Hallo Zusammen,

seit kurzem ist mein Internet extrem langsam. Sobald ich einen Browser öffne ist der Downstream völlig ausgelastet, der Upstream ist allerdings normal.
Die Hardware habe ich schon geprüft und alles funktioniert.
Hier die gewünschten Logfiles.

FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-06-2014 01
Ran by admin (administrator) on PC on 01-06-2014 17:16:24
Running from C:\Users\admin\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Spotify Ltd) C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Akamai Technologies, Inc.) C:\Users\admin\AppData\Local\Akamai\netsession_win.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(Akamai Technologies, Inc.) C:\Users\admin\AppData\Local\Akamai\netsession_win.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Zune Launcher] => C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5181456 2014-05-13] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4330432 2014-02-15] (Emsisoft GmbH)
HKU\S-1-5-21-3912170589-447723747-2927474245-1000\...\Run: [Spotify Web Helper] => C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-19] (Spotify Ltd)
HKU\S-1-5-21-3912170589-447723747-2927474245-1000\...\Run: [Akamai NetSession Interface] => C:\Users\admin\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\guzxi5oy.default
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\guzxi5oy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-21]

==================== Services (Whitelisted) =================

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4163584 2014-02-15] (Emsisoft GmbH)
R2 avgfws; C:\Program Files (x86)\AVG\AVG2014\avgfws.exe [1473792 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3644432 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [292424 2014-05-13] (AVG Technologies CZ, s.r.o.)

==================== Drivers (Whitelisted) ====================

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [71472 2014-05-29] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [23088 2014-05-29] (Emsisoft GmbH)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-09-26] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [236312 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [191768 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [323352 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [130328 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [273176 2014-05-13] (AVG Technologies CZ, s.r.o.)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-01 17:16 - 2014-06-01 17:16 - 00008578 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-01 17:16 - 2014-06-01 17:16 - 00000000 ____D () C:\FRST
2014-06-01 17:15 - 2014-06-01 17:15 - 02067456 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2014-06-01 17:12 - 2014-06-01 17:12 - 00000472 _____ () C:\Users\admin\Downloads\defogger_disable.log
2014-06-01 17:12 - 2014-06-01 17:12 - 00000000 _____ () C:\Users\admin\defogger_reenable
2014-06-01 17:11 - 2014-06-01 17:11 - 00050477 _____ () C:\Users\admin\Downloads\Defogger.exe
2014-05-30 01:23 - 2014-05-30 01:23 - 01016261 _____ (Thisisu) C:\Users\admin\Downloads\JRT.exe
2014-05-30 01:22 - 2014-05-30 01:25 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-29 22:36 - 2014-06-01 16:59 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-05-29 22:36 - 2014-05-29 22:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-05-29 22:36 - 2014-05-29 22:36 - 00001097 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-05-29 22:36 - 2014-05-29 22:36 - 00000000 ____D () C:\Users\admin\Documents\Anti-Malware
2014-05-27 16:26 - 2014-05-30 00:29 - 00000000 ____D () C:\Users\admin\AppData\Roaming\vlc
2014-05-27 16:25 - 2014-05-27 16:25 - 00000877 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-27 16:25 - 2014-05-27 16:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-27 16:24 - 2014-05-27 16:24 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-27 16:16 - 2014-05-27 16:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-27 12:39 - 2014-05-27 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-05-27 12:30 - 2014-05-27 12:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-26 23:25 - 2013-05-10 07:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-05-26 23:25 - 2013-05-10 07:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-05-26 23:25 - 2013-05-10 06:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-05-26 23:25 - 2013-05-10 06:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-05-26 23:22 - 2014-05-28 01:08 - 01592096 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-05-26 18:26 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-26 18:26 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-05-26 18:26 - 2013-12-04 04:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-05-26 18:26 - 2013-12-04 04:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-05-26 18:26 - 2013-12-04 04:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-05-26 18:26 - 2013-12-04 04:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-05-26 18:26 - 2013-12-04 04:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-05-26 18:26 - 2013-12-04 04:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-05-26 18:26 - 2013-12-04 04:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-05-26 18:26 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-05-26 18:26 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-05-26 18:26 - 2013-12-04 04:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-05-26 18:26 - 2013-12-04 03:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-05-26 18:26 - 2013-12-04 03:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-05-26 18:26 - 2013-12-04 03:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-05-26 18:26 - 2013-12-04 03:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-05-26 18:25 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-05-26 18:25 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-05-26 18:23 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-05-26 18:23 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-05-26 18:23 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-05-26 18:23 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-05-26 18:23 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-05-26 18:23 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-05-26 18:18 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-05-26 18:18 - 2013-10-30 04:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2014-05-26 18:18 - 2013-10-30 04:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2014-05-26 18:12 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-05-26 18:12 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-05-26 18:07 - 2013-11-23 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-05-26 18:07 - 2013-11-23 19:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-05-26 18:06 - 2014-01-01 01:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-05-26 18:06 - 2014-01-01 01:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-05-26 18:03 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-05-19 21:06 - 2014-05-19 21:06 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-19 19:02 - 2014-05-19 21:22 - 00000000 ____D () C:\Users\admin\Documents\Studium
2014-05-19 18:34 - 2014-05-19 18:34 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-05-18 23:55 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-18 23:55 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-18 23:55 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-18 23:55 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-18 23:55 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-18 23:55 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-18 22:54 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-18 22:54 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-18 22:53 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-18 22:53 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-18 22:53 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-18 22:53 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-18 22:53 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-18 22:53 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-18 22:53 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-18 22:53 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-18 22:53 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-18 22:53 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-18 22:53 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-18 22:53 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-18 22:53 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-18 22:53 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-18 22:53 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-18 22:53 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-14 00:37 - 2014-05-14 00:37 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-13 14:20 - 2014-05-13 14:20 - 00273176 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
2014-05-13 14:20 - 2014-05-13 14:20 - 00235800 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2014-05-13 14:06 - 2014-05-13 14:06 - 00323352 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00191768 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00152344 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgdiska.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00130328 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00236312 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00031512 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgrkx64.sys
2014-05-10 16:27 - 2014-05-19 21:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-06-01 17:16 - 2014-06-01 17:16 - 00008578 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-01 17:16 - 2014-06-01 17:16 - 00000000 ____D () C:\FRST
2014-06-01 17:16 - 2013-11-11 09:15 - 00000000 ____D () C:\Users\admin\AppData\Local\Temp
2014-06-01 17:15 - 2014-06-01 17:15 - 02067456 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2014-06-01 17:12 - 2014-06-01 17:12 - 00000472 _____ () C:\Users\admin\Downloads\defogger_disable.log
2014-06-01 17:12 - 2014-06-01 17:12 - 00000000 _____ () C:\Users\admin\defogger_reenable
2014-06-01 17:12 - 2013-11-11 09:15 - 00000000 ____D () C:\Users\admin
2014-06-01 17:11 - 2014-06-01 17:11 - 00050477 _____ () C:\Users\admin\Downloads\Defogger.exe
2014-06-01 17:02 - 2009-07-14 06:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-01 17:02 - 2009-07-14 06:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-01 17:00 - 2014-01-06 23:05 - 00000000 ____D () C:\ProgramData\MFAData
2014-06-01 17:00 - 2013-11-11 09:07 - 01933655 _____ () C:\Windows\WindowsUpdate.log
2014-06-01 16:59 - 2014-05-29 22:36 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-06-01 16:54 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-01 16:54 - 2009-07-14 06:51 - 00034454 _____ () C:\Windows\setupact.log
2014-05-30 01:25 - 2014-05-30 01:22 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-30 01:23 - 2014-05-30 01:23 - 01016261 _____ (Thisisu) C:\Users\admin\Downloads\JRT.exe
2014-05-30 01:00 - 2010-11-21 05:47 - 00144052 _____ () C:\Windows\PFRO.log
2014-05-30 00:37 - 2014-01-06 23:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-30 00:29 - 2014-05-27 16:26 - 00000000 ____D () C:\Users\admin\AppData\Roaming\vlc
2014-05-29 22:37 - 2014-05-29 22:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-05-29 22:36 - 2014-05-29 22:36 - 00001097 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-05-29 22:36 - 2014-05-29 22:36 - 00000000 ____D () C:\Users\admin\Documents\Anti-Malware
2014-05-29 20:09 - 2014-04-16 02:50 - 00000000 ____D () C:\Program Files (x86)\Assassin's Creed 4 Black Flag Jackdaw Edition
2014-05-28 18:17 - 2014-01-08 16:49 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Spotify
2014-05-28 15:54 - 2014-01-08 16:49 - 00000000 ____D () C:\Users\admin\AppData\Local\Spotify
2014-05-28 01:08 - 2014-05-26 23:22 - 01592096 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-05-28 01:08 - 2011-04-12 09:26 - 00698960 _____ () C:\Windows\system32\perfh007.dat
2014-05-28 01:08 - 2011-04-12 09:26 - 00149100 _____ () C:\Windows\system32\perfc007.dat
2014-05-28 01:08 - 2009-07-14 07:13 - 01592096 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-27 18:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Web
2014-05-27 18:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-27 16:25 - 2014-05-27 16:25 - 00000877 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-27 16:25 - 2014-05-27 16:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-27 16:24 - 2014-05-27 16:24 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-27 16:18 - 2014-04-07 13:10 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-05-27 16:16 - 2014-05-27 16:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-27 15:06 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-27 15:03 - 2014-04-16 11:33 - 00001085 _____ () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-27 12:39 - 2014-05-27 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-05-27 12:33 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-05-27 12:30 - 2014-05-27 12:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-21 23:57 - 2014-04-07 12:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-05-19 21:22 - 2014-05-19 19:02 - 00000000 ____D () C:\Users\admin\Documents\Studium
2014-05-19 21:17 - 2013-11-11 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-19 21:06 - 2014-05-19 21:06 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-19 21:06 - 2014-05-10 16:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-19 21:06 - 2014-01-06 18:59 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Mozilla
2014-05-19 20:55 - 2013-12-12 00:42 - 00000000 ____D () C:\Users\admin\Documents\My Games
2014-05-19 18:34 - 2014-05-19 18:34 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-05-19 14:31 - 2014-01-06 23:12 - 00000987 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-05-19 14:19 - 2014-01-09 13:52 - 00000000 ___RD () C:\Users\admin\Podcasts
2014-05-19 14:19 - 2013-11-11 09:16 - 00000000 ___RD () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 14:19 - 2013-11-11 09:16 - 00000000 ___RD () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-19 14:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-18 23:54 - 2013-11-11 09:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-18 23:52 - 2013-11-11 09:31 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-18 23:16 - 2014-01-22 01:42 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-14 00:38 - 2014-01-06 23:06 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 00:38 - 2014-01-06 23:06 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 00:38 - 2014-01-06 23:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 00:37 - 2014-05-14 00:37 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-13 14:20 - 2014-05-13 14:20 - 00273176 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
2014-05-13 14:20 - 2014-05-13 14:20 - 00235800 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2014-05-13 14:06 - 2014-05-13 14:06 - 00323352 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00191768 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00152344 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgdiska.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00130328 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00236312 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00031512 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgrkx64.sys
2014-05-09 08:14 - 2014-05-26 18:26 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-26 18:26 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 06:40 - 2014-05-18 23:55 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-18 23:55 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-18 23:55 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-18 23:55 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-18 23:55 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-18 23:55 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-29 00:08

