| |
| |||||||
Antiviren-, Firewall- und andere Schutzprogramme: Zusätzliche Firewall sinnvoll?Windows 7 Sämtliche Fragen zur Bedienung von Firewalls, Anti-Viren Programmen, Anti Malware und Anti Trojaner Software sind hier richtig. Dies ist ein Diskussionsforum für Sicherheitslösungen für Windows Rechner. Benötigst du Hilfe beim Trojaner entfernen oder weil du dir einen Virus eingefangen hast, erstelle ein Thema in den oberen Bereinigungsforen. |
 |
11.07.2013, 12:39
| #1 |
 |  Zusätzliche Firewall sinnvoll? Hallo zusammen, lohnt es sich, eine weitere/alternative Firewall zur vorhandenen Windows-Firewall zu installieren? Ich lese immer wieder hier und da, dass einige Benutzer eine zusätzliche Firewall verwenden, aber auch, dass es eigentlich unnötig sei und möglicherweise auch problematisch. Könnt ihr mir was dazu sagen? Viele Grüße |
|
11.07.2013, 12:44
| #2 |
| /// the machine /// TB-Ausbilder    | Zusätzliche Firewall sinnvoll? Hi,
__________________sowas ist nicht zusätzlich, die Windows Firewall wird dann deaktiviert. Wenn Du hinter einem Router sitzt reicht eigentlich die Windows Firewall für Otto-Normal-Anwender.
__________________ |
|
11.07.2013, 12:46
| #3 |
| | Zusätzliche Firewall sinnvoll? Danke für die Antwort!
__________________Ab wann ist man denn aus "Profi"-Sicht kein Otto-Normal-Anwender mehr? |
|
11.07.2013, 13:02
| #4 |
| /// the machine /// TB-Ausbilder | Zusätzliche Firewall sinnvoll? Musst du irgendwas spezielles Zocken, oder hast Entwicklerprogramme die spezielle Ports brauchen? Die ganzen illegalen Sachen zähl ich mal nicht auf  Wenn nein, reicht die von Windows.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.07.2013, 13:22
| #5 |
| | Zusätzliche Firewall sinnvoll? Nichts dergleichen Wo ich dich grad "an der Strippe" hab, ist es möglich von euch mein System überprüfen zu lassen, auch ohne dass gravierende Probleme aufgetreten sind? Quasi nur aus reiner Vorsicht? Oder braucht ihr schon bestimme Anhaltspunkte wonach ihr suchen sollt? |
|
11.07.2013, 13:28
| #6 |
| /// the machine /// TB-Ausbilder | Zusätzliche Firewall sinnvoll? Nö, brauch ich nit  . Was ich brauch sind Logfiles Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ --> Zusätzliche Firewall sinnvoll? |
|
11.07.2013, 13:39
| #7 |
| | Zusätzliche Firewall sinnvoll? Ok ich habe doch ein Problem, das meiner Meinung erst seit kurzem besteht, evtl. heute? Wenn ich den Download des Tools durch Admin Recht öffnen will (habe nur ein Benutzerkonto und das mit Admin Rechten, ich weiß ich weiß..  ) dann verschwindet das Admin Fenster aber der Bildschirm bleibt in diesem Halbdunkel und ich kann nichts mehr anklicken. Nur durch Strg Alt Entf lässt sich das beheben... Was mag da los sein? |
|
11.07.2013, 14:56
| #8 |
| /// the machine /// TB-Ausbilder | Zusätzliche Firewall sinnvoll? Wenn Du FRST starten willst? Starte es einfach mal mit Doppelklick.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.07.2013, 15:52
| #9 |
| | Zusätzliche Firewall sinnvoll? Das war ein Problem, dass alle Programme betraf, die ich probeweise per Admin öffnen wollte.. Aber nach einer guten Stunde rumprobieren konnte ich das Problem durch einen cleveren Neustart beheben -.- Der Scan dauert schon über eine halbe Stunde, ist das korrekt? Oke es hat sich aufgehangen, habs nochmal gemacht: FRST.log: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2013 04
Ran by **** (administrator) on 11-07-2013 17:51:05
Running from C:\Users\****\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
(AVAST Software) C:\Program Files (x86)\avast! Free Antivirus\AvastSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Spotify Ltd) C:\Users\Kai\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(AVAST Software) C:\Program Files (x86)\avast! Free Antivirus\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\system32\cmd.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
(Microsoft Corporation) C:\Windows\system32\werfault.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [168216 2011-04-15] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [392472 2011-04-15] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [416024 2011-04-15] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [Spotify Web Helper] - "C:\Users\****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1104384 2013-07-09] (Spotify Ltd)
HKCU\...\Run: [Google Update] - "C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-06-27] (Google Inc.)
