Joah past

frisches FRST log bitte. Noch Probleme?

Zitat von schrauber

Joah past

frisches FRST log bitte. Noch Probleme?

Bis jetzt keine Probleme.Securitycheck funktioniert ja nicht,soll ich das dann lassen?Kann ich Eset wieder deinstallieren und werden die Dateien die in Quarantäne sind dann mit gelöscht oder lasse ich Eset auf dem PC?


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-07-2013
Ran by Rene (administrator) on 04-07-2013 13:51:53
Running from C:\Users\Rene\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Entriq, Inc.) C:\Program Files (x86)\maxdome\DCBin\DCService.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe
(ashampoo GmbH & Co. KG) C:\Program Files (x86)\Medion MediaPack 2\Ashampoo Snap\ashsnap.exe
() C:\Users\Rene\AppData\Local\Viber\Viber.exe
() C:\Program Files (x86)\maxdome\DCBin\DCTrayApp.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12673128 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [MedionReminder] C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe [443688 2011-05-26] (CyberLink)
HKLM\...\RunOnce: [MedionReminder] C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe /DeleteRunKey [443688 2011-05-26] (CyberLink)
HKCU\...\Run: [AshSnap] C:\Program Files (x86)\Medion MediaPack 2\Ashampoo Snap\ashsnap.exe [1721344 2011-04-14] (ashampoo GmbH & Co. KG)
HKCU\...\Run: [Viber] "C:\Users\Rene\AppData\Local\Viber\Viber.exe" StartMinimized [906240 2013-05-08] ()
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [SSBkgdUpdate] "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] "C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe" [29984 2008-07-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] "C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe" [46368 2008-07-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] "C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini" [328992 2007-08-31] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: []  [x]
HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-27] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [HKCU] C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Default\...\RunOnce: [Screensaver] C:\Windows\Web\Wallpaper\MEDION\start.vbs [129 2009-10-23] ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\maxdome Download Manager.lnk
ShortcutTarget: maxdome Download Manager.lnk -> C:\Program Files (x86)\maxdome\DCBin\DCTrayApp.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Steganos Password Manager Toolbar - {9C65D12D-CF9D-454D-8049-61965D8C6FFF} - C:\Program Files (x86)\Steganos Password Manager 2012\SPMIEToolbar.dll No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\c85uxq6e.default
FF NewTab: user_pref("browser.newtab.url", "");
FF SearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: hxxp://www.google.de/ig
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\c85uxq6e.default\Extensions\7f404ccc-b0a9-4faf-b3c0-89ceea949aea@a6724a05-9380-4ebe-be02-e67e35a3402c.com
FF Extension: alarm - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\c85uxq6e.default\Extensions\alarm@gutscheinsammler.de.xpi
FF Extension: toolbar - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\c85uxq6e.default\Extensions\toolbar@qipu.de.xpi
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{00F0643E-B367-4779-B45D-7046EBA37A88}] C:\Program Files (x86)\Steganos Password Manager 2012\spmplugin3
FF HKCU\...\Firefox\Extensions: [addlyrics@addlyrics.net] C:\Program Files (x86)\AddLyrics\FF\

