Hallo zusammen,

mich hat es (leider) auch erwischt.

Seit gestern habe ich den GVU-Trojaner.

Probiert habe ich folgendes:

Internetverbindung trennen.
PC im abgesicherten Modus starten.
Malware Bytes den Trojaner suchen und bereinigen lassen.
PC neu gestartet.
Dann im Normalmodus (Windows 7 64 Bit) nochmal Malware Bytes und meinen
Virenscanner drüberlaufen lassen.

Bei jedem Neustart ist aber angeblich wieder die rundll32.exe und eine .txt-Datei
infiziert.

Wie kann ich jetzt weiter vorgehen? (außer Neuinstallation)

Lieben Gruß

Andreas

Hi,

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Scan.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Werde ich heute abend (=nach der Arbeit) machen.

Kann ich das auch im abgesicherten Modus machen oder
sollte dies im Normalmodus geschehen?

vorerst egal

So, habe ich mich gemacht.

Hier ist ja sehr viel los.

FRST-Datei:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-06-2013 01
Ran by Andreas (administrator) on 06-06-2013 20:10:30
Running from C:\Users\Andreas\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) =================


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12681320 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe /minimized [5889816 2011-12-07] (Logitech Inc.)
HKLM\...\Run: [Bdagent] C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1569536 2013-04-29] (Bitdefender)
HKCU\...\Run: [AmazonMP3DownloaderHelper] C:\Users\Andreas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [397632 2013-05-02] ()
HKCU\...\Run: [ctfmon.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\tovido.dat,FG00 [159744 2013-06-05] ()
HKCU\...\Winlogon: [Shell] Explorer.exe
HKCU\...\Command Processor: "C:\Users\Andreas\Documents\3ae9184b.exe"
MountPoints2: D - D:\Autorun.exe
MountPoints2: {81259008-5c1f-11e2-8ccb-001a4d5e8039} - J:\AutoRun.exe {D2D77DC2-8299-11D1-8949-444553540000} 5.2066.1.A11B02 PID_0083
MountPoints2: {c4aea240-100b-11e2-a44b-806e6f6e6963} - F:\AutoRun.exe
HKLM-x32\...\Run: [NWEReboot]  [x]
HKLM-x32\...\Run: [BrMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ChallengerUltimate] "C:\Program Files (x86)\Thermaltake Ttesports Ultimate\Ttsystray3.exe" [1254912 2010-08-05] (Chicony)
HKLM-x32\...\Run: [ChallengerUltimateOSD] "C:\Program Files (x86)\Thermaltake Ttesports Ultimate\tTOSD2k1001.exe" [634880 2010-08-05] (Chicony)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
ShortcutTarget: msconfig.lnk -> C:\PROGRA~3\tovido.dat ()

==================== Internet (Whitelisted) ====================

ProxyServer: http=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: (No Name) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} -  No File
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {F989F9AF-5E01-4188-A5C2-D0510799BAD1} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1561552
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Oracle)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll (AnchorFree Inc.)
BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} -  No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files (x86)\Hotspot_Shield\prxtbHots.dll (Conduit Ltd.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Oracle)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
BHO-x32: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
Toolbar: HKLM-x32 - Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files (x86)\Hotspot_Shield\prxtbHots.dll (Conduit Ltd.)
Toolbar: HKCU - No Name - {C95A4E8E-816D-4655-8C79-D736DA1ADB6D} -  No File
PDF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
PDF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
PDF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

FireFox:
========
FF ProfilePath: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\1mllhi2f.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.3 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

==================== Services (Whitelisted) =================

S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [69392 2013-03-30] (Bitdefender)
S2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe [545576 2013-02-23] (AnchorFree Inc.)
S4 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [78512 2013-02-22] ()
S2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [389928 2013-02-23] ()
S2 libusbd; C:\Windows\SysWow64\libusbd-nt.exe [18944 2005-03-09] (hxxp://libusb-win32.sourceforge.net)
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-02-12] ()
S2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [68856 2013-03-30] (Bitdefender)
S2 vsserv; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1646792 2013-06-01] (Bitdefender)

==================== Drivers (Whitelisted) ====================

S0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [718840 2013-04-29] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [593144 2013-04-29] (BitDefender)
S1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-04-29] (BitDefender LLC)
S1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82384 2012-11-12] (BitDefender SRL)
R0 CLBStor; C:\Windows\System32\DRIVERS\CLBStor.sys [24560 2007-10-26] (Cyberlink Co.,Ltd.)
S0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [147232 2013-03-30] (BitDefender LLC)
S1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [46280 2013-02-22] (AnchorFree Inc.)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66328 2011-10-24] (Logitech Inc.)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [36680 2013-06-05] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2012-10-07] (Duplex Secure Ltd.)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-02-22] (Anchorfree Inc.)
S0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [382536 2013-06-01] (BitDefender S.R.L.)
S4 InCDFs; system32\drivers\InCDFs.sys [x]
S1 InCDPass; system32\drivers\InCDPass.sys [x]
S1 InCDRm; system32\drivers\InCDRm.sys [x]
U3 JavaQuickStarterService; 
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-06 20:10 - 2013-06-06 20:10 - 00000000 ____D C:\FRST
2013-06-06 20:10 - 2013-06-06 19:45 - 01917710 ____A (Farbar) C:\Users\Andreas\Desktop\FRST64.exe
2013-06-05 22:45 - 2013-06-05 22:45 - 00036680 ____A C:\Windows\System32\Drivers\mbamchameleon.sys
2013-06-05 19:55 - 2013-06-05 19:55 - 00000000 ____D C:\Users\Andreas\Desktop\mbar-1.06.0.1003
2013-06-05 19:55 - 2013-05-28 06:52 - 13169742 ____A C:\Users\Andreas\Desktop\mbar-1.06.0.1003.zip
2013-05-28 06:11 - 2013-05-28 06:11 - 00162985 ____A C:\Users\Andreas\AppData\Local\2433f433
2013-05-16 21:19 - 2013-02-17 01:40 - 00028672 ____A (Microsoft Corporation) C:\Windows\System32\IEUDINIT.EXE
2013-05-16 20:51 - 2013-05-16 20:51 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-05-16 20:43 - 2013-05-16 21:19 - 00009703 ____A C:\Windows\IE10_main.log
2013-05-15 18:09 - 2013-05-15 18:09 - 00000000 ____D C:\Windows\46ED2B6485C74E1F920CA555B21F2E4C.TMP
2013-05-15 07:38 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 07:38 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-15 07:38 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-15 07:38 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-15 07:38 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-15 07:38 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-15 07:38 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-15 07:38 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-15 07:38 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-15 07:38 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-15 07:38 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-15 07:38 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-15 07:38 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-05-15 07:38 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-09 22:07 - 2013-05-09 22:07 - 00000000 ____D C:\Users\Andreas\Documents\Amazon MP3