==================== End Of Log ============================
         

Addition:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-06-2014 01
Ran by admin at 2014-06-01 17:16:49
Running from C:\Users\admin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG Internet Security 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Emsisoft Anti-Malware (Enabled - Up to date) {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {3E653F0B-EA3E-10F8-1B87-CAD78F211367}
AS: AVG Internet Security 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: AVG Internet Security 2014 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

==================== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4592 - AVG Technologies)
AVG 2014 (Version: 14.0.3955 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4592 - AVG Technologies) Hidden
Combat Arms EU (HKLM-x32\...\Combat Arms EU) (Version:  - )
Emsisoft Anti-Malware (HKLM-x32\...\{BC30E5E7-047D-4232-A7E8-F2CB7CC7B2E0}_is1) (Version: 8.1 - Emsisoft GmbH)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Small Business 2007 (HKLM-x32\...\SMALLBUSINESSR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Small Business 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
Windows Mobile Device Updater Component (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
Zune (HKLM\...\Zune) (Version: 04.08.2345.00 - Microsoft Corporation)
Zune (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (CHS) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (CHT) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (CSY) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (DAN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (DEU) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (ELL) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (ESP) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (FIN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (FRA) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (HUN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (IND) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (ITA) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (JPN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (KOR) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (MSL) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (NLD) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (NOR) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (PLK) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (PTB) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (PTG) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (RUS) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (SVE) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

29-05-2014 19:12:34 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {7A5D973E-92C9-477E-8F54-BF0213974C89} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-05-19 21:06 - 2014-05-07 04:27 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-05-14 00:38 - 2014-05-14 00:38 - 16361136 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/01/2014 04:55:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/30/2014 01:13:41 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/30/2014 01:02:06 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/30/2014 01:01:35 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 8e4

Startzeit: 01cf7b91d5795ce9

Endzeit: 47

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: 293b9c20-e785-11e3-a9a6-0024e8468660

Error: (05/30/2014 00:42:33 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/29/2014 03:02:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/29/2014 02:32:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/28/2014 10:42:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 06:40:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 04:04:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (06/01/2014 04:54:14 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active

Error: (06/01/2014 04:54:14 PM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (05/30/2014 01:12:10 AM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active

Error: (05/30/2014 01:12:10 AM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (05/30/2014 01:00:35 AM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active

Error: (05/30/2014 01:00:35 AM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (05/30/2014 00:41:01 AM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active

Error: (05/30/2014 00:41:01 AM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (05/30/2014 00:37:08 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/29/2014 10:49:44 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 37%
Total physical RAM: 3965.59 MB
Available physical RAM: 2475.37 MB
Total Pagefile: 7929.37 MB
Available Pagefile: 5714.9 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:148.91 GB) (Free:110.92 GB) NTFS
Drive d: (Daten) (Fixed) (Total:465.76 GB) (Free:465.65 GB) NTFS
Drive g: (TOSHIBA EXT) (Fixed) (Total:931.41 GB) (Free:866.56 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: 98DEB064)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 0001E24B)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or Vista) (Size: 932 GB) (Disk ID: 54D8AF16)
Partition 1: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:12 on 01/06/2014 (admin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

GMER:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-01 17:30:07
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST316031 rev.CC44 149,01GB
Running: Gmer-19357.exe; Driver: C:\Users\admin\AppData\Local\Temp\pgddapow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                  fffff80002c03000 46 bytes [FF, F3, 48, 83, EC, 30, 48, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                  fffff80002c0302f 21 bytes {XOR R9D, R9D; XOR R8D, R8D; XOR EDX, EDX; XOR ECX, ECX; CALL 0xae799}