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=MDNE&bmod=MDNE
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.142\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.142\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.142\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Mick\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.462_0\plugin/npUrlAdvisor.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Mick\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0\plugin/npVKPlugin.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Mick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll (Kaspersky Lab ZAO)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U2) - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File
CHR Extension: (Avira Toolbar) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaabfjnbeinlpljodiajipidiompfl\7.15.13.0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.462_0
CHR Extension: (Virtual Keyboard) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0
CHR Extension: (AddLyrics) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdlfddggdloaadnphbhejknhaggjaeld\1.107
CHR Extension: (Anti-Banner) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 Prosieben; C:\Program Files (x86)\maxdome\DCBin\DCService.exe [77032 2009-05-01] (Entriq, Inc.)
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
S2 BstHdAndroidSvc; "C:\Program Files (x86)\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [x]
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-31] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-03-31] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-31] (Avira Operations GmbH & Co. KG)
S2 BstHdDrv; \??\C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-04 13:10 - 2013-07-04 13:10 - 00890988 ____A C:\Users\Rene\Desktop\SecurityCheck.exe
2013-07-04 13:06 - 2013-07-04 13:06 - 00095587 ____A C:\Users\Rene\Desktop\JRT.txt
2013-07-04 13:01 - 2013-07-04 13:02 - 00000000 ____D C:\JRT
2013-07-04 13:01 - 2013-07-04 13:01 - 00000000 ____D C:\Windows\ERUNT
2013-07-04 13:00 - 2013-07-04 13:00 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Rene\Desktop\JRT.exe
2013-07-04 09:27 - 2013-07-04 09:27 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-04 09:26 - 2013-07-04 09:26 - 02347384 ____A (ESET) C:\Users\Rene\Desktop\esetsmartinstaller_enu.exe
2013-07-04 09:19 - 2013-07-04 09:19 - 00017539 ____A C:\AdwCleaner[S1].txt
2013-07-04 09:19 - 2013-07-04 09:19 - 00000098 ____A C:\Windows\DeleteOnReboot.bat
2013-07-04 09:18 - 2013-07-04 09:18 - 00650027 ____A C:\Users\Rene\Desktop\adwcleaner.exe
2013-07-04 09:15 - 2013-07-04 09:15 - 00001120 ____A C:\Users\Rene\Desktop\Continue Zip Opener Installation.lnk
2013-07-04 09:14 - 2013-07-04 09:14 - 00793536 ____A C:\Users\Rene\Desktop\ZipOpenerSetup.exe
2013-07-03 18:55 - 2013-07-03 18:55 - 00022577 ____A C:\ComboFix.txt
2013-07-03 18:27 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-03 18:27 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-03 18:27 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-03 18:27 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-03 18:27 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-03 18:27 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-03 18:27 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-03 18:27 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-03 18:26 - 2013-07-03 18:55 - 00000000 ____D C:\Qoobox
2013-07-03 18:26 - 2013-07-03 18:54 - 00000000 ____D C:\Windows\erdnt
2013-07-03 18:25 - 2013-07-03 18:25 - 05085735 ____R (Swearware) C:\Users\Rene\Desktop\ComboFix.exe
2013-07-03 11:28 - 2013-07-03 11:29 - 00057949 ____A C:\Users\Rene\Desktop\Addition.txt
2013-07-03 11:27 - 2013-07-03 11:27 - 00000000 ____D C:\FRST
2013-07-03 11:26 - 2013-07-03 11:26 - 01933556 ____A (Farbar) C:\Users\Rene\Desktop\FRST64.exe
2013-07-03 08:26 - 2013-07-03 08:27 - 00000470 ____A C:\Users\Rene\Desktop\defogger_disable.log
2013-07-03 08:26 - 2013-07-03 08:26 - 00000000 ____A C:\Users\Rene\defogger_reenable
2013-07-03 08:24 - 2013-07-03 08:24 - 00050477 ____A C:\Users\Rene\Desktop\Defogger.exe
2013-06-26 10:48 - 2013-07-04 13:46 - 00000000 ____D C:\Users\Rene\AppData\Local\Viber
2013-06-26 10:48 - 2013-07-04 09:22 - 00000000 ____D C:\Users\Rene\AppData\Roaming\ViberPC
2013-06-26 10:48 - 2013-06-26 10:48 - 00001056 ____A C:\Users\Rene\Desktop\Viber.lnk
2013-06-17 15:12 - 2013-06-17 15:12 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-06-17 15:12 - 2013-06-17 15:12 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-06-15 05:25 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-15 05:25 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-15 05:25 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-15 05:25 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-15 05:25 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-15 05:25 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-15 05:25 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-15 05:25 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-15 05:25 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-15 05:25 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-15 05:25 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-15 05:25 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-12 10:54 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 10:54 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 10:54 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 10:54 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 10:54 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 10:54 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 10:54 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 10:54 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 10:54 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 10:54 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 10:54 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 10:54 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 10:54 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 10:54 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 10:54 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 10:54 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 10:54 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 10:54 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 10:54 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 09:00 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 09:00 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 09:00 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 09:00 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 09:00 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 09:00 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 09:00 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 09:00 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 09:00 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 09:00 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 09:00 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 09:00 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 09:00 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 09:00 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 09:00 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 09:00 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 09:00 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 09:00 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 09:00 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-04 18:56 - 2013-06-04 18:56 - 00001268 ____A C:\Users\Rene\Desktop\Revo Uninstaller.lnk
2013-06-04 09:57 - 2013-06-04 09:57 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-06-04 09:54 - 2013-06-04 09:58 - 00000000 ____D C:\Program Files (x86)\MSECACHE
2013-06-04 09:53 - 2013-06-04 09:53 - 00393080 ____A (Softonic                                        ) C:\Users\Rene\Documents\SoftonicDownloader_fuer_windows-installer-clean-up.exe
2013-06-04 09:46 - 2013-06-04 18:56 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2013-06-04 09:46 - 2013-06-04 18:55 - 02617648 ____A (VS Revo Group Ltd.) C:\Users\Rene\Documents\revosetup194.exe