==================== One Month Modified Files and Folders =======

2013-06-06 20:10 - 2013-06-06 20:10 - 00000000 ____D C:\FRST
2013-06-06 20:06 - 2012-02-27 17:48 - 00084161 ____A C:\Windows\setupact.log
2013-06-06 20:06 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-06 19:45 - 2013-06-06 20:10 - 01917710 ____A (Farbar) C:\Users\Andreas\Desktop\FRST64.exe
2013-06-06 07:37 - 2009-07-14 06:45 - 00013744 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-06 07:37 - 2009-07-14 06:45 - 00013744 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-06 07:36 - 2009-10-24 00:39 - 01190745 ____A C:\Windows\WindowsUpdate.log
2013-06-06 07:32 - 2012-02-27 17:48 - 00399168 ____A C:\Windows\PFRO.log
2013-06-06 07:01 - 2009-07-14 19:58 - 00677804 ____A C:\Windows\System32\perfh007.dat
2013-06-06 07:01 - 2009-07-14 19:58 - 00140868 ____A C:\Windows\System32\perfc007.dat
2013-06-06 07:01 - 2009-07-14 07:13 - 01563502 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-05 22:45 - 2013-06-05 22:45 - 00036680 ____A C:\Windows\System32\Drivers\mbamchameleon.sys
2013-06-05 19:55 - 2013-06-05 19:55 - 00000000 ____D C:\Users\Andreas\Desktop\mbar-1.06.0.1003
2013-06-05 19:37 - 2012-03-30 19:52 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-03 22:10 - 2013-03-21 09:09 - 00000000 ____D C:\Users\Andreas\Desktop\Bewerbungen
2013-06-01 11:13 - 2013-03-29 17:29 - 00382536 ____A (BitDefender S.R.L.) C:\Windows\System32\Drivers\trufos.sys
2013-05-30 01:00 - 2010-12-13 19:32 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\TS3Client
2013-05-28 06:52 - 2013-06-05 19:55 - 13169742 ____A C:\Users\Andreas\Desktop\mbar-1.06.0.1003.zip
2013-05-28 06:11 - 2013-05-28 06:11 - 00162985 ____A C:\Users\Andreas\AppData\Local\2433f433
2013-05-17 20:12 - 2013-02-10 11:40 - 00000000 ____D C:\Windows\rescache
2013-05-17 07:23 - 2009-10-24 08:51 - 00000000 ___RD C:\Users\Andreas\Desktop\Programme
2013-05-17 06:57 - 2009-10-24 01:35 - 00000000 ____D C:\Windows\Panther
2013-05-16 21:19 - 2013-05-16 20:43 - 00009703 ____A C:\Windows\IE10_main.log
2013-05-16 21:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-05-16 20:51 - 2013-05-16 20:51 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-05-15 22:19 - 2009-07-14 06:45 - 00474616 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 18:17 - 2011-05-17 19:52 - 00000000 ____D C:\Users\Andreas\AppData\Local\CrashDumps
2013-05-15 18:09 - 2013-05-15 18:09 - 00000000 ____D C:\Windows\46ED2B6485C74E1F920CA555B21F2E4C.TMP
2013-05-15 18:09 - 2009-10-25 17:11 - 00000000 ____D C:\Users\Andreas\Documents\My Games
2013-05-15 18:08 - 2012-04-21 12:19 - 00296170 ____A C:\Windows\DirectX.log
2013-05-15 07:42 - 2009-10-24 09:35 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 07:37 - 2012-03-30 19:52 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-15 07:37 - 2011-06-09 19:54 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-12 18:39 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-05-09 22:07 - 2013-05-09 22:07 - 00000000 ____D C:\Users\Andreas\Documents\Amazon MP3
2013-05-09 20:37 - 2013-02-15 13:31 - 00000000 ____D C:\Program Files\Google
2013-05-09 20:37 - 2010-02-21 12:42 - 00000000 ____D C:\Program Files (x86)\Google
2013-05-09 18:09 - 2010-02-21 12:43 - 00000000 ____D C:\Users\Andreas\AppData\Local\Google

Files to move or delete:
====================
C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
C:\ProgramData\8498848.bat
C:\ProgramData\8498848.pad
C:\ProgramData\8498848.reg
C:\ProgramData\9123894.bat
C:\ProgramData\9123894.pad
C:\ProgramData\9123894.reg
C:\ProgramData\odivot.bat
C:\ProgramData\odivot.pad
C:\ProgramData\odivot.reg
C:\ProgramData\tovido.dat

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


Last Boot: 2013-06-05 19:12

==================== End Of Log ============================
         

Addition-Datei:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-06-2013 01
Ran by Andreas at 2013-06-06 20:11:00 Run:
Running from C:\Users\Andreas\Desktop
Boot Mode: Safe Mode (minimal)
==========================================================