MountPoints2: H - H:\LaunchU3.exe -a
MountPoints2: {520b6f0d-6e9c-11e1-b912-101f74ca483d} - H:\LaunchU3.exe -a
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586808 2011-04-08] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [318520 2011-01-27] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [avast] - "C:\Program Files (x86)\avast! Free Antivirus\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [KeePass 2 PreLoad] - "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload [1960448 2013-04-05] (Dominik Reichl)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
AppInit_DLLs: [0 ] ()
AppInit_DLLs-x32: [0 ] ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
HKLM-x32 SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
HKCU SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKCU - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - {801DB2AE-1BC6-4D42-AC28-26024FC09C17} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=D3A35910-881B-4370-A12D-8FA358B9AF37&apn_sauid=CC83FCA6-1E8A-4BBE-BD7C-6B4BEB7DB924
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=410&sr=0&q={searchTerms}
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE64.dll (AVAST Software)
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - No Name - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM-x32 - No Name - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\mibzh96l.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\****\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\****\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
FF Extension: HTTPS-Everywhere - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\mibzh96l.default\Extensions\https-everywhere@eff.org
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\mibzh96l.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files (x86)\avast! Free Antivirus\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files (x86)\avast! Free Antivirus\WebRep\FF
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HomePage: hxxp://www.searchnu.com/410
CHR RestoreOnStartup: "hxxp://google.de/"
CHR DefaultSearchURL: (Ask) - hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=D3A35910-881B-4370-A12D-8FA358B9AF37&apn_ptnrs=U3&apn_sauid=CC83FCA6-1E8A-4BBE-BD7C-6B4BEB7DB924&apn_dtid=OSJ000YYDE&q={searchTerms}
CHR DefaultSuggestURL: (Ask) - hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Users\****\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.110\gcswf32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll ()
CHR Plugin: (Simple Pass 2011) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdhihajbmafmgilcciomnamcjfkdhikl\1.0_0\npwebsitelogon.dll (HP)
CHR Plugin: (Skype Toolbars) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files (x86)\avast! Free Antivirus\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [1759168 2013-07-11] (SurfRight B.V.)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2011-12-30] ()
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [279616 2011-12-29] (DT Soft Ltd)
R2 hmpalert; C:\Windows\system32\drivers\hmpalert.sys [17416 2013-07-11] ()
R2 hmpalert; C:\Windows\system32\drivers\hmpalert.sys [17416 2013-07-11] ()
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2011-12-30] ()
S3 PRESONUS_AUDIOBOX_MIDI; C:\Windows\System32\drivers\psabusbm.sys [37496 2009-12-04] (Ploytec GmbH)
S3 PRESONUS_AUDIOBOX_USB; C:\Windows\System32\Drivers\psabusbu.sys [462968 2009-12-04] (Ploytec GmbH)
S3 PRESONUS_AUDIOBOX_WDM; C:\Windows\System32\drivers\psabusba.sys [50808 2009-12-04] (Ploytec GmbH)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-11 16:00 - 2013-07-11 16:00 - 00000000 ____D C:\FRST
2013-07-11 14:32 - 2013-07-11 14:32 - 01777775 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-07-11 11:48 - 2013-06-24 04:48 - 00000000 ____D C:\Users\****\Desktop\Tor Browser