==================== One Month Modified Files and Folders =======

2013-07-04 13:46 - 2013-06-26 10:48 - 00000000 ____D C:\Users\Rene\AppData\Local\Viber
2013-07-04 13:43 - 2012-03-30 20:17 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-04 13:22 - 2012-03-29 12:51 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-04 13:10 - 2013-07-04 13:10 - 00890988 ____A C:\Users\Rene\Desktop\SecurityCheck.exe
2013-07-04 13:06 - 2013-07-04 13:06 - 00095587 ____A C:\Users\Rene\Desktop\JRT.txt
2013-07-04 13:02 - 2013-07-04 13:01 - 00000000 ____D C:\JRT
2013-07-04 13:01 - 2013-07-04 13:01 - 00000000 ____D C:\Windows\ERUNT
2013-07-04 13:00 - 2013-07-04 13:00 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Rene\Desktop\JRT.exe
2013-07-04 12:22 - 2012-03-29 12:51 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-04 11:53 - 2012-03-29 12:52 - 01916477 ____A C:\Windows\WindowsUpdate.log
2013-07-04 09:28 - 2009-07-14 06:45 - 00017152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-04 09:28 - 2009-07-14 06:45 - 00017152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-04 09:27 - 2013-07-04 09:27 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-04 09:26 - 2013-07-04 09:26 - 02347384 ____A (ESET) C:\Users\Rene\Desktop\esetsmartinstaller_enu.exe
2013-07-04 09:22 - 2013-06-26 10:48 - 00000000 ____D C:\Users\Rene\AppData\Roaming\ViberPC
2013-07-04 09:21 - 2012-01-24 18:36 - 00207012 ____A C:\Windows\setupact.log
2013-07-04 09:21 - 2010-11-21 05:47 - 00038980 ____A C:\Windows\PFRO.log
2013-07-04 09:21 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-04 09:19 - 2013-07-04 09:19 - 00017539 ____A C:\AdwCleaner[S1].txt
2013-07-04 09:19 - 2013-07-04 09:19 - 00000098 ____A C:\Windows\DeleteOnReboot.bat
2013-07-04 09:18 - 2013-07-04 09:18 - 00650027 ____A C:\Users\Rene\Desktop\adwcleaner.exe
2013-07-04 09:15 - 2013-07-04 09:15 - 00001120 ____A C:\Users\Rene\Desktop\Continue Zip Opener Installation.lnk
2013-07-04 09:14 - 2013-07-04 09:14 - 00793536 ____A C:\Users\Rene\Desktop\ZipOpenerSetup.exe
2013-07-03 18:55 - 2013-07-03 18:55 - 00022577 ____A C:\ComboFix.txt
2013-07-03 18:55 - 2013-07-03 18:26 - 00000000 ____D C:\Qoobox
2013-07-03 18:55 - 2009-07-14 05:20 - 00000000 __RHD C:\users\Default
2013-07-03 18:54 - 2013-07-03 18:26 - 00000000 ____D C:\Windows\erdnt
2013-07-03 18:50 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-07-03 18:25 - 2013-07-03 18:25 - 05085735 ____R (Swearware) C:\Users\Rene\Desktop\ComboFix.exe
2013-07-03 18:24 - 2011-05-16 16:04 - 00654602 ____A C:\Windows\System32\perfh007.dat
2013-07-03 18:24 - 2011-05-16 16:04 - 00130216 ____A C:\Windows\System32\perfc007.dat
2013-07-03 18:24 - 2009-07-14 07:13 - 01500294 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-03 15:02 - 2013-03-24 19:54 - 00000000 ____D C:\Users\Rene\AppData\Local\DoNotTrackPlus
2013-07-03 14:53 - 2012-05-03 16:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 11:29 - 2013-07-03 11:28 - 00057949 ____A C:\Users\Rene\Desktop\Addition.txt
2013-07-03 11:27 - 2013-07-03 11:27 - 00000000 ____D C:\FRST
2013-07-03 11:26 - 2013-07-03 11:26 - 01933556 ____A (Farbar) C:\Users\Rene\Desktop\FRST64.exe