---- User code sections - GMER 2.1 ----

.text     C:\Windows\system32\taskhost.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                  0000000077b81510 6 bytes {JMP QWORD [RIP+0x85beb20]}
.text     C:\Windows\system32\taskhost.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                     0000000077b815e0 6 bytes {JMP QWORD [RIP+0x85fea50]}
.text     C:\Windows\system32\taskhost.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                   0000000077b81800 6 bytes {JMP QWORD [RIP+0x85de830]}
.text     C:\Windows\system32\taskhost.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                  0000000077b818b0 6 bytes {JMP QWORD [RIP+0x857e780]}
.text     C:\Windows\system32\taskhost.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                               0000000077b81e40 6 bytes {JMP QWORD [RIP+0x859e1f0]}
.text     C:\Windows\system32\taskhost.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                             0000000077b827e0 6 bytes {JMP QWORD [RIP+0x861d850]}
.text     C:\Windows\system32\taskhost.exe[1848] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                      000000007792db80 6 bytes {JMP QWORD [RIP+0x88924b0]}
.text     C:\Windows\system32\taskhost.exe[1848] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                      000007fefcaa9055 3 bytes CALL 79000026
.text     C:\Windows\system32\taskhost.exe[1848] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                              000007fefce555c8 6 bytes {JMP QWORD [RIP+0xe8aa68]}
.text     C:\Windows\system32\taskhost.exe[1848] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                              000007fefce6b85c 6 bytes {JMP QWORD [RIP+0xe547d4]}
.text     C:\Windows\system32\Dwm.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                       0000000077b81510 6 bytes {JMP QWORD [RIP+0x85beb20]}
.text     C:\Windows\system32\Dwm.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                          0000000077b815e0 6 bytes {JMP QWORD [RIP+0x85fea50]}
.text     C:\Windows\system32\Dwm.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                        0000000077b81800 6 bytes {JMP QWORD [RIP+0x85de830]}
.text     C:\Windows\system32\Dwm.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                       0000000077b818b0 6 bytes {JMP QWORD [RIP+0x857e780]}
.text     C:\Windows\system32\Dwm.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                    0000000077b81e40 6 bytes {JMP QWORD [RIP+0x859e1f0]}
.text     C:\Windows\system32\Dwm.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                  0000000077b827e0 6 bytes {JMP QWORD [RIP+0x861d850]}
.text     C:\Windows\system32\Dwm.exe[2284] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                           000000007792db80 6 bytes {JMP QWORD [RIP+0x88924b0]}
.text     C:\Windows\system32\Dwm.exe[2284] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                           000007fefcaa9055 3 bytes CALL 9000027
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                           0000000077b81510 6 bytes {JMP QWORD [RIP+0x85beb20]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                              0000000077b815e0 6 bytes {JMP QWORD [RIP+0x85fea50]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                            0000000077b81800 6 bytes {JMP QWORD [RIP+0x85de830]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                           0000000077b818b0 6 bytes {JMP QWORD [RIP+0x857e780]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                        0000000077b81e40 6 bytes {JMP QWORD [RIP+0x859e1f0]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                      0000000077b827e0 6 bytes {JMP QWORD [RIP+0x861d850]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                               000000007792db80 6 bytes JMP 1a
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                               000007fefcaa9055 3 bytes CALL 9000027
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\system32\msi.dll!MsiSetInternalUI                                                          000007fef6c45cd0 6 bytes {JMP QWORD [RIP+0xbca360]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\system32\msi.dll!MsiInstallProductA                                                        000007fef6cc0f20 6 bytes {JMP QWORD [RIP+0x33f110]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\system32\msi.dll!MsiInstallProductW                                                        000007fef6ccfaa8 6 bytes {JMP QWORD [RIP+0xb60588]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA                                                    000007fef86a7b34 6 bytes {JMP QWORD [RIP+0xa84fc]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW                                                    000007fef86b03c0 6 bytes {JMP QWORD [RIP+0x10fc70]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW                                                 000007fefe873030 6 bytes {JMP QWORD [RIP+0x63d000]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\system32\WS2_32.dll!connect + 1                                                            000007fefe8745c1 5 bytes {JMP QWORD [RIP+0x5fba70]}
.text     C:\Windows\Explorer.EXE[2356] C:\Windows\system32\WS2_32.dll!listen                                                                 000007fefe878290 6 bytes {JMP QWORD [RIP+0x617da0]}
.text     C:\Program Files\Zune\ZuneLauncher.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077b81510 6 bytes {JMP QWORD [RIP+0x85beb20]}
.text     C:\Program Files\Zune\ZuneLauncher.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                               0000000077b815e0 6 bytes {JMP QWORD [RIP+0x85fea50]}
.text     C:\Program Files\Zune\ZuneLauncher.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                             0000000077b81800 6 bytes {JMP QWORD [RIP+0x85de830]}
.text     C:\Program Files\Zune\ZuneLauncher.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                            0000000077b818b0 6 bytes {JMP QWORD [RIP+0x857e780]}
.text     C:\Program Files\Zune\ZuneLauncher.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                         0000000077b81e40 6 bytes {JMP QWORD [RIP+0x859e1f0]}
.text     C:\Program Files\Zune\ZuneLauncher.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000077b827e0 6 bytes {JMP QWORD [RIP+0x861d850]}
.text     C:\Program Files\Zune\ZuneLauncher.exe[2472] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                000000007792db80 6 bytes {JMP QWORD [RIP+0x88924b0]}
.text     C:\Program Files\Zune\ZuneLauncher.exe[2472] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                000007fefcaa9055 3 bytes CALL 9000027
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                  0000000077d2fc20 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4              0000000077d2fc24 2 bytes [80, 71]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                     0000000077d2fd64 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                 0000000077d2fd68 2 bytes [7A, 71]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                   0000000077d300b4 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4               0000000077d300b8 2 bytes [7D, 71]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                  0000000077d301c4 3 bytes JMP 7187000a
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4              0000000077d301c8 2 bytes JMP 7187000a
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey               0000000077d30a44 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4           0000000077d30a48 2 bytes [83, 71]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread             0000000077d31920 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4         0000000077d31924 2 bytes [77, 71]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW      0000000075af3bbb 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4  0000000075af3bbf 2 bytes [74, 71]
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493      0000000075812c9e 4 bytes {CALL QWORD [RIP+0x71af000a]}
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\USER32.dll!SendMessageW                  0000000076429679 6 bytes {JMP QWORD [RIP+0x7195001e]}
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\USER32.dll!PostMessageW                  00000000764312a5 6 bytes {JMP QWORD [RIP+0x718f001e]}
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\USER32.dll!PostMessageA                  0000000076433baa 6 bytes {JMP QWORD [RIP+0x7192001e]}
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\USER32.dll!SendMessageA                  000000007643612e 6 bytes {JMP QWORD [RIP+0x7198001e]}
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\USER32.dll!SendInput                     000000007644ff4a 3 bytes JMP 719c000a
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\USER32.dll!SendInput + 4                 000000007644ff4e 2 bytes JMP 719c000a
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\USER32.dll!mouse_event                   000000007648027b 6 bytes JMP 71a2000a
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\USER32.dll!keybd_event                   00000000764802bf 6 bytes {JMP QWORD [RIP+0x719e001e]}
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW              00000000758770c4 6 bytes {JMP QWORD [RIP+0x7189001e]}
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA              0000000075893264 6 bytes {JMP QWORD [RIP+0x718c001e]}
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW        0000000075a9575a 6 bytes {JMP QWORD [RIP+0x71a4001e]}
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\WS2_32.dll!connect                       0000000075a96bdd 6 bytes {JMP QWORD [RIP+0x71aa001e]}
.text     C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2508] C:\Windows\syswow64\WS2_32.dll!listen                        0000000075a9b001 6 bytes {JMP QWORD [RIP+0x71a7001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                            0000000077d2fc20 3 bytes JMP 7181000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                        0000000077d2fc24 2 bytes JMP 7181000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                               0000000077d2fd64 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                           0000000077d2fd68 2 bytes [7A, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                             0000000077d300b4 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                         0000000077d300b8 2 bytes [7D, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                            0000000077d301c4 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                        0000000077d301c8 2 bytes [86, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                         0000000077d30a44 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                     0000000077d30a48 2 bytes [83, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                       0000000077d31920 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                   0000000077d31924 2 bytes [77, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                0000000075af3bbb 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4            0000000075af3bbf 2 bytes [74, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                0000000075812c9e 4 bytes {CALL QWORD [RIP+0x71af000a]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\USER32.dll!SendMessageW                            0000000076429679 6 bytes JMP 7196000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\USER32.dll!PostMessageW                            00000000764312a5 6 bytes JMP 7190000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\USER32.dll!PostMessageA                            0000000076433baa 6 bytes {JMP QWORD [RIP+0x7192001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\USER32.dll!SendMessageA                            000000007643612e 6 bytes {JMP QWORD [RIP+0x7198001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\USER32.dll!SendInput                               000000007644ff4a 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\USER32.dll!SendInput + 4                           000000007644ff4e 2 bytes [9B, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\USER32.dll!mouse_event                             000000007648027b 6 bytes {JMP QWORD [RIP+0x71a1001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\USER32.dll!keybd_event                             00000000764802bf 6 bytes JMP 719f000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                        00000000758770c4 6 bytes {JMP QWORD [RIP+0x7189001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                        0000000075893264 6 bytes {JMP QWORD [RIP+0x718c001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW                  0000000075a9575a 6 bytes {JMP QWORD [RIP+0x71a4001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\WS2_32.dll!connect                                 0000000075a96bdd 6 bytes {JMP QWORD [RIP+0x71aa001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\WS2_32.dll!listen                                  0000000075a9b001 6 bytes {JMP QWORD [RIP+0x71a7001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                0000000076901465 2 bytes [90, 76]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155               00000000769014bb 2 bytes [90, 76]
.text     ...                                                                                                                                 * 2
.text     C:\Program Files (x86)\AVG\AVG2014\avgui.exe[2628] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                          0000000075af3bbb 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\AVG\AVG2014\avgui.exe[2628] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                      0000000075af3bbf 2 bytes [74, 71]
.text     C:\Program Files (x86)\AVG\AVG2014\avgui.exe[2628] C:\Windows\syswow64\USER32.dll!SendMessageW                                      0000000076429679 6 bytes JMP 7196000a