==================== Installed Programs =======================

7-Zip 9.20
Adobe Flash Player 11 ActiveX (Version: 11.7.700.202)
Adobe Flash Player 11 Plugin (Version: 11.7.700.202)
Adobe Reader XI (11.0.03) - Deutsch (Version: 11.0.03)
Allgemeine Runtime Files (x86) (Version: 1.0.3.1)
Amazon MP3-Downloader 1.0.18 (Version: 1.0.18)
Amazon MP3-Downloader 1.0.9
Apple Application Support (Version: 2.3.3)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
Battlefield 3™ (Version: 1.0.0.0)
Bitdefender Internet Security 2013 (Version: 16.26.0.1739)
Bonjour (Version: 3.0.0.10)
Brother MFL-Pro Suite MFC-490CW (Version: 1.0.1.0)
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
CDBurnerXP (Version: 4.3.8.2523)
CDBurnerXP (Version: 4.4.0.3018)
Counter-Strike: Global Offensive Beta
DAEMON Tools Lite (Version: 4.45.4.0316)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dishonored (Version: 1.0)
ESN Sonar (Version: 0.70.0)
ESN Sonar (Version: 0.70.4)
FIFA 13 (Version: 1.0.0.0)
FLV Player 2.0 (build 25) (Version: 2.0 (build 25))
Free YouTube Download version 3.2.0.128 (Version: 3.2.0.128)
Hitman: Absolution
Hotspot Shield 2.88 (Version: 2.88)
Hotspot Shield Toolbar (Version: 6.9.0.16)
ICQ7.6 (Version: 7.6)
ImagXpress (Version: 7.0.74.0)
Interactive Dungeon
iTunes (Version: 11.0.2.26)
Java(TM) 6 Update 21 (64-bit) (Version: 6.0.210)
Java(TM) 6 Update 21 (Version: 6.0.210)
Joulemeter (Version: 1.1.0)
LibUSB-Win32-0.1.10.1 (Version: 0.1.10.1)
Logitech Gaming Software (Version: 8.20.74)
Logitech Gaming Software 8.20 (Version: 8.20.74)
LogMeIn Hamachi (Version: 2.1.0.294)
Magic: The Gathering - Duels of the Planeswalkers 2013
MailNavigator v.1.11 (Version: )
Mass Effect 2 (Version: 1.02)
Mass Effect™ 3 (Version: 1.05.0.0)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (Version: 3.5.50.0)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual J# 2.0 Redistributable Package (Version: 2.0.50727)
Microsoft Xbox 360 Accessories 1.1 (Version: 1.10.123.0)
mkv2vob (Version: 2.4.9)
MobileMe Control Panel (Version: 3.1.5.0)
Mozilla Firefox 18.0.2 (x86 de) (Version: 18.0.2)
MSD Sovereign
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (Version: 1.0.1.2)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser und SDK (Version: 4.20.9818.0)
NVIDIA 3D Vision Treiber 311.06 (Version: 311.06)
NVIDIA Grafiktreiber 311.06 (Version: 311.06)
NVIDIA HD-Audiotreiber 1.3.12.0 (Version: 1.3.12.0)
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA PhysX (Version: 9.12.0604)
NVIDIA PhysX-Systemsoftware 9.12.0604 (Version: 9.12.0604)
NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.1106)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
NVIDIA Update 1.11.3 (Version: 1.11.3)
NVIDIA Update Components (Version: 1.11.3)
OpenAL
Origin (Version: 8.5.0.4554)
Pando Media Booster (Version: 2.6.0.6)
PyMapper 8.2
QuickTime (Version: 7.73.80.64)
Realtek Ethernet Controller Driver For Windows 7 (Version: 7.11.1127.2009)
Realtek High Definition Audio Driver (Version: 6.0.1.6449)
RedMon - Redirection Port Monitor
Roleplaying City Map Generator (Version: 4.5.0.0)
Sid Meier's Civilization V
SimCity™ (Version: 1.0.0.0)
Star Trek Online
Steam (Version: 1.0.0.0)
Syndicate™ (Version: 1.0.0.1)
System Requirements Lab
TeamSpeak 3 Client (Version: 3.0.10.1)
TIPP10 Version 2.1.0
TomTom HOME (Version: 2.9.1)
TomTom HOME Visual Studio Merge Modules (Version: 1.0.2)
Tt eSPORTS Challenger Ultimate (Version: 2.0.2.0)
Ubisoft Game Launcher (Version: 1.0.0.0)
UltraStar Deluxe (Version: 1.1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
Uplay (Version: 2.0)
Visual C++ 2008 x64 Runtime - (v9.0.30729.5026) (Version: 9.0.30729.5026)
Visual C++ 2008 x64 Runtime - v9.0.30729.5026 (Version: 9.0.30729.5026)
Visual C++ 2008 x86 Runtime - (v9.0.30729.5026) (Version: 9.0.30729.5026)
Visual C++ 2008 x86 Runtime - v9.0.30729.5026 (Version: 9.0.30729.5026)
VLC media player 1.0.3 (Version: 1.0.3)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
WinRAR
Wondershare PPT to Video 4.7.0.11 Trial
XCOM: Enemy Unknown
Xfire (remove only)
Xilisoft Video Converter Ultimate (Version: 7.7.1.20130115)
XMedia Recode 3.0.4.6 (Version: 3.0.4.6)
YAWLE 0.5b

==================== Restore Points  =========================

05-06-2013 20:58:41 Malwarebytes Anti-Rootkit Restore Point
06-06-2013 04:52:11 Malwarebytes Anti-Rootkit Restore Point
06-06-2013 05:30:37 Malwarebytes Anti-Rootkit Restore Point

==================== Faulty Device Manager Devices =============

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/05/2013 09:31:14 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Users\Andreas\Desktop\mbar-1.06.0.1003\mbar\mbar.exe ; Beschreibung = Malwarebytes Anti-Rootkit Restore Point; Fehler = 0x8007043c).

Error: (06/05/2013 09:01:52 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Users\Andreas\Desktop\mbar-1.06.0.1003\mbar\mbar.exe ; Beschreibung = Malwarebytes Anti-Rootkit Restore Point; Fehler = 0x8007043c).

Error: (06/05/2013 08:07:52 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Users\Andreas\Desktop\mbar-1.06.0.1003\mbar\mbar.exe ; Beschreibung = Malwarebytes Anti-Rootkit Restore Point; Fehler = 0x8007043c).

Error: (06/04/2013 06:59:29 AM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 10.0.9200.16576 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1288

Startzeit: 01ce60e023a1bd8f

Endzeit: 62

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (05/15/2013 06:17:28 PM) (Source: MsiInstaller) (User: Win7-Game-PC)
Description: Product: NVIDIA PhysX -- Installation terminated

Error: (05/15/2013 06:17:22 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Dishonored.exe, Version: 1.0.0.0, Zeitstempel: 0x5167d60f
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18015, Zeitstempel: 0x50b83c8a
Ausnahmecode: 0x00000001
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x136c
Startzeit der fehlerhaften Anwendung: 0xDishonored.exe0
Pfad der fehlerhaften Anwendung: Dishonored.exe1
Pfad des fehlerhaften Moduls: Dishonored.exe2
Berichtskennung: Dishonored.exe3

Error: (05/15/2013 06:17:15 PM) (Source: MsiInstaller) (User: Win7-Game-PC)
Description: Product: NVIDIA PhysX -- Installation terminated

Error: (05/15/2013 06:09:07 PM) (Source: MsiInstaller) (User: Win7-Game-PC)
Description: Product: NVIDIA PhysX -- Installation terminated

Error: (05/09/2013 08:48:00 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16476, Zeitstempel: 0x5126e7ac
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x4c545049
ID des fehlerhaften Prozesses: 0xdb4
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (05/08/2013 07:55:05 PM) (Source: Application Hang) (User: )
Description: Programm CivilizationV_DX11.exe, Version 1.0.2.44 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: f9c

Startzeit: 01ce4c14c1a87102

Endzeit: 623

Anwendungspfad: G:\Call of Duty - Modern Warfare 2\steamapps\common\Sid Meier's Civilization V\CivilizationV_DX11.exe

Berichts-ID:


System errors:
=============
Error: (06/06/2013 08:10:20 PM) (Source: DCOM) (User: )
Description: 1084NVSvc{DCAB0989-1301-4319-BE5F-ADE89F88581C}

Error: (06/06/2013 08:09:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/06/2013 08:09:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/06/2013 08:09:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/06/2013 08:09:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/06/2013 08:09:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/06/2013 08:09:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/06/2013 08:09:16 PM) (Source: DCOM) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (06/06/2013 08:09:16 PM) (Source: DCOM) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (06/06/2013 08:09:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068