2013-07-11 11:46 - 2013-07-11 11:48 - 28110931 ____A (Igor Pavlov) C:\Users\****\Downloads\tor-browser-2.3.25-10_de.exe
2013-07-11 11:42 - 2013-05-29 07:36 - 01346560 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 11:42 - 2013-05-29 07:35 - 01392128 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 11:42 - 2013-05-29 07:34 - 01494528 ____A (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-11 11:42 - 2013-05-29 07:33 - 00237056 ____A (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-11 11:42 - 2013-05-29 07:29 - 00173056 ____A (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-11 11:42 - 2013-05-29 07:25 - 02382848 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 11:42 - 2013-05-29 07:25 - 00096768 ____A (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-11 11:42 - 2013-05-29 07:18 - 00248320 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 11:42 - 2013-05-29 03:41 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-11 11:42 - 2013-05-29 03:41 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 11:42 - 2013-05-29 03:41 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 11:42 - 2013-05-29 03:40 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-11 11:42 - 2013-05-29 03:37 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-11 11:42 - 2013-05-29 03:36 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-11 11:42 - 2013-05-29 03:33 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 11:42 - 2013-05-29 03:33 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-11 11:42 - 2013-05-29 03:29 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 11:41 - 2013-05-29 08:15 - 17829376 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 11:41 - 2013-05-29 07:50 - 10926080 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 11:41 - 2013-05-29 07:43 - 02312704 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 11:41 - 2013-05-29 07:31 - 00085504 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 11:41 - 2013-05-29 07:29 - 00816640 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 11:41 - 2013-05-29 07:29 - 00599040 ____A (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-11 11:41 - 2013-05-29 07:27 - 02147840 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 11:41 - 2013-05-29 07:27 - 00729088 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 11:41 - 2013-05-29 03:56 - 12333568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 11:41 - 2013-05-29 03:50 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 11:41 - 2013-05-29 03:48 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 11:41 - 2013-05-29 03:38 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 11:41 - 2013-05-29 03:35 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 11:41 - 2013-05-29 03:35 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 11:41 - 2013-05-29 03:33 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 11:38 - 2013-07-11 11:38 - 00486139 ____A C:\Users\****\Downloads\https-everywhere324-latest.zip
2013-07-11 11:38 - 2013-07-11 10:19 - 00504251 ____A C:\Users\****\Desktop\https-everywhere-latest.xpi
2013-07-11 11:30 - 2013-07-11 13:01 - 00000000 ____D C:\Users\****\AppData\Roaming\tor
2013-07-11 11:18 - 2013-07-11 13:10 - 00000000 ____D C:\Users\****\AppData\Local\Vidalia
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Users\****\AppData\Local\Tor
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Program Files (x86)\Vidalia Bridge Bundle
2013-07-11 11:16 - 2013-07-11 11:17 - 09636506 ____A C:\Users\****\Downloads\vidalia-bridge-bundle-0.2.3.25-0.2.21.exe
