C:\Users\janni\AppData\Local\Skillbrains\lightshot"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1]
"InstallLocation"="C:\Users\janni\AppData\Local\Skillbrains\lightshot\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1]
"UninstallString"=""C:\Users\janni\AppData\Local\Skillbrains\lightshot\unins000.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1]
"QuietUninstallString"=""C:\Users\janni\AppData\Local\Skillbrains\lightshot\unins000.exe" /SILENT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1]
"Publisher"="Skillbrains"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SkillBrains]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SkillBrains\Updater]
"path"="C:\Program Files (x86)\Skillbrains\Updater\updater.exe"
[HKEY_USERS\S-1-5-21-792214429-3740351277-2917951772-1001\Software\SkillBrains]
-= EOF =-
So  Dann mal eine gute Nacht LG Jan |
|
24.05.2014, 14:55
| #6 |
| /// TB-Ausbilder | Windows 8.1 Adware , Trojaner verdacht , Websiten werden auf Werbung umgeleitet Reste entfernen Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
C:\Users\janni\AppData\Local\Skillbrains
C:\Users\janni\Desktop\O2BS2013DEMO.part1.rar
C:\Users\janni\Desktop\SpeedFan_TSA33T6OP.exe
C:\Users\janni\Desktop\O2BS2013DEMO
C:\Users\janni\Downloads\ClickHeretoDownloadSetup-cj7OWl2T*.exe
C:\Users\janni\Downloads\*CHIP-Downloader*.exe
C:\Users\janni\Downloads\MyPhoneExplorer*.exe
C:\Users\janni\Downloads\setup*.exe
C:\Windows\Installer\7c11e.msi
C:\Users\janni\Downloads\Free CD-Burner\CD-Burner.iso
Reg: reg delete "HKEY_CURRENT_USER\Software\SkillBrains" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SkillBrains" /f
Reboot:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Schritt 1 Du verwendest veraltete Software auf deinem Rechner, was ein Sicherheitsrisiko darstellt. Daher solltest du veraltete Software deinstallieren und anschließend die aktuellste Version installieren. Folge dem Pfad Start > Systemsteuerung > Sofware / Programme deinstallieren. Deinstalliere die folgenden Programme von deinem Rechner:
Downloade und installiere dir bitte nun:Starte deinen Rechner nach der Installation neu auf. Schritt 2 Die Reihenfolge ist hier entscheidend.
Schritt 3 Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti-Viren-Programm und zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden. Mozilla Firefox
Performance
Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
|
25.05.2014, 12:28
| #7 |
| | Windows 8.1 Adware , Trojaner verdacht , Websiten werden auf Werbung umgeleitet Erstmal vielen vielen Dank für deine Hilfe , es ist alles entfernt und bereinigt . Ich werde die Tipps an mich nehmen. LG : JAN |
|
25.05.2014, 13:18
| #8 |
| /// TB-Ausbilder | Windows 8.1 Adware , Trojaner verdacht , Websiten werden auf Werbung umgeleitet Ich bin froh, dass wir helfen konnten  In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest: Lob, Kritik und Wünsche Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen. |
|
Linear-Darstellung