Microsoft Office Sessions:
=========================
Error: (06/05/2013 09:31:14 PM) (Source: System Restore)(User: )
Description: C:\Users\Andreas\Desktop\mbar-1.06.0.1003\mbar\mbar.exe Malwarebytes Anti-Rootkit Restore Point0x8007043c

Error: (06/05/2013 09:01:52 PM) (Source: System Restore)(User: )
Description: C:\Users\Andreas\Desktop\mbar-1.06.0.1003\mbar\mbar.exe Malwarebytes Anti-Rootkit Restore Point0x8007043c

Error: (06/05/2013 08:07:52 PM) (Source: System Restore)(User: )
Description: C:\Users\Andreas\Desktop\mbar-1.06.0.1003\mbar\mbar.exe Malwarebytes Anti-Rootkit Restore Point0x8007043c

Error: (06/04/2013 06:59:29 AM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE10.0.9200.16576128801ce60e023a1bd8f62C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (05/15/2013 06:17:28 PM) (Source: MsiInstaller)(User: Win7-Game-PC)
Description: Product: NVIDIA PhysX -- Installation terminated(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (05/15/2013 06:17:22 PM) (Source: Application Error)(User: )
Description: Dishonored.exe1.0.0.05167d60fKERNELBASE.dll6.1.7601.1801550b83c8a000000010000c41f136c01ce5187aa64cc02G:\Call of Duty - Modern Warfare 2\steamapps\common\Dishonored\Binaries\Win32\Dishonored.exeC:\Windows\syswow64\KERNELBASE.dllebbc7aec-bd7a-11e2-ba2d-001a4d5e8039

Error: (05/15/2013 06:17:15 PM) (Source: MsiInstaller)(User: Win7-Game-PC)
Description: Product: NVIDIA PhysX -- Installation terminated(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (05/15/2013 06:09:07 PM) (Source: MsiInstaller)(User: Win7-Game-PC)
Description: Product: NVIDIA PhysX -- Installation terminated(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (05/09/2013 08:48:00 AM) (Source: Application Error)(User: )
Description: iexplore.exe9.0.8112.164765126e7acunknown0.0.0.000000000c00000054c545049db401ce4c81101dccfbc:\program files (x86)\internet explorer\iexplore.exeunknown631ee97c-b874-11e2-b582-001a4d5e8039

Error: (05/08/2013 07:55:05 PM) (Source: Application Hang)(User: )
Description: CivilizationV_DX11.exe1.0.2.44f9c01ce4c14c1a87102623G:\Call of Duty - Modern Warfare 2\steamapps\common\Sid Meier's Civilization V\CivilizationV_DX11.exe


CodeIntegrity Errors:
===================================
  Date: 2013-01-08 19:46:21.012
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-08 19:46:20.932
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 8190.49 MB
Available physical RAM: 6908.58 MB
Total Pagefile: 16379.17 MB
Available Pagefile: 15135.21 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Windows 7) (Fixed) (Total:78.12 GB) (Free:8.47 GB) NTFS (Disk=1 Partition=1)
Drive f: () (Removable) (Total:7.53 GB) (Free:7.5 GB) FAT32 (Disk=2 Partition=1)
Drive g: (Games) (Fixed) (Total:195.31 GB) (Free:42.71 GB) NTFS (Disk=1 Partition=2)
Drive h: (Daten) (Fixed) (Total:192.32 GB) (Free:41.35 GB) NTFS (Disk=1 Partition=3)
Drive i: (Downloads) (Fixed) (Total:74.43 GB) (Free:20.13 GB) NTFS (Disk=0 Partition=2)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 75 GB) (Disk ID: 0082803E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=74 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 00000001)
Partition 1: (Not Active) - (Size=78 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=192 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 8 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=8 GB) - (Type=0C)

==================== End Of Log ============================
         

Hier ist ja sehr viel los

soll heissen?

Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKCU\...\Run: [ctfmon.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\tovido.dat,FG00 [159744 2013-06-05] ()
HKCU\...\Command Processor: "C:\Users\Andreas\Documents\3ae9184b.exe"
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
ShortcutTarget: msconfig.lnk -> C:\PROGRA~3\tovido.dat ()
C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
C:\ProgramData\8498848.bat
C:\ProgramData\8498848.pad
C:\ProgramData\8498848.reg
C:\ProgramData\9123894.bat
C:\ProgramData\9123894.pad
C:\ProgramData\9123894.reg
C:\ProgramData\odivot.bat
C:\ProgramData\odivot.pad
C:\ProgramData\odivot.reg
C:\ProgramData\tovido.dat
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Fix Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Soll heißen, dass sich viele den GVU-Trojaner eingefangen haben. :-(

Die Fixlog poste ich (leider wieder erst) heute Abend.

Vielen Dank schonmal!

Kein Ding.

Nach dem Fixen bitte Rechner normal hoch booten und freuen

Auch nochmal Malware Bytes und Virenscanner drüberlaufen lassen?

FRST neu laden, auf dem Desktop speichern, laufen lassen und Logs posten, aber alles im Normal-Modus.

Es funktioniert!!!


Wie hast du das gemacht?

Fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-06-2013 01
Ran by Andreas at 2013-06-07 18:49:26 Run:1
Running from C:\Users\Andreas\Desktop
Boot Mode: Safe Mode (minimal)
==============================================

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon.exe => Value deleted successfully.
HKCU\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk => Moved successfully.
C:\PROGRA~3\tovido.dat => Moved successfully.
C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk => File/Directory not found.
C:\ProgramData\8498848.bat => Moved successfully.
C:\ProgramData\8498848.pad => Moved successfully.
C:\ProgramData\8498848.reg => Moved successfully.
C:\ProgramData\9123894.bat => Moved successfully.
C:\ProgramData\9123894.pad => Moved successfully.
C:\ProgramData\9123894.reg => Moved successfully.
C:\ProgramData\odivot.bat => Moved successfully.
C:\ProgramData\odivot.pad => Moved successfully.
C:\ProgramData\odivot.reg => Moved successfully.
C:\ProgramData\tovido.da => File/Directory not found.

==== End of Fixlog ====
         

Die anderen beiden Logs kommen gleich.

Edit: Ups, sehe gerade, dass ich tovido.da statt tovido.dat eingegeben habe.
Nochmal neu?