2013-07-10 16:17 - 2013-07-10 16:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-10 15:51 - 2013-06-05 05:34 - 03153920 ____A (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 15:51 - 2013-06-04 08:00 - 00624128 ____A (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 15:51 - 2013-06-04 06:53 - 00509440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 15:51 - 2013-05-06 08:03 - 01887744 ____A (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 15:51 - 2013-05-06 06:56 - 01620480 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 15:50 - 2013-04-10 01:34 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 15:50 - 2013-04-03 00:51 - 01643520 ____A (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-09 18:03 - 2013-07-11 15:56 - 00000336 ____A C:\Windows\setupact.log
2013-07-09 18:03 - 2013-07-09 18:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 12:03 - 2013-07-09 12:05 - 04396440 ____A (Piriform Ltd) C:\Users\****\Downloads\ccsetup403.exe
2013-07-08 16:16 - 2013-07-08 16:26 - 00008836 ____A C:\Users\****\Desktop\ESTA Auftragsnummer.odt
2013-07-03 20:46 - 2013-07-11 13:04 - 00000000 ____D C:\Program Files (x86)\HitmanPro.Alert
2013-07-03 20:46 - 2013-07-11 11:24 - 00540104 ____A (SurfRight) C:\Windows\SysWOW64\hmpalert.dll
2013-07-03 20:46 - 2013-07-11 11:24 - 00494784 ____A (SurfRight) C:\Windows\system32\hmpalert.dll
2013-07-03 20:46 - 2013-07-11 11:24 - 00017416 ____A C:\Windows\system32\Drivers\hmpalert.sys
2013-07-03 20:46 - 2013-07-03 20:46 - 00000000 ____D C:\ProgramData\HitmanPro.Alert
2013-07-03 20:45 - 2013-07-03 20:45 - 01751952 ____A (SurfRight B.V.) C:\Users\****\Downloads\hmpalert.exe
2013-07-03 20:40 - 2013-07-03 20:40 - 00002019 ____A C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-07-03 20:39 - 2013-07-03 20:39 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-03 20:32 - 2013-07-03 20:32 - 07872648 ____A (Adobe Systems Inc.) C:\Users\****\Downloads\Shockwave_Installer_Slim.exe
2013-07-03 17:42 - 2013-07-03 18:03 - 00000000 ____D C:\Users\****\Skrupelloser Scheiß
2013-06-28 14:30 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-26 22:22 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-26 22:22 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-06-26 20:50 - 2013-06-26 20:51 - 08340864 ____A (PortableApps.com) C:\Users\****\Downloads\ClamWinPortable_0.97.8_English.paf.exe
2013-06-26 20:23 - 2013-06-26 20:23 - 00903080 ____A (Oracle Corporation) C:\Users\****\Downloads\jxpiinstall.exe
2013-06-26 20:21 - 2013-06-26 20:21 - 00000000 ____D C:\Users\****\AppData\Roaming\Oracle
2013-06-24 12:28 - 2013-06-24 12:28 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-24 00:47 - 2013-06-24 00:47 - 00002768 ____A C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-06-24 00:46 - 2013-06-24 00:46 - 04378864 ____A (Piriform Ltd) C:\Users\****\Downloads\ccsetup402.exe
2013-06-20 17:48 - 2013-06-20 17:48 - 00376576 ____A C:\Users\****\Downloads\wot_safe_surfing-20130515-fx.zip
2013-06-13 21:48 - 2013-06-13 21:48 - 00001105 ____A C:\Users\****\Desktop\KeePass 2.lnk
2013-06-13 21:48 - 2013-06-13 21:48 - 00000000 ____D C:\Program Files (x86)\KeePass Password Safe 2
2013-06-13 21:47 - 2013-06-13 21:48 - 02475400 ____A (Dominik Reichl ) C:\Users\****\Downloads\KeePass-2.22-Setup(1).exe
2013-06-13 21:45 - 2013-06-13 21:46 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22(1).zip
2013-06-13 21:22 - 2013-06-13 21:25 - 58084984 ____A (PortableApps.com) C:\Users\****\Downloads\PortableApps.com_Suite_Light_Setup_1.6.1_German.exe
2013-06-13 20:05 - 2013-06-13 20:06 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22.zip