.text     C:\Program Files (x86)\AVG\AVG2014\avgui.exe[2628] C:\Windows\syswow64\USER32.dll!PostMessageW                                      00000000764312a5 6 bytes JMP 7190000a
.text     C:\Program Files (x86)\AVG\AVG2014\avgui.exe[2628] C:\Windows\syswow64\USER32.dll!PostMessageA                                      0000000076433baa 6 bytes {JMP QWORD [RIP+0x7192001e]}
.text     C:\Program Files (x86)\AVG\AVG2014\avgui.exe[2628] C:\Windows\syswow64\USER32.dll!SendMessageA                                      000000007643612e 6 bytes {JMP QWORD [RIP+0x7198001e]}
.text     C:\Program Files (x86)\AVG\AVG2014\avgui.exe[2628] C:\Windows\syswow64\USER32.dll!SendInput                                         000000007644ff4a 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\AVG\AVG2014\avgui.exe[2628] C:\Windows\syswow64\USER32.dll!SendInput + 4                                     000000007644ff4e 2 bytes [9B, 71]
.text     C:\Program Files (x86)\AVG\AVG2014\avgui.exe[2628] C:\Windows\syswow64\USER32.dll!mouse_event                                       000000007648027b 6 bytes {JMP QWORD [RIP+0x71a1001e]}
.text     C:\Program Files (x86)\AVG\AVG2014\avgui.exe[2628] C:\Windows\syswow64\USER32.dll!keybd_event                                       00000000764802bf 6 bytes {JMP QWORD [RIP+0x719e001e]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                  0000000077d2fc20 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4              0000000077d2fc24 2 bytes [89, 71]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                     0000000077d2fd64 3 bytes JMP 7184000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                 0000000077d2fd68 2 bytes JMP 7184000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                   0000000077d300b4 3 bytes JMP 7187000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4               0000000077d300b8 2 bytes JMP 7187000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                  0000000077d301c4 3 bytes JMP 7190000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4              0000000077d301c8 2 bytes JMP 7190000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey               0000000077d30a44 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4           0000000077d30a48 2 bytes [8C, 71]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread             0000000077d31920 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4         0000000077d31924 2 bytes [80, 71]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW      0000000075af3bbb 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4  0000000075af3bbf 2 bytes [7D, 71]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493      0000000075812c9e 4 bytes CALL 71af0000
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW              00000000758770c4 6 bytes {JMP QWORD [RIP+0x7192001e]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA              0000000075893264 6 bytes {JMP QWORD [RIP+0x7195001e]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\USER32.dll!SendMessageW                  0000000076429679 6 bytes {JMP QWORD [RIP+0x719e001e]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\USER32.dll!PostMessageW                  00000000764312a5 6 bytes {JMP QWORD [RIP+0x7198001e]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\USER32.dll!PostMessageA                  0000000076433baa 6 bytes {JMP QWORD [RIP+0x719b001e]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\USER32.dll!SendMessageA                  000000007643612e 6 bytes {JMP QWORD [RIP+0x71a1001e]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\USER32.dll!SendInput                     000000007644ff4a 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\USER32.dll!SendInput + 4                 000000007644ff4e 2 bytes [A4, 71]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\USER32.dll!mouse_event                   000000007648027b 6 bytes {JMP QWORD [RIP+0x71aa001e]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2740] C:\Windows\syswow64\USER32.dll!keybd_event                   00000000764802bf 6 bytes {JMP QWORD [RIP+0x71a7001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                            0000000077d2fc20 3 bytes JMP 7181000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                        0000000077d2fc24 2 bytes JMP 7181000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                               0000000077d2fd64 3 bytes JMP 717b000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                           0000000077d2fd68 2 bytes JMP 717b000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                             0000000077d300b4 3 bytes JMP 717e000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                         0000000077d300b8 2 bytes JMP 717e000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                            0000000077d301c4 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                        0000000077d301c8 2 bytes [86, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                         0000000077d30a44 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                     0000000077d30a48 2 bytes [83, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                       0000000077d31920 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                   0000000077d31924 2 bytes [77, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                0000000075af3bbb 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4            0000000075af3bbf 2 bytes [74, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                0000000075812c9e 4 bytes CALL 71af0000
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\USER32.dll!SendMessageW                            0000000076429679 6 bytes {JMP QWORD [RIP+0x7195001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\USER32.dll!PostMessageW                            00000000764312a5 6 bytes {JMP QWORD [RIP+0x718f001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\USER32.dll!PostMessageA                            0000000076433baa 6 bytes {JMP QWORD [RIP+0x7192001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\USER32.dll!SendMessageA                            000000007643612e 6 bytes {JMP QWORD [RIP+0x7198001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\USER32.dll!SendInput                               000000007644ff4a 3 bytes [FF, 25, 1E]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\USER32.dll!SendInput + 4                           000000007644ff4e 2 bytes [9B, 71]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\USER32.dll!mouse_event                             000000007648027b 6 bytes {JMP QWORD [RIP+0x71a1001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\USER32.dll!keybd_event                             00000000764802bf 6 bytes {JMP QWORD [RIP+0x719e001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                        00000000758770c4 6 bytes {JMP QWORD [RIP+0x7189001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                        0000000075893264 6 bytes {JMP QWORD [RIP+0x718c001e]}
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW                  0000000075a9575a 6 bytes JMP 71a5000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\WS2_32.dll!connect                                 0000000075a96bdd 6 bytes JMP 71ab000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\WS2_32.dll!listen                                  0000000075a9b001 6 bytes JMP 71a8000a
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                0000000076901465 2 bytes [90, 76]
.text     C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[2856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155               00000000769014bb 2 bytes [90, 76]
.text     ...                                                                                                                                 * 2
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                    0000000077d2fc20 3 bytes [FF, 25, 1E]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                0000000077d2fc24 2 bytes [89, 71]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                       0000000077d2fd64 3 bytes JMP 7184000a
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                   0000000077d2fd68 2 bytes JMP 7184000a
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                     0000000077d300b4 3 bytes JMP 7187000a
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                 0000000077d300b8 2 bytes JMP 7187000a
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                    0000000077d301c4 3 bytes [FF, 25, 1E]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                0000000077d301c8 2 bytes [8F, 71]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                 0000000077d30a44 3 bytes [FF, 25, 1E]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                             0000000077d30a48 2 bytes [8C, 71]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                               0000000077d31920 3 bytes [FF, 25, 1E]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                           0000000077d31924 2 bytes [80, 71]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                        0000000075af3bbb 3 bytes [FF, 25, 1E]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                    0000000075af3bbf 2 bytes [7D, 71]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                        0000000075812c9e 4 bytes CALL 71af0000
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\USER32.dll!SendMessageW                                                    0000000076429679 6 bytes {JMP QWORD [RIP+0x719e001e]}
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\USER32.dll!PostMessageW                                                    00000000764312a5 6 bytes JMP 7199000a
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\USER32.dll!PostMessageA                                                    0000000076433baa 6 bytes {JMP QWORD [RIP+0x719b001e]}
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\USER32.dll!SendMessageA                                                    000000007643612e 6 bytes {JMP QWORD [RIP+0x71a1001e]}
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\USER32.dll!SendInput                                                       000000007644ff4a 3 bytes [FF, 25, 1E]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                   000000007644ff4e 2 bytes [A4, 71]
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\USER32.dll!mouse_event                                                     000000007648027b 6 bytes {JMP QWORD [RIP+0x71aa001e]}
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\USER32.dll!keybd_event                                                     00000000764802bf 6 bytes {JMP QWORD [RIP+0x71a7001e]}
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                00000000758770c4 6 bytes {JMP QWORD [RIP+0x7192001e]}
.text     C:\Windows\SysWOW64\ctfmon.exe[3568] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                0000000075893264 6 bytes JMP 7196000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                           0000000077d2fc20 3 bytes JMP 718a000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                       0000000077d2fc24 2 bytes JMP 718a000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                              0000000077d2fd64 3 bytes JMP 7184000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                          0000000077d2fd68 2 bytes JMP 7184000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                            0000000077d300b4 3 bytes JMP 7187000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                        0000000077d300b8 2 bytes JMP 7187000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                           0000000077d301c4 3 bytes JMP 7190000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                       0000000077d301c8 2 bytes JMP 7190000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                        0000000077d30a44 3 bytes JMP 718d000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                    0000000077d30a48 2 bytes JMP 718d000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                      0000000077d31920 3 bytes JMP 7181000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                  0000000077d31924 2 bytes JMP 7181000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                               0000000075af3bbb 3 bytes JMP 717e000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                           0000000075af3bbf 2 bytes JMP 717e000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                               0000000075812c9e 4 bytes CALL 71af0000
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\USER32.dll!SendMessageW                                           0000000076429679 6 bytes JMP 719f000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\USER32.dll!PostMessageW                                           00000000764312a5 6 bytes JMP 7199000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\USER32.dll!PostMessageA                                           0000000076433baa 6 bytes JMP 719c000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\USER32.dll!SendMessageA                                           000000007643612e 6 bytes JMP 71a2000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\USER32.dll!SendInput                                              000000007644ff4a 3 bytes JMP 71a5000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\USER32.dll!SendInput + 4                                          000000007644ff4e 2 bytes JMP 71a5000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\USER32.dll!mouse_event                                            000000007648027b 6 bytes JMP 71ab000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\USER32.dll!keybd_event                                            00000000764802bf 6 bytes JMP 71a8000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                       00000000758770c4 6 bytes JMP 7193000a
.text     C:\Users\admin\Downloads\Gmer-19357.exe[2120] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                       0000000075893264 6 bytes JMP 7196000a