Hier die FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-06-2013 01
Ran by Andreas (administrator) on 07-06-2013 18:59:51
Running from C:\Users\Andreas\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
() C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe
() C:\Users\Andreas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Chicony) C:\Program Files (x86)\Thermaltake Ttesports Ultimate\Ttsystray3.exe
(Chicony) C:\Program Files (x86)\Thermaltake Ttesports Ultimate\tTOSD2k1001.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12681320 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe /minimized [5889816 2011-12-07] (Logitech Inc.)
HKLM\...\Run: [Bdagent] C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1569536 2013-04-29] (Bitdefender)
HKCU\...\Run: [AmazonMP3DownloaderHelper] C:\Users\Andreas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [397632 2013-05-02] ()
HKCU\...\Winlogon: [Shell] Explorer.exe
MountPoints2: D - D:\Autorun.exe
MountPoints2: {81259008-5c1f-11e2-8ccb-001a4d5e8039} - J:\AutoRun.exe {D2D77DC2-8299-11D1-8949-444553540000} 5.2066.1.A11B02 PID_0083
MountPoints2: {c4aea240-100b-11e2-a44b-806e6f6e6963} - F:\AutoRun.exe
HKLM-x32\...\Run: [NWEReboot]  [x]
HKLM-x32\...\Run: [BrMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ChallengerUltimate] "C:\Program Files (x86)\Thermaltake Ttesports Ultimate\Ttsystray3.exe" [1254912 2010-08-05] (Chicony)
HKLM-x32\...\Run: [ChallengerUltimateOSD] "C:\Program Files (x86)\Thermaltake Ttesports Ultimate\tTOSD2k1001.exe" [634880 2010-08-05] (Chicony)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)

==================== Internet (Whitelisted) ====================

ProxyServer: http=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: (No Name) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} -  No File
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {F989F9AF-5E01-4188-A5C2-D0510799BAD1} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1561552
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Oracle)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll (AnchorFree Inc.)
BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} -  No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files (x86)\Hotspot_Shield\prxtbHots.dll (Conduit Ltd.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Oracle)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
BHO-x32: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
Toolbar: HKLM-x32 - Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files (x86)\Hotspot_Shield\prxtbHots.dll (Conduit Ltd.)
Toolbar: HKCU - No Name - {C95A4E8E-816D-4655-8C79-D736DA1ADB6D} -  No File
PDF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
PDF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
PDF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

FireFox:
========
FF ProfilePath: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\1mllhi2f.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.3 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

==================== Services (Whitelisted) =================

S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [69392 2013-03-30] (Bitdefender)
R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe [545576 2013-02-23] (AnchorFree Inc.)
S4 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [78512 2013-02-22] ()
R2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [389928 2013-02-23] ()
S2 libusbd; C:\Windows\SysWow64\libusbd-nt.exe [18944 2005-03-09] (hxxp://libusb-win32.sourceforge.net)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-02-12] ()
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [68856 2013-03-30] (Bitdefender)
R2 vsserv; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1646792 2013-06-01] (Bitdefender)

==================== Drivers (Whitelisted) ====================

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [718840 2013-04-29] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [593144 2013-04-29] (BitDefender)
R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-04-29] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82384 2012-11-12] (BitDefender SRL)
R0 CLBStor; C:\Windows\System32\DRIVERS\CLBStor.sys [24560 2007-10-26] (Cyberlink Co.,Ltd.)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [147232 2013-03-30] (BitDefender LLC)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [46280 2013-02-22] (AnchorFree Inc.)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66328 2011-10-24] (Logitech Inc.)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [36680 2013-06-05] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2012-10-07] (Duplex Secure Ltd.)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-02-22] (Anchorfree Inc.)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [382536 2013-06-01] (BitDefender S.R.L.)
U3 avvszoxi; C:\Windows\System32\Drivers\avvszoxi.sys [0 ] (Advanced Micro Devices)
S4 InCDFs; system32\drivers\InCDFs.sys [x]
S1 InCDPass; system32\drivers\InCDPass.sys [x]
S1 InCDRm; system32\drivers\InCDRm.sys [x]
U3 JavaQuickStarterService; 
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-07 18:59 - 2013-06-07 18:59 - 01918758 ____A (Farbar) C:\Users\Andreas\Desktop\FRST64.exe
2013-06-07 18:52 - 2013-06-07 18:52 - 00000000 ____D C:\Users\Andreas\Desktop\Fixlog
2013-06-06 20:10 - 2013-06-06 20:10 - 00000000 ____D C:\FRST
2013-06-05 22:45 - 2013-06-05 22:45 - 00036680 ____A C:\Windows\System32\Drivers\mbamchameleon.sys
2013-06-05 19:55 - 2013-06-05 19:55 - 00000000 ____D C:\Users\Andreas\Desktop\mbar-1.06.0.1003
2013-06-05 19:55 - 2013-05-28 06:52 - 13169742 ____A C:\Users\Andreas\Desktop\mbar-1.06.0.1003.zip
2013-05-28 06:11 - 2013-05-28 06:11 - 00162985 ____A C:\Users\Andreas\AppData\Local\2433f433
2013-05-16 21:19 - 2013-02-17 01:40 - 00028672 ____A (Microsoft Corporation) C:\Windows\System32\IEUDINIT.EXE
2013-05-16 20:51 - 2013-05-16 20:51 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-05-16 20:43 - 2013-05-16 21:19 - 00009703 ____A C:\Windows\IE10_main.log
2013-05-15 18:09 - 2013-05-15 18:09 - 00000000 ____D C:\Windows\46ED2B6485C74E1F920CA555B21F2E4C.TMP
2013-05-15 07:38 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 07:38 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-15 07:38 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-15 07:38 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-15 07:38 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-15 07:38 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-15 07:38 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-15 07:38 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-15 07:38 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-15 07:38 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-15 07:38 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-15 07:38 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-15 07:38 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-05-15 07:38 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-09 22:07 - 2013-05-09 22:07 - 00000000 ____D C:\Users\Andreas\Documents\Amazon MP3