2013-06-12 12:08 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-06-12 12:08 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-06-12 12:08 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-06-12 12:08 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-06-12 12:08 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 12:08 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 12:08 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 12:08 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-06-12 12:08 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 12:08 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 12:08 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-06-12 12:08 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 12:08 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-06-12 12:08 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-06-12 12:08 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 12:08 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 12:08 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 12:08 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-06-12 12:08 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-06-11 23:36 - 2013-07-11 12:11 - 00004702 ____A C:\Users\****\Desktop\Datenbank.kdbx
2013-06-11 23:19 - 2013-07-11 15:47 - 00000000 ____D C:\Users\****\AppData\Roaming\KeePass
2013-06-11 23:19 - 2013-03-28 17:05 - 00038997 ____A C:\Users\****\Desktop\German.lngx
2013-06-11 23:18 - 2013-06-11 23:18 - 02475400 ____A (Dominik Reichl ) C:\Users\****\Downloads\KeePass-2.22-Setup.exe
2013-06-11 23:17 - 2013-06-11 23:18 - 00039022 ____A C:\Users\****\Downloads\KeePass-2.22-German.zip
2013-06-11 22:43 - 2013-06-11 22:44 - 17355184 ____A (Sun Microsystems, Inc.) C:\Users\****\Downloads\jre-6u45-windows-x64.exe
2013-06-11 22:22 - 2013-06-28 14:30 - 00189936 ____A C:\Windows\system32\Drivers\aswVmm.sys
2013-06-11 22:22 - 2013-05-09 10:59 - 00065336 ____A C:\Windows\system32\Drivers\aswRvrt.sys
2013-06-11 22:07 - 2013-06-11 22:07 - 20971520 ____A C:\Users\****\Desktop\TrueCrypt Volumen
2013-06-11 20:35 - 2013-06-11 20:35 - 00000000 ____D C:\Users\****\AppData\Roaming\TrueCrypt
2013-06-11 20:30 - 2013-06-11 20:35 - 00000000 ____D C:\Program Files\TrueCrypt
2013-06-11 20:30 - 2013-06-11 20:30 - 00231376 ____A (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2013-06-11 20:30 - 2013-06-11 20:30 - 00000875 ____A C:\Users\Public\Desktop\TrueCrypt.lnk
2013-06-11 20:29 - 2013-06-11 20:30 - 03466248 ____A (TrueCrypt Foundation) C:\Users\Kai\Downloads\truecrypt_setup_7.1a.exe
==================== One Month Modified Files and Folders =======
2013-07-11 17:24 - 2012-09-03 20:03 - 00001112 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001UA.job
2013-07-11 17:24 - 2012-09-03 20:03 - 00001060 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001Core.job
2013-07-11 17:21 - 2011-11-05 18:51 - 00003914 ____A C:\Windows\System32\Tasks\User_Feed_Synchronization-{845D5F33-BF75-41E9-A20A-4D3E0EDECEC8}
2013-07-11 17:16 - 2012-06-09 12:37 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-11 16:05 - 2009-07-14 06:45 - 00031856 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-11 16:05 - 2009-07-14 06:45 - 00031856 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-11 16:00 - 2013-07-11 16:00 - 00000000 ____D C:\FRST
2013-07-11 15:57 - 2012-07-10 13:14 - 00004196 ____A C:\Windows\System32\Tasks\avast! Emergency Update
2013-07-11 15:57 - 2012-06-09 12:37 - 00001100 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-11 15:56 - 2013-07-09 18:03 - 00000336 ____A C:\Windows\setupact.log
2013-07-11 15:56 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 15:52 - 2012-03-11 05:12 - 01519484 ____A C:\Windows\WindowsUpdate.log
2013-07-11 15:47 - 2013-06-11 23:19 - 00000000 ____D C:\Users\****\AppData\Roaming\KeePass
2013-07-11 14:32 - 2013-07-11 14:32 - 01777775 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-07-11 13:10 - 2013-07-11 11:18 - 00000000 ____D C:\Users\****\AppData\Local\Vidalia
2013-07-11 13:05 - 2009-07-14 06:45 - 00302296 ____A C:\Windows\system32\FNTCACHE.DAT
2013-07-11 13:04 - 2013-07-03 20:46 - 00000000 ____D C:\Program Files (x86)\HitmanPro.Alert