---- EOF - GMER 2.1 ----
         

Danke schonmal für die Hilfe!

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

combofix.txt

ComboFix 14-05-29.01 - admin 01.06.2014  23:23:47.1.2 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3966.2406 [GMT 2:00]
ausgeführt von:: c:\users\admin\Downloads\ComboFix.exe
AV: AVG Internet Security 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Emsisoft Anti-Malware *Disabled/Updated* {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
FW: AVG Internet Security 2014 *Enabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
SP: AVG Internet Security 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Emsisoft Anti-Malware *Disabled/Updated* {3E653F0B-EA3E-10F8-1B87-CAD78F211367}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-05-01 bis 2014-06-01  ))))))))))))))))))))))))))))))
.
.
2014-06-01 21:28 . 2014-06-01 21:28	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-06-01 15:16 . 2014-06-01 15:17	--------	d-----w-	C:\FRST
2014-05-29 20:36 . 2014-06-01 21:20	--------	d-----w-	c:\program files (x86)\Emsisoft Anti-Malware
2014-05-27 14:26 . 2014-05-29 22:29	--------	d-----w-	c:\users\admin\AppData\Roaming\vlc
2014-05-27 14:24 . 2014-05-27 14:24	--------	d-----w-	c:\program files\VideoLAN
2014-05-27 14:16 . 2014-05-27 14:16	--------	d-----w-	c:\programdata\Malwarebytes
2014-05-27 10:30 . 2014-05-27 10:30	--------	d-s---w-	c:\windows\system32\CompatTel
2014-05-26 21:25 . 2013-05-10 05:56	12625920	----a-w-	c:\windows\system32\wmploc.DLL
2014-05-26 21:25 . 2013-05-10 04:30	167424	----a-w-	c:\program files\Windows Media Player\wmplayer.exe
2014-05-26 21:25 . 2013-05-10 03:48	164864	----a-w-	c:\program files (x86)\Windows Media Player\wmplayer.exe
2014-05-26 21:25 . 2013-05-10 04:56	12625408	----a-w-	c:\windows\SysWow64\wmploc.DLL
2014-05-26 21:25 . 2013-05-10 05:56	14631424	----a-w-	c:\windows\system32\wmp.dll
2014-05-26 21:20 . 2014-05-26 21:20	--------	d-----w-	c:\windows\Migration
2014-05-26 16:25 . 2014-01-09 02:22	5694464	----a-w-	c:\windows\SysWow64\mstscax.dll
2014-05-26 16:25 . 2014-01-03 22:44	6574592	----a-w-	c:\windows\system32\mstscax.dll
2014-05-26 16:23 . 2014-02-04 02:35	190912	----a-w-	c:\windows\system32\drivers\storport.sys
2014-05-26 16:23 . 2014-02-04 02:35	274880	----a-w-	c:\windows\system32\drivers\msiscsi.sys
2014-05-26 16:23 . 2014-02-04 02:35	27584	----a-w-	c:\windows\system32\drivers\Diskdump.sys
2014-05-26 16:23 . 2014-02-04 02:00	2048	----a-w-	c:\windows\SysWow64\iologmsg.dll
2014-05-26 16:23 . 2014-02-04 02:28	2048	----a-w-	c:\windows\system32\iologmsg.dll
2014-05-26 16:23 . 2014-01-24 02:37	1684928	----a-w-	c:\windows\system32\drivers\ntfs.sys
2014-05-26 16:18 . 2013-10-30 02:32	335360	----a-w-	c:\windows\system32\msieftp.dll
2014-05-26 16:18 . 2013-10-30 02:19	301568	----a-w-	c:\windows\SysWow64\msieftp.dll
2014-05-26 16:18 . 2014-01-28 02:32	228864	----a-w-	c:\windows\system32\wwansvc.dll
2014-05-26 16:12 . 2014-02-04 02:32	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-05-26 16:12 . 2014-02-04 02:04	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-05-26 16:07 . 2013-11-23 18:26	417792	----a-w-	c:\windows\SysWow64\WMPhoto.dll
2014-05-26 16:07 . 2013-11-23 17:47	465920	----a-w-	c:\windows\system32\WMPhoto.dll
2014-05-26 16:03 . 2013-11-26 11:40	376768	----a-w-	c:\windows\system32\drivers\netio.sys
2014-05-19 19:06 . 2014-05-19 19:06	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2014-05-19 16:34 . 2014-05-19 16:34	--------	d-----w-	c:\windows\system32\appmgmt
2014-05-18 21:55 . 2014-05-06 04:40	23544320	----a-w-	c:\windows\system32\mshtml.dll
2014-05-18 21:55 . 2014-05-06 03:00	84992	----a-w-	c:\windows\system32\mshtmled.dll
2014-05-18 21:55 . 2014-05-06 04:17	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-05-18 21:55 . 2014-05-06 03:07	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2014-05-18 20:54 . 2014-03-25 02:43	14175744	----a-w-	c:\windows\system32\shell32.dll
2014-05-13 22:37 . 2014-05-13 22:37	17938608	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-05-13 12:20 . 2014-05-13 12:20	235800	----a-w-	c:\windows\system32\drivers\avgldx64.sys
2014-05-13 12:20 . 2014-05-13 12:20	273176	----a-w-	c:\windows\system32\drivers\avgtdia.sys
2014-05-13 12:06 . 2014-05-13 12:06	323352	----a-w-	c:\windows\system32\drivers\avgloga.sys
2014-05-13 12:05 . 2014-05-13 12:05	191768	----a-w-	c:\windows\system32\drivers\avgidsha.sys
2014-05-13 12:05 . 2014-05-13 12:05	152344	----a-w-	c:\windows\system32\drivers\avgdiska.sys
2014-05-13 12:05 . 2014-05-13 12:05	130328	----a-w-	c:\windows\system32\drivers\avgmfx64.sys
2014-05-13 12:04 . 2014-05-13 12:04	236312	----a-w-	c:\windows\system32\drivers\avgidsdrivera.sys
2014-05-13 12:04 . 2014-05-13 12:04	31512	----a-w-	c:\windows\system32\drivers\avgrkx64.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-18 21:52 . 2013-11-11 07:31	93223848	----a-w-	c:\windows\system32\MRT.exe
2014-05-13 22:38 . 2014-01-06 21:06	70832	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-13 22:38 . 2014-01-06 21:06	692400	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-16 09:47 . 2014-04-16 09:47	248672	----a-w-	c:\windows\system32\d3dx11_43.dll
2014-04-16 09:16 . 2014-04-16 09:16	2106216	----a-w-	c:\windows\SysWow64\D3DCompiler_43.dll
2014-04-07 12:45 . 2014-04-07 12:45	61120	----a-w-	c:\windows\system32\drivers\wStLibG64.sys
2014-03-31 20:46 . 2014-03-31 20:46	130712	----a-w-	c:\windows\SysWow64\MSSTDFMT.DLL
2014-03-31 20:46 . 2014-03-31 20:46	1070232	----a-w-	c:\windows\SysWow64\MSCOMCTL.OCX
2014-03-17 20:11 . 2014-04-16 09:29	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-03-06 09:31 . 2014-04-23 07:17	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-03-06 08:59 . 2014-04-23 07:17	66048	----a-w-	c:\windows\system32\iesetup.dll
2014-03-06 08:57 . 2014-04-23 07:17	548352	----a-w-	c:\windows\system32\vbscript.dll
2014-03-06 08:57 . 2014-04-23 07:17	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2014-03-06 08:53 . 2014-04-23 07:17	2767360	----a-w-	c:\windows\system32\iertutil.dll
2014-03-06 08:40 . 2014-04-23 07:17	51200	----a-w-	c:\windows\system32\jsproxy.dll
2014-03-06 08:39 . 2014-04-23 07:17	33792	----a-w-	c:\windows\system32\iernonce.dll
2014-03-06 08:32 . 2014-04-23 07:17	574976	----a-w-	c:\windows\system32\ieui.dll
2014-03-06 08:29 . 2014-04-23 07:17	139264	----a-w-	c:\windows\system32\ieUnatt.exe
2014-03-06 08:29 . 2014-04-23 07:17	111616	----a-w-	c:\windows\system32\ieetwcollector.exe
2014-03-06 08:28 . 2014-04-23 07:17	752640	----a-w-	c:\windows\system32\jscript9diag.dll
2014-03-06 08:15 . 2014-04-23 07:17	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-06 08:11 . 2014-04-23 07:17	5784064	----a-w-	c:\windows\system32\jscript9.dll
2014-03-06 08:09 . 2014-04-23 07:17	453120	----a-w-	c:\windows\system32\dxtmsft.dll
2014-03-06 08:03 . 2014-04-23 07:17	586240	----a-w-	c:\windows\system32\ie4uinit.exe
2014-03-06 08:02 . 2014-04-23 07:17	61952	----a-w-	c:\windows\SysWow64\iesetup.dll
2014-03-06 08:02 . 2014-04-23 07:17	455168	----a-w-	c:\windows\SysWow64\vbscript.dll
2014-03-06 08:01 . 2014-04-23 07:17	51200	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2014-03-06 07:56 . 2014-04-23 07:17	38400	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2014-03-06 07:48 . 2014-04-23 07:17	195584	----a-w-	c:\windows\system32\msrating.dll
2014-03-06 07:46 . 2014-04-23 07:17	4254720	----a-w-	c:\windows\SysWow64\jscript9.dll
2014-03-06 07:42 . 2014-04-23 07:17	296960	----a-w-	c:\windows\system32\dxtrans.dll
2014-03-06 07:38 . 2014-04-23 07:17	112128	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2014-03-06 07:36 . 2014-04-23 07:17	592896	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2014-03-06 07:21 . 2014-04-23 07:17	628736	----a-w-	c:\windows\system32\msfeeds.dll
2014-03-06 07:13 . 2014-04-23 07:17	32256	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-03-06 07:11 . 2014-04-23 07:17	2043904	----a-w-	c:\windows\system32\inetcpl.cpl
2014-03-06 06:53 . 2014-04-23 07:17	13551104	----a-w-	c:\windows\system32\ieframe.dll
2014-03-06 06:40 . 2014-04-23 07:17	1967104	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2014-03-06 06:22 . 2014-04-23 07:17	2260480	----a-w-	c:\windows\system32\wininet.dll
2014-03-06 05:58 . 2014-04-23 07:17	1400832	----a-w-	c:\windows\system32\urlmon.dll
2014-03-06 05:50 . 2014-04-23 07:17	846336	----a-w-	c:\windows\system32\ieapfltr.dll
2014-03-06 05:41 . 2014-04-23 07:17	1789440	----a-w-	c:\windows\SysWow64\wininet.dll
2014-03-04 09:44 . 2014-04-10 07:51	362496	----a-w-	c:\windows\system32\wow64win.dll
2014-03-04 09:44 . 2014-04-10 07:51	243712	----a-w-	c:\windows\system32\wow64.dll
2014-03-04 09:44 . 2014-04-10 07:51	13312	----a-w-	c:\windows\system32\wow64cpu.dll
2014-03-04 09:44 . 2014-04-10 07:51	16384	----a-w-	c:\windows\system32\ntvdm64.dll
2014-03-04 09:44 . 2014-04-10 07:51	1163264	----a-w-	c:\windows\system32\kernel32.dll
2014-03-04 09:17 . 2014-04-10 07:51	14336	----a-w-	c:\windows\SysWow64\ntvdm64.dll
2014-03-04 09:17 . 2014-04-10 07:51	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2014-03-04 09:16 . 2014-04-10 07:51	25600	----a-w-	c:\windows\SysWow64\setup16.exe
2014-03-04 09:16 . 2014-04-10 07:51	5120	----a-w-	c:\windows\SysWow64\wow32.dll
2014-03-04 08:09 . 2014-04-10 07:51	7680	----a-w-	c:\windows\SysWow64\instnm.exe
2014-03-04 08:09 . 2014-04-10 07:51	2048	----a-w-	c:\windows\SysWow64\user.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="c:\users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-05-19 1176632]
"Akamai NetSession Interface"="c:\users\admin\AppData\Local\Akamai\netsession_win.exe" [2014-04-17 4672920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVG_UI"="c:\program files (x86)\AVG\AVG2014\avgui.exe" [2014-05-13 5181456]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"emsisoft anti-malware"="c:\program files (x86)\emsisoft anti-malware\a2guard.exe" [2014-02-15 4330432]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [x]
S1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [x]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [x]
S1 Avgdiska;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiska.sys;c:\windows\SYSNATIVE\DRIVERS\avgdiska.sys [x]
S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6a.sys;c:\windows\SYSNATIVE\DRIVERS\avgfwd6a.sys [x]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 8.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 avgfws;AVG Firewall;c:\program files (x86)\AVG\AVG2014\avgfws.exe;c:\program files (x86)\AVG\AVG2014\avgfws.exe [x]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe [x]
S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [x]
S3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - PGDDAPOW
*Deregistered* - pgddapow
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-06 22:38]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2011-08-05 163552]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.t-online.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\guzxi5oy.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.t-online.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-06-01  23:31:13
ComboFix-quarantined-files.txt  2014-06-01 21:31
.
Vor Suchlauf: 8 Verzeichnis(se), 117.949.022.208 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 117.657.317.376 Bytes frei
.
- - End Of File - - B1B7878B6DFE308339C2B4F539D7F1B2
A36C5E4F47E84449FF07ED3517B43A31
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