==================== One Month Modified Files and Folders =======

2013-06-07 18:59 - 2013-06-07 18:59 - 01918758 ____A (Farbar) C:\Users\Andreas\Desktop\FRST64.exe
2013-06-07 18:58 - 2009-10-24 00:39 - 01216607 ____A C:\Windows\WindowsUpdate.log
2013-06-07 18:56 - 2009-07-14 19:58 - 00677804 ____A C:\Windows\System32\perfh007.dat
2013-06-07 18:56 - 2009-07-14 19:58 - 00140868 ____A C:\Windows\System32\perfc007.dat
2013-06-07 18:56 - 2009-07-14 07:13 - 01563502 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-07 18:52 - 2013-06-07 18:52 - 00000000 ____D C:\Users\Andreas\Desktop\Fixlog
2013-06-07 18:51 - 2012-02-27 17:48 - 00084217 ____A C:\Windows\setupact.log
2013-06-07 18:51 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-06 20:10 - 2013-06-06 20:10 - 00000000 ____D C:\FRST
2013-06-06 07:37 - 2009-07-14 06:45 - 00013744 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-06 07:37 - 2009-07-14 06:45 - 00013744 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-06 07:32 - 2012-02-27 17:48 - 00399168 ____A C:\Windows\PFRO.log
2013-06-05 22:45 - 2013-06-05 22:45 - 00036680 ____A C:\Windows\System32\Drivers\mbamchameleon.sys
2013-06-05 19:55 - 2013-06-05 19:55 - 00000000 ____D C:\Users\Andreas\Desktop\mbar-1.06.0.1003
2013-06-05 19:37 - 2012-03-30 19:52 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-03 22:10 - 2013-03-21 09:09 - 00000000 ____D C:\Users\Andreas\Desktop\Bewerbungen
2013-06-01 11:13 - 2013-03-29 17:29 - 00382536 ____A (BitDefender S.R.L.) C:\Windows\System32\Drivers\trufos.sys
2013-05-30 01:00 - 2010-12-13 19:32 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\TS3Client
2013-05-28 06:52 - 2013-06-05 19:55 - 13169742 ____A C:\Users\Andreas\Desktop\mbar-1.06.0.1003.zip
2013-05-28 06:11 - 2013-05-28 06:11 - 00162985 ____A C:\Users\Andreas\AppData\Local\2433f433
2013-05-17 20:12 - 2013-02-10 11:40 - 00000000 ____D C:\Windows\rescache
2013-05-17 07:23 - 2009-10-24 08:51 - 00000000 ___RD C:\Users\Andreas\Desktop\Programme
2013-05-17 06:57 - 2009-10-24 01:35 - 00000000 ____D C:\Windows\Panther
2013-05-16 21:19 - 2013-05-16 20:43 - 00009703 ____A C:\Windows\IE10_main.log
2013-05-16 21:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-05-16 20:51 - 2013-05-16 20:51 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-05-15 22:19 - 2009-07-14 06:45 - 00474616 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 18:17 - 2011-05-17 19:52 - 00000000 ____D C:\Users\Andreas\AppData\Local\CrashDumps
2013-05-15 18:09 - 2013-05-15 18:09 - 00000000 ____D C:\Windows\46ED2B6485C74E1F920CA555B21F2E4C.TMP
2013-05-15 18:09 - 2009-10-25 17:11 - 00000000 ____D C:\Users\Andreas\Documents\My Games
2013-05-15 18:08 - 2012-04-21 12:19 - 00296170 ____A C:\Windows\DirectX.log
2013-05-15 07:42 - 2009-10-24 09:35 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 07:37 - 2012-03-30 19:52 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-15 07:37 - 2011-06-09 19:54 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-12 18:39 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-05-09 22:07 - 2013-05-09 22:07 - 00000000 ____D C:\Users\Andreas\Documents\Amazon MP3
2013-05-09 20:37 - 2013-02-15 13:31 - 00000000 ____D C:\Program Files\Google
2013-05-09 20:37 - 2010-02-21 12:42 - 00000000 ____D C:\Program Files (x86)\Google
2013-05-09 18:09 - 2010-02-21 12:43 - 00000000 ____D C:\Users\Andreas\AppData\Local\Google

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


Last Boot: 2013-06-05 19:12

==================== End Of Log ============================
         

Wie hast du das gemacht?

ich kann zaubern

Die eine Datei machen wir nachher.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST logfile

Ui, Eset hat die halbe nacht gescannt, hat mehrere Stunden gedauert.

Also, fangen wir an:

Adw-Cleaner Log:

# AdwCleaner v2.302 - Datei am 07/06/2013 um 19:14:37 erstellt
# Aktualisiert am 06/06/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Andreas - WIN7-GAME-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Andreas\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Gelöscht mit Neustart : C:\Program Files (x86)\Hotspot Shield
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\Hotspot_Shield
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com
Ordner Gelöscht : C:\Program Files (x86)\Wondershare
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Hotspot Shield
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
Ordner Gelöscht : C:\ProgramData\Trymedia
Ordner Gelöscht : C:\Users\Andreas\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\Andreas\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Andreas\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Andreas\AppData\LocalLow\Hotspot_Shield
Ordner Gelöscht : C:\Users\Andreas\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\Hotspot Shield
Ordner Gelöscht : C:\Windows\SysWOW64\Hotspot Shield

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Hotspot_Shield
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87EAB409-97D7-4889-ACFA-C548FC6F3ECF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT1561552
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Hotspot_Shield
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{87EAB409-97D7-4889-ACFA-C548FC6F3ECF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{87EAB409-97D7-4889-ACFA-C548FC6F3ECF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04540672-AF49-452A-8B83-99A4BCC8C328}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{67B59B74-8705-4635-B179-F5F9CFA97E1F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Hotspot_Shield Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v18.0.2 (de)

Datei : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\1mllhi2f.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [6929 octets] - [07/06/2013 19:14:37]

########## EOF - C:\AdwCleaner[S1].txt - [6989 octets] ##########
         

Junkware Log:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by Andreas on 07.06.2013 at 19:20:20,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{F989F9AF-5E01-4188-A5C2-D0510799BAD1}



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.06.2013 at 19:25:30,63
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Eset Log:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=a51cda2fff12a542b488724e3905d2e7
# engine=14021
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-07 10:56:16
# local_time=2013-06-08 12:56:16 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 59758890 122275626 0 0
# scanned=262865
# found=19
# cleaned=0
# scan_time=19690
sh=927C4CC8897C9805953F436B2D425928B2D8EBBA ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\FRST\Quarantine\msconfig.lnk"
sh=DC310B793CF0EE6804DF4CBA5C9AA8824A18DE01 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\FRST\Quarantine\odivot.bat"
sh=19E09BEA2550251F55BCB30064BE3C01808DF52F ft=1 fh=628acaec49a000d5 vn="a variant of Win32/Kryptik.BCXV trojan" ac=I fn="C:\FRST\Quarantine\tovido.dat"
sh=3B16A6D936056BF62DB16B8CCBAC2E667A6B1413 ft=0 fh=0000000000000000 vn="HTML/Ransom.B trojan" ac=I fn="C:\ProgramData\wpsbcbssifblxrb\main.html"
sh=6DFB1E0A4A190D5CBFEAC13842382EBDA4431B6D ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Andreas\AppData\Local\Temp\jar_cache659388532113520413.tmp"
sh=13CA3CA13F17CAB27C039691828A1EB86D05491F ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Andreas\AppData\Local\Temp\jar_cache7539669847715819330.tmp"
sh=2D5EA25AAE47E46E12A7EAA5A710EFA345EF818D ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.OML trojan" ac=I fn="C:\Users\Andreas\AppData\Local\Temp\jar_cache9200953865970518054.tmp"
sh=19E09BEA2550251F55BCB30064BE3C01808DF52F ft=1 fh=628acaec49a000d5 vn="a variant of Win32/Kryptik.BCXV trojan" ac=I fn="C:\Users\Andreas\AppData\Local\Temp\lropntsppybbghckaer.bfg"
sh=8BD800FDEE217A97989014B45F38B216364CC41A ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.OLH trojan" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\5806e48c-5b0e445c"
sh=64F68F918FD98A149C7534C238877F6004B81EBF ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\14d9f4d9-7d67423d"
sh=1EF039BE45F9FBE535250108AC7A686DD4BAF4C1 ft=0 fh=0000000000000000 vn="Java/TrojanDownloader.OpenStream.NAX trojan" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\35f1045a-1200bd43"
sh=19E09BEA2550251F55BCB30064BE3C01808DF52F ft=1 fh=628acaec49a000d5 vn="a variant of Win32/Kryptik.BCXV trojan" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\5a4bbde5-79f45aff"
sh=1512FC04D34C5BC42A6103574073A6E72BE7B4D0 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\da72fa8-1f088d0c"
sh=13CA3CA13F17CAB27C039691828A1EB86D05491F ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\6c76df31-3b343e4d"
sh=6DFB1E0A4A190D5CBFEAC13842382EBDA4431B6D ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\6c76df31-408bcdeb"
sh=13CA3CA13F17CAB27C039691828A1EB86D05491F ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\6c76df31-4f5682e7"
sh=6DFB1E0A4A190D5CBFEAC13842382EBDA4431B6D ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\6c76df31-58551d2d"
sh=6DFB1E0A4A190D5CBFEAC13842382EBDA4431B6D ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\6c76df31-753b5348"
sh=E654A5C91EC4B33C925BE28641368B2207A75B13 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2012-0507.FQ trojan" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\52ea7dbd-3e138f31"
         