2013-07-11 13:04 - 2013-05-17 15:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-11 13:04 - 2012-05-18 22:57 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 13:04 - 2012-05-18 22:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-11 13:03 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 13:03 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 13:01 - 2013-07-11 11:30 - 00000000 ____D C:\Users\****\AppData\Roaming\tor
2013-07-11 12:11 - 2013-06-11 23:36 - 00004702 ____A C:\Users\****\Desktop\Datenbank.kdbx
2013-07-11 11:53 - 2011-07-16 07:32 - 00664868 ____A C:\Windows\system32\perfh007.dat
2013-07-11 11:53 - 2011-07-16 07:32 - 00135004 ____A C:\Windows\system32\perfc007.dat
2013-07-11 11:53 - 2009-07-14 07:13 - 01549542 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 11:48 - 2013-07-11 11:46 - 28110931 ____A (Igor Pavlov) C:\Users\****\Downloads\tor-browser-2.3.25-10_de.exe
2013-07-11 11:43 - 2012-02-07 18:56 - 78185248 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 11:38 - 2013-07-11 11:38 - 00486139 ____A C:\Users\****\Downloads\https-everywhere324-latest.zip
2013-07-11 11:24 - 2013-07-03 20:46 - 00540104 ____A (SurfRight) C:\Windows\SysWOW64\hmpalert.dll
2013-07-11 11:24 - 2013-07-03 20:46 - 00494784 ____A (SurfRight) C:\Windows\system32\hmpalert.dll
2013-07-11 11:24 - 2013-07-03 20:46 - 00017416 ____A C:\Windows\system32\Drivers\hmpalert.sys
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Users\****\AppData\Local\Tor
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Program Files (x86)\Vidalia Bridge Bundle
2013-07-11 11:17 - 2013-07-11 11:16 - 09636506 ____A C:\Users\****\Downloads\vidalia-bridge-bundle-0.2.3.25-0.2.21.exe
2013-07-11 10:19 - 2013-07-11 11:38 - 00504251 ____A C:\Users\****\Desktop\https-everywhere-latest.xpi
2013-07-10 16:17 - 2013-07-10 16:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-09 18:13 - 2012-03-18 20:38 - 00000000 ____D C:\Users\****\AppData\Roaming\Spotify
2013-07-09 18:03 - 2013-07-09 18:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 18:03 - 2012-03-18 20:42 - 00000000 ____D C:\Users\****\AppData\Local\Spotify
2013-07-09 12:06 - 2012-03-06 08:59 - 00000822 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 12:06 - 2012-03-06 08:59 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 12:05 - 2013-07-09 12:03 - 04396440 ____A (Piriform Ltd) C:\Users\****\Downloads\ccsetup403.exe
2013-07-08 22:26 - 2012-06-18 08:23 - 00007600 ____A C:\Users\****\AppData\Local\Resmon.ResmonCfg
2013-07-08 17:14 - 2011-11-05 18:52 - 00000000 ____D C:\Users\****\Documents\Youcam
2013-07-08 16:26 - 2013-07-08 16:16 - 00008836 ____A C:\Users\****\Desktop\ESTA Auftragsnummer.odt
2013-07-08 15:24 - 2012-01-09 18:15 - 00000000 ____A C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-07-04 23:12 - 2012-01-06 16:24 - 00000000 ____D C:\Program Files (x86)\avast! Free Antivirus
2013-07-03 20:46 - 2013-07-03 20:46 - 00000000 ____D C:\ProgramData\HitmanPro.Alert
2013-07-03 20:45 - 2013-07-03 20:45 - 01751952 ____A (SurfRight B.V.) C:\Users\****\Downloads\hmpalert.exe
2013-07-03 20:40 - 2013-07-03 20:40 - 00002019 ____A C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-07-03 20:40 - 2011-11-06 14:35 - 00000000 ____D C:\Users\****\AppData\Local\Adobe
2013-07-03 20:39 - 2013-07-03 20:39 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-03 20:39 - 2011-07-15 22:16 - 00000000 ____D C:\ProgramData\Adobe
2013-07-03 20:33 - 2011-07-15 22:10 - 00000000 ____D C:\Windows\SysWOW64\Adobe
2013-07-03 20:32 - 2013-07-03 20:32 - 07872648 ____A (Adobe Systems Inc.) C:\Users\****\Downloads\Shockwave_Installer_Slim.exe
2013-07-03 18:24 - 2013-04-02 18:39 - 00000000 ____D C:\Users\****\AppData\Local\HP
2013-07-03 18:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-03 18:03 - 2013-07-03 17:42 - 00000000 ____D C:\Users\****\Skrupelloser Scheiß
2013-07-03 17:42 - 2011-11-05 18:46 - 00000000 ____D C:\Users\****