mbam.txt

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 02.06.2014
Suchlauf-Zeit: 22:21:44
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.02.07
Rootkit Datenbank: v2014.05.21.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: admin

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 268179
Verstrichene Zeit: 7 Min, 42 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
         

adwcleaner

# AdwCleaner v3.211 - Bericht erstellt am 02/06/2014 um 22:41:19
# Aktualisiert 26/05/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : admin - PC
# Gestartet von : C:\Users\admin\Downloads\adwcleaner_3.211.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v29.0.1 (de)

[ Datei : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\guzxi5oy.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [863 octets] - [02/06/2014 22:34:45]
AdwCleaner[S0].txt - [785 octets] - [02/06/2014 22:41:19]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [844 octets] ##########
         

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by admin on 03.06.2014 at  0:20:51,96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\sitefinder"



~~~ FireFox

Emptied folder: C:\Users\admin\AppData\Roaming\mozilla\firefox\profiles\guzxi5oy.default\minidumps [5 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.06.2014 at  0:34:44,90
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

frst.txt


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by admin (administrator) on PC on 03-06-2014 00:43:46
Running from C:\Users\admin\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Spotify Ltd) C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Akamai Technologies, Inc.) C:\Users\admin\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Akamai Technologies, Inc.) C:\Users\admin\AppData\Local\Akamai\netsession_win.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Zune Launcher] => C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5181456 2014-05-13] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4330432 2014-02-15] (Emsisoft GmbH)
HKU\S-1-5-21-3912170589-447723747-2927474245-1000\...\Run: [Spotify Web Helper] => C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-19] (Spotify Ltd)
HKU\S-1-5-21-3912170589-447723747-2927474245-1000\...\Run: [Akamai NetSession Interface] => C:\Users\admin\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\guzxi5oy.default
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\guzxi5oy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-21]

==================== Services (Whitelisted) =================

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4163584 2014-02-15] (Emsisoft GmbH)
R2 avgfws; C:\Program Files (x86)\AVG\AVG2014\avgfws.exe [1473792 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3644432 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [292424 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [71472 2014-05-29] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [23088 2014-05-29] (Emsisoft GmbH)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-09-26] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [236312 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [191768 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [323352 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [130328 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [273176 2014-05-13] (AVG Technologies CZ, s.r.o.)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-02] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-03 00:43 - 2014-06-03 00:43 - 00000000 ____D () C:\Users\admin\Downloads\FRST-OlderVersion
2014-06-03 00:34 - 2014-06-03 00:34 - 00000826 _____ () C:\Users\admin\Desktop\JRT.txt
2014-06-03 00:20 - 2014-06-03 00:20 - 00000000 ____D () C:\Windows\ERUNT
2014-06-03 00:19 - 2014-06-03 00:19 - 00002134 _____ () C:\Users\admin\Desktop\Junkware Removal Tool - CHIP Downloader.lnk
2014-06-03 00:16 - 2014-06-03 00:16 - 00961360 _____ (Chip Digital GmbH) C:\Users\admin\Downloads\Junkware Removal Tool - CHIP-Installer.exe
2014-06-02 22:34 - 2014-06-02 22:41 - 00000000 ____D () C:\AdwCleaner
2014-06-02 22:34 - 2014-06-02 22:34 - 00001156 _____ () C:\mbam.txt
2014-06-02 22:19 - 2014-06-02 22:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-02 22:18 - 2014-06-02 22:18 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-02 22:18 - 2014-06-02 22:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-02 22:18 - 2014-06-02 22:18 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-02 22:18 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-02 22:18 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-02 22:18 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-02 22:16 - 2014-06-02 22:17 - 01327971 _____ () C:\Users\admin\Downloads\adwcleaner_3.211.exe
2014-06-02 22:14 - 2014-06-02 22:17 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-06-01 23:31 - 2014-06-01 23:31 - 00016684 _____ () C:\ComboFix.txt
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-01 23:22 - 2014-06-01 23:31 - 00000000 ____D () C:\Qoobox
2014-06-01 23:22 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-01 23:22 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-01 23:22 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-01 23:22 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-01 23:22 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-01 23:22 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-01 23:22 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-01 23:22 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-01 23:21 - 2014-06-01 23:29 - 00000000 ____D () C:\Windows\erdnt
2014-06-01 23:19 - 2014-06-01 23:20 - 05203398 ____R (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2014-06-01 17:30 - 2014-06-01 17:30 - 00041188 _____ () C:\Users\admin\Downloads\gmer.txt
2014-06-01 17:21 - 2014-06-01 17:21 - 00380416 _____ () C:\Users\admin\Downloads\Gmer-19357.exe
2014-06-01 17:16 - 2014-06-03 00:43 - 00009461 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-01 17:16 - 2014-06-03 00:43 - 00000000 ____D () C:\FRST
2014-06-01 17:16 - 2014-06-01 17:17 - 00017567 _____ () C:\Users\admin\Downloads\Addition.txt
2014-06-01 17:15 - 2014-06-03 00:43 - 02068992 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2014-06-01 17:12 - 2014-06-01 17:12 - 00000472 _____ () C:\Users\admin\Downloads\defogger_disable.log
2014-06-01 17:12 - 2014-06-01 17:12 - 00000000 _____ () C:\Users\admin\defogger_reenable
2014-06-01 17:11 - 2014-06-01 17:11 - 00050477 _____ () C:\Users\admin\Downloads\Defogger.exe
2014-05-30 01:23 - 2014-05-30 01:23 - 01016261 _____ (Thisisu) C:\Users\admin\Downloads\JRT.exe
2014-05-30 01:22 - 2014-05-30 01:25 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-29 22:36 - 2014-06-03 00:06 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-05-29 22:36 - 2014-05-29 22:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-05-29 22:36 - 2014-05-29 22:36 - 00001097 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-05-29 22:36 - 2014-05-29 22:36 - 00000000 ____D () C:\Users\admin\Documents\Anti-Malware
2014-05-27 16:26 - 2014-06-02 12:57 - 00000000 ____D () C:\Users\admin\AppData\Roaming\vlc
2014-05-27 16:25 - 2014-05-27 16:25 - 00000877 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-27 16:25 - 2014-05-27 16:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-27 16:24 - 2014-05-27 16:24 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-27 16:16 - 2014-05-27 16:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-27 12:39 - 2014-05-27 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-05-27 12:30 - 2014-05-27 12:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-26 23:25 - 2013-05-10 07:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-05-26 23:25 - 2013-05-10 07:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-05-26 23:25 - 2013-05-10 06:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-05-26 23:25 - 2013-05-10 06:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-05-26 23:22 - 2014-05-28 01:08 - 01592096 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-05-26 18:26 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-26 18:26 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-05-26 18:26 - 2013-12-04 04:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-05-26 18:26 - 2013-12-04 04:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-05-26 18:26 - 2013-12-04 04:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-05-26 18:26 - 2013-12-04 04:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-05-26 18:26 - 2013-12-04 04:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-05-26 18:26 - 2013-12-04 04:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-05-26 18:26 - 2013-12-04 04:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-05-26 18:26 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-05-26 18:26 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-05-26 18:26 - 2013-12-04 04:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-05-26 18:26 - 2013-12-04 03:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-05-26 18:26 - 2013-12-04 03:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-05-26 18:26 - 2013-12-04 03:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-05-26 18:26 - 2013-12-04 03:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-05-26 18:25 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-05-26 18:25 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-05-26 18:23 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-05-26 18:23 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-05-26 18:23 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-05-26 18:23 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-05-26 18:23 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-05-26 18:23 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-05-26 18:18 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-05-26 18:18 - 2013-10-30 04:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2014-05-26 18:18 - 2013-10-30 04:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2014-05-26 18:12 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-05-26 18:12 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-05-26 18:07 - 2013-11-23 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-05-26 18:07 - 2013-11-23 19:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-05-26 18:06 - 2014-01-01 01:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-05-26 18:06 - 2014-01-01 01:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-05-26 18:03 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-05-19 21:06 - 2014-05-19 21:06 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-19 19:02 - 2014-05-19 21:22 - 00000000 ____D () C:\Users\admin\Documents\Studium
2014-05-19 18:34 - 2014-05-19 18:34 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-05-18 23:55 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-18 23:55 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-18 23:55 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-18 23:55 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-18 23:55 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-18 23:55 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-18 22:54 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-18 22:54 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-18 22:53 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-18 22:53 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-18 22:53 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-18 22:53 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-18 22:53 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-18 22:53 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-18 22:53 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-18 22:53 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-18 22:53 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-18 22:53 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-18 22:53 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-18 22:53 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-18 22:53 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-18 22:53 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-18 22:53 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-18 22:53 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-14 00:37 - 2014-05-14 00:37 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-13 14:20 - 2014-05-13 14:20 - 00273176 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
2014-05-13 14:20 - 2014-05-13 14:20 - 00235800 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2014-05-13 14:06 - 2014-05-13 14:06 - 00323352 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00191768 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00152344 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgdiska.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00130328 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00236312 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00031512 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgrkx64.sys
2014-05-10 16:27 - 2014-05-19 21:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-06-03 00:44 - 2014-06-01 17:16 - 00009461 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-03 00:43 - 2014-06-03 00:43 - 00000000 ____D () C:\Users\admin\Downloads\FRST-OlderVersion
2014-06-03 00:43 - 2014-06-01 17:16 - 00000000 ____D () C:\FRST
2014-06-03 00:43 - 2014-06-01 17:15 - 02068992 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2014-06-03 00:43 - 2013-11-11 09:15 - 00000000 ____D () C:\Users\admin\AppData\Local\Temp
2014-06-03 00:37 - 2014-01-06 23:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-03 00:34 - 2014-06-03 00:34 - 00000826 _____ () C:\Users\admin\Desktop\JRT.txt
2014-06-03 00:20 - 2014-06-03 00:20 - 00000000 ____D () C:\Windows\ERUNT
2014-06-03 00:19 - 2014-06-03 00:19 - 00002134 _____ () C:\Users\admin\Desktop\Junkware Removal Tool - CHIP Downloader.lnk
2014-06-03 00:16 - 2014-06-03 00:16 - 00961360 _____ (Chip Digital GmbH) C:\Users\admin\Downloads\Junkware Removal Tool - CHIP-Installer.exe
2014-06-03 00:06 - 2014-05-29 22:36 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-06-02 23:59 - 2014-01-06 23:05 - 00000000 ____D () C:\ProgramData\MFAData
2014-06-02 22:59 - 2014-06-02 22:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-02 22:50 - 2009-07-14 06:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-02 22:50 - 2009-07-14 06:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-02 22:42 - 2010-11-21 05:47 - 00144904 _____ () C:\Windows\PFRO.log
2014-06-02 22:42 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-02 22:42 - 2009-07-14 06:51 - 00034566 _____ () C:\Windows\setupact.log
2014-06-02 22:41 - 2014-06-02 22:34 - 00000000 ____D () C:\AdwCleaner
2014-06-02 22:41 - 2013-11-11 09:07 - 01965219 _____ () C:\Windows\WindowsUpdate.log
2014-06-02 22:39 - 2014-01-08 16:49 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Spotify
2014-06-02 22:34 - 2014-06-02 22:34 - 00001156 _____ () C:\mbam.txt
2014-06-02 22:18 - 2014-06-02 22:18 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-02 22:18 - 2014-06-02 22:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-02 22:18 - 2014-06-02 22:18 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-02 22:17 - 2014-06-02 22:16 - 01327971 _____ () C:\Users\admin\Downloads\adwcleaner_3.211.exe
2014-06-02 22:17 - 2014-06-02 22:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-06-02 12:57 - 2014-05-27 16:26 - 00000000 ____D () C:\Users\admin\AppData\Roaming\vlc