Security Check Log:

 Results of screen317's Security Check version 0.99.64  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Bitdefender Virenschutz   
 Antivirus out of date! (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Java(TM) 6 Update 21  
 Java version out of Date! 
 Adobe Flash Player 11.7.700.202  
 Adobe Reader XI  
 Mozilla Firefox 18.0.2 Firefox out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 Thermaltake Ttesports Ultimate Ttsystray3.exe   
 Thermaltake Ttesports Ultimate tTOSD2k1001.exe   
 Bitdefender Bitdefender 2013 vsserv.exe  
 Bitdefender Bitdefender 2013 updatesrv.exe  
 Bitdefender Bitdefender 2013 bdagent.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

Und ein frisches FRST Log:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-06-2013 01
Ran by Andreas (administrator) on 08-06-2013 05:54:44
Running from C:\Users\Andreas\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe
() C:\Users\Andreas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Chicony) C:\Program Files (x86)\Thermaltake Ttesports Ultimate\Ttsystray3.exe
(Chicony) C:\Program Files (x86)\Thermaltake Ttesports Ultimate\tTOSD2k1001.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12681320 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe /minimized [5889816 2011-12-07] (Logitech Inc.)
HKLM\...\Run: [Bdagent] C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1569536 2013-04-29] (Bitdefender)
HKCU\...\Run: [AmazonMP3DownloaderHelper] C:\Users\Andreas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [397632 2013-05-02] ()
HKCU\...\Winlogon: [Shell] Explorer.exe
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
MountPoints2: D - D:\Autorun.exe
MountPoints2: {81259008-5c1f-11e2-8ccb-001a4d5e8039} - J:\AutoRun.exe {D2D77DC2-8299-11D1-8949-444553540000} 5.2066.1.A11B02 PID_0083
MountPoints2: {c4aea240-100b-11e2-a44b-806e6f6e6963} - F:\AutoRun.exe
HKLM-x32\...\Run: [NWEReboot]  [x]
HKLM-x32\...\Run: [BrMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ChallengerUltimate] "C:\Program Files (x86)\Thermaltake Ttesports Ultimate\Ttsystray3.exe" [1254912 2010-08-05] (Chicony)
HKLM-x32\...\Run: [ChallengerUltimateOSD] "C:\Program Files (x86)\Thermaltake Ttesports Ultimate\tTOSD2k1001.exe" [634880 2010-08-05] (Chicony)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)

==================== Internet (Whitelisted) ====================

ProxyServer: http=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Oracle)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Oracle)
PDF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
PDF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
PDF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\1mllhi2f.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.3 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

==================== Services (Whitelisted) =================

S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [69392 2013-03-30] (Bitdefender)
S2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe [545576 2013-02-23] (AnchorFree Inc.)
S4 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [78512 2013-02-22] ()
R2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [389928 2013-02-23] ()
S2 libusbd; C:\Windows\SysWow64\libusbd-nt.exe [18944 2005-03-09] (hxxp://libusb-win32.sourceforge.net)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-02-12] ()
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [68856 2013-03-30] (Bitdefender)
R2 vsserv; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1646792 2013-06-01] (Bitdefender)

==================== Drivers (Whitelisted) ====================

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [718840 2013-04-29] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [593144 2013-04-29] (BitDefender)
R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-04-29] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82384 2012-11-12] (BitDefender SRL)
R0 CLBStor; C:\Windows\System32\DRIVERS\CLBStor.sys [24560 2007-10-26] (Cyberlink Co.,Ltd.)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [147232 2013-03-30] (BitDefender LLC)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [46280 2013-02-22] (AnchorFree Inc.)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66328 2011-10-24] (Logitech Inc.)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [36680 2013-06-05] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2012-10-07] (Duplex Secure Ltd.)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-02-22] (Anchorfree Inc.)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [382536 2013-06-01] (BitDefender S.R.L.)
U3 aj7nd911; C:\Windows\System32\Drivers\aj7nd911.sys [0 ] (Advanced Micro Devices)
S4 InCDFs; system32\drivers\InCDFs.sys [x]
S1 InCDPass; system32\drivers\InCDPass.sys [x]
S1 InCDRm; system32\drivers\InCDRm.sys [x]
U3 JavaQuickStarterService; 
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-07 19:26 - 2013-06-07 19:26 - 00000000 ____D C:\Program Files (x86)\ESET
2013-06-07 19:20 - 2013-06-07 19:20 - 00000000 ____D C:\Windows\ERUNT
2013-06-07 19:20 - 2013-06-07 19:20 - 00000000 ____D C:\JRT
2013-06-07 19:14 - 2013-06-07 19:14 - 00007048 ____A C:\AdwCleaner[S1].txt
2013-06-07 19:14 - 2013-06-07 19:14 - 00000105 ____A C:\Windows\DeleteOnReboot.bat
2013-06-07 18:59 - 2013-06-07 18:59 - 01918758 ____A (Farbar) C:\Users\Andreas\Desktop\FRST64.exe
2013-06-07 18:52 - 2013-06-07 18:52 - 00000000 ____D C:\Users\Andreas\Desktop\Fixlog
2013-06-06 20:10 - 2013-06-06 20:10 - 00000000 ____D C:\FRST
2013-06-05 22:45 - 2013-06-05 22:45 - 00036680 ____A C:\Windows\System32\Drivers\mbamchameleon.sys
2013-06-05 19:55 - 2013-06-05 19:55 - 00000000 ____D C:\Users\Andreas\Desktop\mbar-1.06.0.1003
2013-06-05 19:55 - 2013-05-28 06:52 - 13169742 ____A C:\Users\Andreas\Desktop\mbar-1.06.0.1003.zip
2013-05-28 06:11 - 2013-05-28 06:11 - 00162985 ____A C:\Users\Andreas\AppData\Local\2433f433
2013-05-16 21:19 - 2013-02-17 01:40 - 00028672 ____A (Microsoft Corporation) C:\Windows\System32\IEUDINIT.EXE
2013-05-16 20:51 - 2013-05-16 20:51 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-05-16 20:43 - 2013-05-16 21:19 - 00009703 ____A C:\Windows\IE10_main.log
2013-05-15 18:09 - 2013-05-15 18:09 - 00000000 ____D C:\Windows\46ED2B6485C74E1F920CA555B21F2E4C.TMP
2013-05-15 07:38 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 07:38 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-15 07:38 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-15 07:38 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-15 07:38 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-15 07:38 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-15 07:38 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-15 07:38 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-15 07:38 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-15 07:38 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-15 07:38 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-15 07:38 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-15 07:38 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-05-15 07:38 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-09 22:07 - 2013-05-09 22:07 - 00000000 ____D C:\Users\Andreas\Documents\Amazon MP3