2013-07-03 17:19 - 2012-09-03 20:03 - 00004078 ____A C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001UA
2013-07-03 17:19 - 2012-09-03 20:03 - 00003682 ____A C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001Core
2013-07-02 16:01 - 2012-02-06 18:19 - 00000324 ____A C:\Windows\Tasks\HPCeeScheduleFor****.job
2013-07-01 20:14 - 2012-02-06 18:19 - 00003174 ____A C:\Windows\System32\Tasks\HPCeeScheduleFor****
2013-07-01 20:14 - 2012-01-02 12:21 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log
2013-06-29 01:08 - 2009-07-14 07:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-28 14:30 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-28 14:30 - 2013-06-26 22:22 - 00000175 ____A C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-28 14:30 - 2013-06-26 22:22 - 00000175 ____A C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-06-28 14:30 - 2013-06-11 22:22 - 00189936 ____A C:\Windows\system32\Drivers\aswVmm.sys
2013-06-28 14:30 - 2012-01-06 16:24 - 01030952 ____A (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-06-28 14:30 - 2012-01-06 16:24 - 00378944 ____A (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-06-26 20:51 - 2013-06-26 20:50 - 08340864 ____A (PortableApps.com) C:\Users\****\Downloads\ClamWinPortable_0.97.8_English.paf.exe
2013-06-26 20:23 - 2013-06-26 20:23 - 00903080 ____A (Oracle Corporation) C:\Users\****\Downloads\jxpiinstall.exe
2013-06-26 20:22 - 2012-01-03 02:10 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-26 20:21 - 2013-06-26 20:21 - 00000000 ____D C:\Users\****\AppData\Roaming\Oracle
2013-06-24 12:28 - 2013-06-24 12:28 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-24 12:28 - 2012-11-04 22:52 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-24 12:28 - 2012-11-04 22:52 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-24 12:28 - 2012-11-04 22:52 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-24 12:28 - 2012-09-08 09:31 - 00867240 ____A (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-06-24 12:28 - 2012-01-03 02:10 - 00789416 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-06-24 12:14 - 2011-11-05 18:50 - 00068104 ____A C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-24 04:48 - 2013-07-11 11:48 - 00000000 ____D C:\Users\****\Desktop\Tor Browser
2013-06-24 02:49 - 2012-08-11 22:31 - 00000000 ____D C:\Users\****\Desktop\Registry Saves
2013-06-24 02:47 - 2011-07-15 22:20 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-24 02:46 - 2013-03-26 20:01 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2013-06-24 00:57 - 2012-01-06 16:19 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-06-24 00:51 - 2012-05-05 03:15 - 00000000 ____D C:\Users\****\AppData\Local\CrashDumps
2013-06-24 00:47 - 2013-06-24 00:47 - 00002768 ____A C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-06-24 00:46 - 2013-06-24 00:46 - 04378864 ____A (Piriform Ltd) C:\Users\****\Downloads\ccsetup402.exe
2013-06-23 19:18 - 2012-02-17 19:35 - 00000000 ____D C:\Program Files (x86)\StarCraft II
2013-06-20 17:48 - 2013-06-20 17:48 - 00376576 ____A C:\Users\****\Downloads\wot_safe_surfing-20130515-fx.zip
2013-06-18 16:36 - 2012-08-17 16:42 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-18 16:36 - 2011-07-15 22:03 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-13 21:48 - 2013-06-13 21:48 - 00001105 ____A C:\Users\****\Desktop\KeePass 2.lnk
2013-06-13 21:48 - 2013-06-13 21:48 - 00000000 ____D C:\Program Files (x86)\KeePass Password Safe 2
2013-06-13 21:48 - 2013-06-13 21:47 - 02475400 ____A (Dominik Reichl ) C:\Users\****\Downloads\KeePass-2.22-Setup(1).exe
2013-06-13 21:46 - 2013-06-13 21:45 - 02256199 ____A C:\Users\Kai\Downloads\KeePass-2.22(1).zip
2013-06-13 21:25 - 2013-06-13 21:22 - 58084984 ____A (PortableApps.com) C:\Users\****\Downloads\PortableApps.com_Suite_Light_Setup_1.6.1_German.exe