2014-06-01 23:31 - 2014-06-01 23:31 - 00016684 _____ () C:\ComboFix.txt
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-01 23:31 - 2014-06-01 23:22 - 00000000 ____D () C:\Qoobox
2014-06-01 23:29 - 2014-06-01 23:21 - 00000000 ____D () C:\Windows\erdnt
2014-06-01 23:29 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-06-01 23:20 - 2014-06-01 23:19 - 05203398 ____R (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2014-06-01 17:30 - 2014-06-01 17:30 - 00041188 _____ () C:\Users\admin\Downloads\gmer.txt
2014-06-01 17:21 - 2014-06-01 17:21 - 00380416 _____ () C:\Users\admin\Downloads\Gmer-19357.exe
2014-06-01 17:17 - 2014-06-01 17:16 - 00017567 _____ () C:\Users\admin\Downloads\Addition.txt
2014-06-01 17:12 - 2014-06-01 17:12 - 00000472 _____ () C:\Users\admin\Downloads\defogger_disable.log
2014-06-01 17:12 - 2014-06-01 17:12 - 00000000 _____ () C:\Users\admin\defogger_reenable
2014-06-01 17:12 - 2013-11-11 09:15 - 00000000 ____D () C:\Users\admin
2014-06-01 17:11 - 2014-06-01 17:11 - 00050477 _____ () C:\Users\admin\Downloads\Defogger.exe
2014-05-30 01:25 - 2014-05-30 01:22 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-30 01:23 - 2014-05-30 01:23 - 01016261 _____ (Thisisu) C:\Users\admin\Downloads\JRT.exe
2014-05-29 22:37 - 2014-05-29 22:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-05-29 22:36 - 2014-05-29 22:36 - 00001097 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-05-29 22:36 - 2014-05-29 22:36 - 00000000 ____D () C:\Users\admin\Documents\Anti-Malware
2014-05-29 20:09 - 2014-04-16 02:50 - 00000000 ____D () C:\Program Files (x86)\Assassin's Creed 4 Black Flag Jackdaw Edition
2014-05-28 15:54 - 2014-01-08 16:49 - 00000000 ____D () C:\Users\admin\AppData\Local\Spotify
2014-05-28 01:08 - 2014-05-26 23:22 - 01592096 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-05-28 01:08 - 2011-04-12 09:26 - 00698960 _____ () C:\Windows\system32\perfh007.dat
2014-05-28 01:08 - 2011-04-12 09:26 - 00149100 _____ () C:\Windows\system32\perfc007.dat
2014-05-28 01:08 - 2009-07-14 07:13 - 01592096 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-27 18:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Web
2014-05-27 18:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-27 16:25 - 2014-05-27 16:25 - 00000877 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-27 16:25 - 2014-05-27 16:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-27 16:24 - 2014-05-27 16:24 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-27 16:18 - 2014-04-07 13:10 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-05-27 16:16 - 2014-05-27 16:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-27 15:06 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-27 15:03 - 2014-04-16 11:33 - 00001085 _____ () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-27 12:39 - 2014-05-27 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-05-27 12:33 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-05-27 12:30 - 2014-05-27 12:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-21 23:57 - 2014-04-07 12:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-05-19 21:22 - 2014-05-19 19:02 - 00000000 ____D () C:\Users\admin\Documents\Studium
2014-05-19 21:17 - 2013-11-11 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-19 21:06 - 2014-05-19 21:06 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-19 21:06 - 2014-05-10 16:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-19 21:06 - 2014-01-06 18:59 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Mozilla
2014-05-19 20:55 - 2013-12-12 00:42 - 00000000 ____D () C:\Users\admin\Documents\My Games
2014-05-19 18:34 - 2014-05-19 18:34 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-05-19 14:31 - 2014-01-06 23:12 - 00000987 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-05-19 14:19 - 2014-01-09 13:52 - 00000000 ___RD () C:\Users\admin\Podcasts
2014-05-19 14:19 - 2013-11-11 09:16 - 00000000 ___RD () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 14:19 - 2013-11-11 09:16 - 00000000 ___RD () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-19 14:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-18 23:54 - 2013-11-11 09:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-18 23:52 - 2013-11-11 09:31 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-18 23:16 - 2014-01-22 01:42 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-14 00:38 - 2014-01-06 23:06 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 00:38 - 2014-01-06 23:06 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 00:38 - 2014-01-06 23:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 00:37 - 2014-05-14 00:37 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-13 14:20 - 2014-05-13 14:20 - 00273176 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
2014-05-13 14:20 - 2014-05-13 14:20 - 00235800 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2014-05-13 14:06 - 2014-05-13 14:06 - 00323352 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00191768 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00152344 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgdiska.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00130328 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00236312 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00031512 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgrkx64.sys
2014-05-12 07:26 - 2014-06-02 22:18 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-06-02 22:18 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-06-02 22:18 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-09 08:14 - 2014-05-26 18:26 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-26 18:26 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 06:40 - 2014-05-18 23:55 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-18 23:55 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-18 23:55 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-18 23:55 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-18 23:55 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-18 23:55 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

Some content of TEMP:
====================
C:\Users\admin\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-29 00:08

==================== End Of Log ============================
         

--- --- ---

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Es wurden zwei Bedrohungen gefunden...
Eset:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=3c0894db77ab8b4487c21c0568c25533
# engine=18540
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-03 09:10:38
# local_time=2014-06-03 11:10:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='AVG Internet Security 2014'
# compatibility_mode=1049 16777213 100 100 41339 88963822 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 12790682 153459688 0 0
# scanned=114136
# found=2
# cleaned=0
# scan_time=2977
sh=99F97AD369E8621AB4D17DF53E80E60FEE99C727 ft=1 fh=42567613b862d846 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\admin\AppData\Local\Temp\OCS\ocs_v71b.exe"
sh=1036F8B8981E1669E64D8295E57070C98067628A ft=1 fh=7ff80cc04b516749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\admin\Downloads\Junkware Removal Tool - CHIP-Installer.exe"
         

checkup.txt

 Results of screen317's Security Check version 0.99.83  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
AVG Internet Security 2014   
Emsisoft Anti-Malware        
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 7 Update 55  
 Adobe Flash Player 13.0.0.214  
 Adobe Reader XI  
 Mozilla Firefox (29.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 AVG avgwdsvc.exe 
 Emsisoft Anti-Malware a2service.exe   
 Malwarebytes Anti-Malware mbamscheduler.exe   
 Emsisoft Anti-Malware a2guard.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

FRST

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by admin (administrator) on PC on 03-06-2014 23:23:03
Running from C:\Users\admin\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Spotify Ltd) C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Akamai Technologies, Inc.) C:\Users\admin\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(Akamai Technologies, Inc.) C:\Users\admin\AppData\Local\Akamai\netsession_win.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginClientService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Zune Launcher] => C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5181456 2014-05-13] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4330432 2014-02-15] (Emsisoft GmbH)
HKU\S-1-5-21-3912170589-447723747-2927474245-1000\...\Run: [Spotify Web Helper] => C:\Users\admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-19] (Spotify Ltd)
HKU\S-1-5-21-3912170589-447723747-2927474245-1000\...\Run: [Akamai NetSession Interface] => C:\Users\admin\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-3912170589-447723747-2927474245-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3588952 2014-06-03] (Electronic Arts)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\guzxi5oy.default
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\guzxi5oy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-21]

==================== Services (Whitelisted) =================

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4163584 2014-02-15] (Emsisoft GmbH)
R2 avgfws; C:\Program Files (x86)\AVG\AVG2014\avgfws.exe [1473792 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3644432 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [292424 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [71472 2014-05-29] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [23088 2014-05-29] (Emsisoft GmbH)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-09-26] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [236312 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [191768 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [323352 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [130328 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [273176 2014-05-13] (AVG Technologies CZ, s.r.o.)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-03] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-03 22:20 - 2014-06-03 22:20 - 00854367 _____ () C:\Users\admin\Downloads\SecurityCheck.exe
2014-06-03 22:17 - 2014-06-03 22:17 - 02347384 _____ (ESET) C:\Users\admin\Downloads\esetsmartinstaller_deu.exe
2014-06-03 12:20 - 2014-06-03 12:22 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-06-03 12:19 - 2014-06-03 15:56 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Origin
2014-06-03 12:19 - 2014-06-03 12:20 - 00000000 ____D () C:\Users\admin\AppData\Local\Origin
2014-06-03 12:04 - 2014-06-03 20:09 - 00000000 ____D () C:\ProgramData\Origin
2014-06-03 12:04 - 2014-06-03 15:54 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-06-03 12:04 - 2014-06-03 12:04 - 00000985 _____ () C:\Users\Public\Desktop\Origin.lnk
2014-06-03 12:04 - 2014-06-03 12:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2014-06-03 12:04 - 2014-06-03 12:04 - 00000000 ____D () C:\ProgramData\Electronic Arts
2014-06-03 12:01 - 2014-06-03 12:04 - 17009768 _____ (Electronic Arts, Inc.) C:\Users\admin\Downloads\OriginThinSetup.exe
2014-06-03 00:43 - 2014-06-03 00:43 - 00000000 ____D () C:\Users\admin\Downloads\FRST-OlderVersion
2014-06-03 00:34 - 2014-06-03 00:34 - 00000826 _____ () C:\Users\admin\Desktop\JRT.txt
2014-06-03 00:20 - 2014-06-03 00:20 - 00000000 ____D () C:\Windows\ERUNT
2014-06-02 22:34 - 2014-06-02 22:41 - 00000000 ____D () C:\AdwCleaner
2014-06-02 22:34 - 2014-06-02 22:34 - 00001156 _____ () C:\mbam.txt
2014-06-02 22:19 - 2014-06-03 22:14 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-02 22:18 - 2014-06-02 22:18 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-02 22:18 - 2014-06-02 22:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-02 22:18 - 2014-06-02 22:18 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-02 22:18 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-02 22:18 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-02 22:18 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-02 22:16 - 2014-06-02 22:17 - 01327971 _____ () C:\Users\admin\Downloads\adwcleaner_3.211.exe
2014-06-02 22:14 - 2014-06-02 22:17 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-06-01 23:31 - 2014-06-01 23:31 - 00016684 _____ () C:\ComboFix.txt
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-01 23:22 - 2014-06-01 23:31 - 00000000 ____D () C:\Qoobox
2014-06-01 23:22 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-01 23:22 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-01 23:22 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-01 23:22 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-01 23:22 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-01 23:22 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-01 23:22 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-01 23:22 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-01 23:21 - 2014-06-01 23:29 - 00000000 ____D () C:\Windows\erdnt
2014-06-01 23:19 - 2014-06-01 23:20 - 05203398 ____R (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2014-06-01 17:30 - 2014-06-01 17:30 - 00041188 _____ () C:\Users\admin\Downloads\gmer.txt
2014-06-01 17:21 - 2014-06-01 17:21 - 00380416 _____ () C:\Users\admin\Downloads\Gmer-19357.exe
2014-06-01 17:16 - 2014-06-03 23:23 - 00009847 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-01 17:16 - 2014-06-03 23:23 - 00000000 ____D () C:\FRST
2014-06-01 17:16 - 2014-06-01 17:17 - 00017567 _____ () C:\Users\admin\Downloads\Addition.txt
2014-06-01 17:15 - 2014-06-03 00:43 - 02068992 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2014-06-01 17:12 - 2014-06-01 17:12 - 00000472 _____ () C:\Users\admin\Downloads\defogger_disable.log
2014-06-01 17:12 - 2014-06-01 17:12 - 00000000 _____ () C:\Users\admin\defogger_reenable
2014-06-01 17:11 - 2014-06-01 17:11 - 00050477 _____ () C:\Users\admin\Downloads\Defogger.exe
2014-05-30 01:23 - 2014-05-30 01:23 - 01016261 _____ (Thisisu) C:\Users\admin\Downloads\JRT.exe
2014-05-30 01:22 - 2014-05-30 01:25 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-29 22:36 - 2014-06-03 23:21 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-05-29 22:36 - 2014-05-29 22:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-05-29 22:36 - 2014-05-29 22:36 - 00001097 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-05-29 22:36 - 2014-05-29 22:36 - 00000000 ____D () C:\Users\admin\Documents\Anti-Malware
2014-05-27 16:26 - 2014-06-02 12:57 - 00000000 ____D () C:\Users\admin\AppData\Roaming\vlc