==================== One Month Modified Files and Folders =======

2013-06-08 05:48 - 2009-10-24 00:39 - 01247935 ____A C:\Windows\WindowsUpdate.log
2013-06-08 05:47 - 2009-07-14 06:45 - 00013744 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-08 05:47 - 2009-07-14 06:45 - 00013744 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-08 05:46 - 2009-07-14 19:58 - 00677804 ____A C:\Windows\System32\perfh007.dat
2013-06-08 05:46 - 2009-07-14 19:58 - 00140868 ____A C:\Windows\System32\perfc007.dat
2013-06-08 05:46 - 2009-07-14 07:13 - 01563502 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-08 05:40 - 2012-02-27 17:48 - 00084329 ____A C:\Windows\setupact.log
2013-06-08 05:40 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-07 23:37 - 2012-03-30 19:52 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-07 19:26 - 2013-06-07 19:26 - 00000000 ____D C:\Program Files (x86)\ESET
2013-06-07 19:20 - 2013-06-07 19:20 - 00000000 ____D C:\Windows\ERUNT
2013-06-07 19:20 - 2013-06-07 19:20 - 00000000 ____D C:\JRT
2013-06-07 19:14 - 2013-06-07 19:14 - 00007048 ____A C:\AdwCleaner[S1].txt
2013-06-07 19:14 - 2013-06-07 19:14 - 00000105 ____A C:\Windows\DeleteOnReboot.bat
2013-06-07 19:14 - 2012-04-19 20:05 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2013-06-07 18:59 - 2013-06-07 18:59 - 01918758 ____A (Farbar) C:\Users\Andreas\Desktop\FRST64.exe
2013-06-07 18:52 - 2013-06-07 18:52 - 00000000 ____D C:\Users\Andreas\Desktop\Fixlog
2013-06-06 20:10 - 2013-06-06 20:10 - 00000000 ____D C:\FRST
2013-06-06 07:32 - 2012-02-27 17:48 - 00399168 ____A C:\Windows\PFRO.log
2013-06-05 22:45 - 2013-06-05 22:45 - 00036680 ____A C:\Windows\System32\Drivers\mbamchameleon.sys
2013-06-05 19:55 - 2013-06-05 19:55 - 00000000 ____D C:\Users\Andreas\Desktop\mbar-1.06.0.1003
2013-06-03 22:10 - 2013-03-21 09:09 - 00000000 ____D C:\Users\Andreas\Desktop\Bewerbungen
2013-06-01 11:13 - 2013-03-29 17:29 - 00382536 ____A (BitDefender S.R.L.) C:\Windows\System32\Drivers\trufos.sys
2013-05-30 01:00 - 2010-12-13 19:32 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\TS3Client
2013-05-28 06:52 - 2013-06-05 19:55 - 13169742 ____A C:\Users\Andreas\Desktop\mbar-1.06.0.1003.zip
2013-05-28 06:11 - 2013-05-28 06:11 - 00162985 ____A C:\Users\Andreas\AppData\Local\2433f433
2013-05-17 20:12 - 2013-02-10 11:40 - 00000000 ____D C:\Windows\rescache
2013-05-17 07:23 - 2009-10-24 08:51 - 00000000 ___RD C:\Users\Andreas\Desktop\Programme
2013-05-17 06:57 - 2009-10-24 01:35 - 00000000 ____D C:\Windows\Panther
2013-05-16 21:19 - 2013-05-16 20:43 - 00009703 ____A C:\Windows\IE10_main.log
2013-05-16 21:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-05-16 20:51 - 2013-05-16 20:51 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-16 20:51 - 2013-05-16 20:51 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-05-16 20:51 - 2013-05-16 20:51 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-05-16 20:51 - 2013-05-16 20:51 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-05-16 20:51 - 2013-05-16 20:51 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-05-16 20:51 - 2013-05-16 20:51 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-05-16 20:51 - 2013-05-16 20:51 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-05-15 22:19 - 2009-07-14 06:45 - 00474616 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 18:17 - 2011-05-17 19:52 - 00000000 ____D C:\Users\Andreas\AppData\Local\CrashDumps
2013-05-15 18:09 - 2013-05-15 18:09 - 00000000 ____D C:\Windows\46ED2B6485C74E1F920CA555B21F2E4C.TMP
2013-05-15 18:09 - 2009-10-25 17:11 - 00000000 ____D C:\Users\Andreas\Documents\My Games
2013-05-15 18:08 - 2012-04-21 12:19 - 00296170 ____A C:\Windows\DirectX.log
2013-05-15 07:42 - 2009-10-24 09:35 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 07:37 - 2012-03-30 19:52 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-15 07:37 - 2011-06-09 19:54 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-12 18:39 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-05-09 22:07 - 2013-05-09 22:07 - 00000000 ____D C:\Users\Andreas\Documents\Amazon MP3
2013-05-09 20:37 - 2013-02-15 13:31 - 00000000 ____D C:\Program Files\Google
2013-05-09 20:37 - 2010-02-21 12:42 - 00000000 ____D C:\Program Files (x86)\Google
2013-05-09 18:09 - 2010-02-21 12:43 - 00000000 ____D C:\Users\Andreas\AppData\Local\Google

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


Last Boot: 2013-06-05 19:12

==================== End Of Log ============================
         

Puh. :-)

Bitdefender, java und Firefox bitte updaten.


Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.


Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

C:\ProgramData\wpsbcbssifblxrb
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Fix Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Noch probleme?

Super, danke. Werde ich heute Abend direkt machen. Ist das System dann wieder sauber?