2013-07-03 11:22 - 2013-05-17 21:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 10:11 - 2012-04-01 19:32 - 00000000 ____D C:\Users\Mick\AppData\Roaming\SoftGrid Client
2013-07-03 08:27 - 2013-07-03 08:26 - 00000470 ____A C:\Users\Rene\Desktop\defogger_disable.log
2013-07-03 08:26 - 2013-07-03 08:26 - 00000000 ____A C:\Users\Rene\defogger_reenable
2013-07-03 08:26 - 2012-03-29 12:56 - 00000000 ____D C:\users\Rene
2013-07-03 08:24 - 2013-07-03 08:24 - 00050477 ____A C:\Users\Rene\Desktop\Defogger.exe
2013-07-02 17:37 - 2012-03-30 14:57 - 00000000 ____D C:\Users\Rene\AppData\Roaming\SoftGrid Client
2013-06-30 11:11 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-27 14:24 - 2013-05-07 11:54 - 00083672 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-26 10:48 - 2013-06-26 10:48 - 00001056 ____A C:\Users\Rene\Desktop\Viber.lnk
2013-06-20 13:23 - 2012-03-29 12:51 - 00002187 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-06-17 15:12 - 2013-06-17 15:12 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-06-17 15:12 - 2013-06-17 15:12 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-06-15 12:41 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-15 05:21 - 2013-02-20 21:01 - 00701952 ____A C:\Users\Mick\Desktop\Arbeitsplan.xls
2013-06-12 20:43 - 2012-03-30 20:17 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 20:43 - 2011-12-01 23:26 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-12 10:54 - 2011-07-18 22:31 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-08 16:08 - 2013-06-15 05:25 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-15 05:25 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-15 05:25 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-15 05:25 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-15 05:25 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-15 05:25 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-15 05:25 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-15 05:25 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:40 - 2013-06-15 05:25 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-15 05:25 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-15 05:25 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:13 - 2013-06-15 05:25 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-04 18:56 - 2013-06-04 18:56 - 00001268 ____A C:\Users\Rene\Desktop\Revo Uninstaller.lnk
2013-06-04 18:56 - 2013-06-04 09:46 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2013-06-04 18:55 - 2013-06-04 09:46 - 02617648 ____A (VS Revo Group Ltd.) C:\Users\Rene\Documents\revosetup194.exe
2013-06-04 10:10 - 2012-10-04 15:49 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2013-06-04 09:58 - 2013-06-04 09:54 - 00000000 ____D C:\Program Files (x86)\MSECACHE
2013-06-04 09:57 - 2013-06-04 09:57 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-06-04 09:53 - 2013-06-04 09:53 - 00393080 ____A (Softonic                                        ) C:\Users\Rene\Documents\SoftonicDownloader_fuer_windows-installer-clean-up.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-03 15:53

==================== End Of Log ============================
         

--- --- ---