2014-05-27 16:25 - 2014-05-27 16:25 - 00000877 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-27 16:25 - 2014-05-27 16:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-27 16:24 - 2014-05-27 16:24 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-27 16:16 - 2014-05-27 16:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-27 12:39 - 2014-05-27 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-05-27 12:30 - 2014-05-27 12:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-26 23:25 - 2013-05-10 07:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-05-26 23:25 - 2013-05-10 07:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-05-26 23:25 - 2013-05-10 06:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-05-26 23:25 - 2013-05-10 06:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-05-26 23:22 - 2014-05-28 01:08 - 01592096 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-05-26 18:26 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-26 18:26 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-05-26 18:26 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-05-26 18:26 - 2013-12-04 04:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-05-26 18:26 - 2013-12-04 04:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-05-26 18:26 - 2013-12-04 04:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-05-26 18:26 - 2013-12-04 04:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-05-26 18:26 - 2013-12-04 04:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-05-26 18:26 - 2013-12-04 04:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-05-26 18:26 - 2013-12-04 04:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-05-26 18:26 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-05-26 18:26 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-05-26 18:26 - 2013-12-04 04:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-05-26 18:26 - 2013-12-04 03:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-05-26 18:26 - 2013-12-04 03:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-05-26 18:26 - 2013-12-04 03:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-05-26 18:26 - 2013-12-04 03:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-05-26 18:25 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-05-26 18:25 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-05-26 18:23 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-05-26 18:23 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-05-26 18:23 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-05-26 18:23 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-05-26 18:23 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-05-26 18:23 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-05-26 18:18 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-05-26 18:18 - 2013-10-30 04:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2014-05-26 18:18 - 2013-10-30 04:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2014-05-26 18:12 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-05-26 18:12 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-05-26 18:07 - 2013-11-23 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-05-26 18:07 - 2013-11-23 19:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-05-26 18:06 - 2014-01-01 01:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-05-26 18:06 - 2014-01-01 01:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-05-26 18:03 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-05-19 21:06 - 2014-05-19 21:06 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-19 19:02 - 2014-06-03 14:21 - 00000000 ____D () C:\Users\admin\Documents\Studium
2014-05-19 18:34 - 2014-05-19 18:34 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-05-18 23:55 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-18 23:55 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-18 23:55 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-18 23:55 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-18 23:55 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-18 23:55 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-18 22:54 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-18 22:54 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-18 22:53 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-18 22:53 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-18 22:53 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-18 22:53 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-18 22:53 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-18 22:53 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-18 22:53 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-18 22:53 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-18 22:53 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-18 22:53 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-18 22:53 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-18 22:53 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-18 22:53 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-18 22:53 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-18 22:53 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-18 22:53 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-18 22:53 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-18 22:53 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-18 22:53 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-14 00:37 - 2014-05-14 00:37 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-13 14:20 - 2014-05-13 14:20 - 00273176 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
2014-05-13 14:20 - 2014-05-13 14:20 - 00235800 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2014-05-13 14:06 - 2014-05-13 14:06 - 00323352 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00191768 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00152344 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgdiska.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00130328 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00236312 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00031512 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgrkx64.sys
2014-05-10 16:27 - 2014-05-19 21:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-06-03 23:23 - 2014-06-01 17:16 - 00009847 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-03 23:23 - 2014-06-01 17:16 - 00000000 ____D () C:\FRST
2014-06-03 23:23 - 2013-11-11 09:15 - 00000000 ____D () C:\Users\admin\AppData\Local\Temp
2014-06-03 23:21 - 2014-05-29 22:36 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-06-03 22:37 - 2014-01-06 23:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-03 22:20 - 2014-06-03 22:20 - 00854367 _____ () C:\Users\admin\Downloads\SecurityCheck.exe
2014-06-03 22:17 - 2014-06-03 22:17 - 02347384 _____ (ESET) C:\Users\admin\Downloads\esetsmartinstaller_deu.exe
2014-06-03 22:14 - 2014-06-02 22:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-03 21:59 - 2014-01-06 23:05 - 00000000 ____D () C:\ProgramData\MFAData
2014-06-03 21:47 - 2013-11-11 09:07 - 01987942 _____ () C:\Windows\WindowsUpdate.log
2014-06-03 20:09 - 2014-06-03 12:04 - 00000000 ____D () C:\ProgramData\Origin
2014-06-03 16:01 - 2009-07-14 06:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-03 16:01 - 2009-07-14 06:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-03 15:56 - 2014-06-03 12:19 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Origin
2014-06-03 15:54 - 2014-06-03 12:04 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-06-03 15:53 - 2010-11-21 05:47 - 00146298 _____ () C:\Windows\PFRO.log
2014-06-03 15:53 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-03 15:53 - 2009-07-14 06:51 - 00034678 _____ () C:\Windows\setupact.log
2014-06-03 14:21 - 2014-05-19 19:02 - 00000000 ____D () C:\Users\admin\Documents\Studium
2014-06-03 12:22 - 2014-06-03 12:20 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-06-03 12:20 - 2014-06-03 12:19 - 00000000 ____D () C:\Users\admin\AppData\Local\Origin
2014-06-03 12:04 - 2014-06-03 12:04 - 00000985 _____ () C:\Users\Public\Desktop\Origin.lnk
2014-06-03 12:04 - 2014-06-03 12:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2014-06-03 12:04 - 2014-06-03 12:04 - 00000000 ____D () C:\ProgramData\Electronic Arts
2014-06-03 12:04 - 2014-06-03 12:01 - 17009768 _____ (Electronic Arts, Inc.) C:\Users\admin\Downloads\OriginThinSetup.exe
2014-06-03 00:43 - 2014-06-03 00:43 - 00000000 ____D () C:\Users\admin\Downloads\FRST-OlderVersion
2014-06-03 00:43 - 2014-06-01 17:15 - 02068992 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2014-06-03 00:34 - 2014-06-03 00:34 - 00000826 _____ () C:\Users\admin\Desktop\JRT.txt
2014-06-03 00:20 - 2014-06-03 00:20 - 00000000 ____D () C:\Windows\ERUNT
2014-06-02 22:41 - 2014-06-02 22:34 - 00000000 ____D () C:\AdwCleaner
2014-06-02 22:39 - 2014-01-08 16:49 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Spotify
2014-06-02 22:34 - 2014-06-02 22:34 - 00001156 _____ () C:\mbam.txt
2014-06-02 22:18 - 2014-06-02 22:18 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-02 22:18 - 2014-06-02 22:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-02 22:18 - 2014-06-02 22:18 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-02 22:17 - 2014-06-02 22:16 - 01327971 _____ () C:\Users\admin\Downloads\adwcleaner_3.211.exe
2014-06-02 22:17 - 2014-06-02 22:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-06-02 12:57 - 2014-05-27 16:26 - 00000000 ____D () C:\Users\admin\AppData\Roaming\vlc
2014-06-01 23:31 - 2014-06-01 23:31 - 00016684 _____ () C:\ComboFix.txt
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-01 23:31 - 2014-06-01 23:31 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-01 23:31 - 2014-06-01 23:22 - 00000000 ____D () C:\Qoobox
2014-06-01 23:29 - 2014-06-01 23:21 - 00000000 ____D () C:\Windows\erdnt
2014-06-01 23:29 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-06-01 23:20 - 2014-06-01 23:19 - 05203398 ____R (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2014-06-01 17:30 - 2014-06-01 17:30 - 00041188 _____ () C:\Users\admin\Downloads\gmer.txt
2014-06-01 17:21 - 2014-06-01 17:21 - 00380416 _____ () C:\Users\admin\Downloads\Gmer-19357.exe
2014-06-01 17:17 - 2014-06-01 17:16 - 00017567 _____ () C:\Users\admin\Downloads\Addition.txt
2014-06-01 17:12 - 2014-06-01 17:12 - 00000472 _____ () C:\Users\admin\Downloads\defogger_disable.log
2014-06-01 17:12 - 2014-06-01 17:12 - 00000000 _____ () C:\Users\admin\defogger_reenable
2014-06-01 17:12 - 2013-11-11 09:15 - 00000000 ____D () C:\Users\admin
2014-06-01 17:11 - 2014-06-01 17:11 - 00050477 _____ () C:\Users\admin\Downloads\Defogger.exe
2014-05-30 01:25 - 2014-05-30 01:22 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-30 01:23 - 2014-05-30 01:23 - 01016261 _____ (Thisisu) C:\Users\admin\Downloads\JRT.exe
2014-05-29 22:37 - 2014-05-29 22:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-05-29 22:36 - 2014-05-29 22:36 - 00001097 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-05-29 22:36 - 2014-05-29 22:36 - 00000000 ____D () C:\Users\admin\Documents\Anti-Malware
2014-05-29 20:09 - 2014-04-16 02:50 - 00000000 ____D () C:\Program Files (x86)\Assassin's Creed 4 Black Flag Jackdaw Edition
2014-05-28 15:54 - 2014-01-08 16:49 - 00000000 ____D () C:\Users\admin\AppData\Local\Spotify
2014-05-28 01:08 - 2014-05-26 23:22 - 01592096 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-05-28 01:08 - 2011-04-12 09:26 - 00698960 _____ () C:\Windows\system32\perfh007.dat
2014-05-28 01:08 - 2011-04-12 09:26 - 00149100 _____ () C:\Windows\system32\perfc007.dat
2014-05-28 01:08 - 2009-07-14 07:13 - 01592096 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-27 18:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Web
2014-05-27 18:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-27 16:25 - 2014-05-27 16:25 - 00000877 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-27 16:25 - 2014-05-27 16:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-27 16:24 - 2014-05-27 16:24 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-27 16:18 - 2014-04-07 13:10 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-05-27 16:16 - 2014-05-27 16:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-27 15:06 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-27 15:03 - 2014-04-16 11:33 - 00001085 _____ () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-27 12:39 - 2014-05-27 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-05-27 12:33 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-05-27 12:30 - 2014-05-27 12:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-21 23:57 - 2014-04-07 12:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-05-19 21:17 - 2013-11-11 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-19 21:06 - 2014-05-19 21:06 - 00001165 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-19 21:06 - 2014-05-19 21:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-19 21:06 - 2014-05-10 16:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-19 21:06 - 2014-01-06 18:59 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Mozilla
2014-05-19 20:55 - 2013-12-12 00:42 - 00000000 ____D () C:\Users\admin\Documents\My Games
2014-05-19 18:34 - 2014-05-19 18:34 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-05-19 14:31 - 2014-01-06 23:12 - 00000987 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-05-19 14:19 - 2014-01-09 13:52 - 00000000 ___RD () C:\Users\admin\Podcasts
2014-05-19 14:19 - 2013-11-11 09:16 - 00000000 ___RD () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 14:19 - 2013-11-11 09:16 - 00000000 ___RD () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-19 14:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-18 23:54 - 2013-11-11 09:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-18 23:52 - 2013-11-11 09:31 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-18 23:16 - 2014-01-22 01:42 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-14 00:38 - 2014-01-06 23:06 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 00:38 - 2014-01-06 23:06 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 00:38 - 2014-01-06 23:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 00:37 - 2014-05-14 00:37 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-13 14:20 - 2014-05-13 14:20 - 00273176 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
2014-05-13 14:20 - 2014-05-13 14:20 - 00235800 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2014-05-13 14:06 - 2014-05-13 14:06 - 00323352 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00191768 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00152344 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgdiska.sys
2014-05-13 14:05 - 2014-05-13 14:05 - 00130328 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00236312 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2014-05-13 14:04 - 2014-05-13 14:04 - 00031512 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgrkx64.sys
2014-05-12 07:26 - 2014-06-02 22:18 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-06-02 22:18 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-06-02 22:18 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-09 08:14 - 2014-05-26 18:26 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-26 18:26 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 06:40 - 2014-05-18 23:55 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-18 23:55 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-18 23:55 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-18 23:55 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-18 23:55 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-18 23:55 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

Some content of TEMP:
====================
C:\Users\admin\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-29 00:08

==================== End Of Log ============================
         

--- --- ---


Das Internet läuft jetzt wieder besser, allerdings hatte ich deine Anweisungen gestern Nacht schon befolgt aber es ist erst seit heute Abend wieder "normal" schnell.
Danke schonmal für die Hilfe

Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

hat alles super geklappt!
Vielen Dank kannst mich aus deinem Abo löschen.
Viel Erfolg beim weiteren Kampf gegen Malware
Gruß ichdochned

Gern Geschehen