2013-06-13 20:06 - 2013-06-13 20:05 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22.zip
2013-06-13 19:51 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-11 23:18 - 2013-06-11 23:18 - 02475400 ____A (Dominik Reichl ) C:\Users\****\Downloads\KeePass-2.22-Setup.exe
2013-06-11 23:18 - 2013-06-11 23:17 - 00039022 ____A C:\Users\****\Downloads\KeePass-2.22-German.zip
2013-06-11 22:44 - 2013-06-11 22:43 - 17355184 ____A (Sun Microsystems, Inc.) C:\Users\****\Downloads\jre-6u45-windows-x64.exe
2013-06-11 22:22 - 2012-01-06 16:24 - 00000000 ____A C:\Windows\SysWOW64\config.nt
2013-06-11 22:07 - 2013-06-11 22:07 - 20971520 ____A C:\Users\****\Desktop\TrueCrypt Volumen
2013-06-11 20:35 - 2013-06-11 20:35 - 00000000 ____D C:\Users\****\AppData\Roaming\TrueCrypt
2013-06-11 20:35 - 2013-06-11 20:30 - 00000000 ____D C:\Program Files\TrueCrypt
2013-06-11 20:30 - 2013-06-11 20:30 - 00231376 ____A (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2013-06-11 20:30 - 2013-06-11 20:30 - 00000875 ____A C:\Users\Public\Desktop\TrueCrypt.lnk
2013-06-11 20:30 - 2013-06-11 20:29 - 03466248 ____A (TrueCrypt Foundation) C:\Users\****\Downloads\truecrypt_setup_7.1a.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-03 00:15
==================== End Of Log ============================
--- --- --- --- --- --- Audition.txt: FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-07-2013 04
Ran by **** at 2013-07-11 17:52:29
Running from C:\Users\****\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
4500_G510gm_Help (x32 Version: 000.0.439.000)
4500G510gm (x32 Version: 000.0.423.000)
4500G510gm_Software_Min (x32 Version: 000.0.423.000)
64 Bit HP CIO Components Installer (Version: 7.2.8)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.2.122)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95)
AMD Catalyst Install Manager (Version: 8.0.911.0)
Apple Application Support (x32 Version: 2.3.2)
Apple Mobile Device Support (Version: 6.0.1.3)
Apple Software Update (x32 Version: 2.1.3.127)
Atheros Driver Installation Program (x32 Version: 9.2)
Audacity 1.3.14 (Unicode) (x32)
AudioBox USB driver
AuthenTec TrueAPI (Version: 1.3.0.111)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
Bejeweled 3 (x32 Version: 2.2.0.97)
Blasterball 3 (x32 Version: 2.2.0.97)
Bonjour (Version: 3.0.0.10)
Bounce Symphony (x32 Version: 2.2.0.97)
BufferChm (x32 Version: 130.0.331.000)
Cake Mania (x32 Version: 2.2.0.95)
capella 7 (x32 Version: 7.1.9)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2011.0508.224.2391)
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0508.224.2391)
Catalyst Control Center Localization All (x32 Version: 2011.0508.224.2391)
Catalyst Control Center Profiles Mobile (x32 Version: 2011.0508.224.2391)
CCC Help Chinese Standard (x32 Version: 2011.0508.0223.2391)
CCC Help Chinese Traditional (x32 Version: 2011.0508.0223.2391)
CCC Help Czech (x32 Version: 2011.0508.0223.2391)
CCC Help Danish (x32 Version: 2011.0508.0223.2391)
CCC Help Dutch (x32 Version: 2011.0508.0223.2391)
CCC Help English (x32 Version: 2011.0508.0223.2391)
CCC Help Finnish (x32 Version: 2011.0508.0223.2391)
CCC Help French (x32 Version: 2011.0508.0223.2391)
CCC Help German (x32 Version: 2011.0508.0223.2391)
CCC Help Greek (x32 Version: 2011.0508.0223.2391)
CCC Help Hungarian (x32 Version: 2011.0508.0223.2391)
CCC Help Italian (x32 Version: 2011.0508.0223.2391)
CCC Help Japanese (x32 Version: 2011.0508.0223.2391)
CCC Help Korean (x32 Version: 2011.0508.0223.2391)
CCC Help Norwegian (x32 Version: 2011.0508.0223.2391)
CCC Help Polish (x32 Version: 2011.0508.0223.2391)
CCC Help Portuguese (x32 Version: 2011.0508.0223.2391)
CCC Help Russian (x32 Version: 2011.0508.0223.2391)
CCC Help Spanish (x32 Version: 2011.0508.0223.2391)
CCC Help Swedish (x32 Version: 2011.0508.0223.2391)
CCC Help Thai (x32 Version: 2011.0508.0223.2391)
CCC Help Turkish (x32 Version: 2011.0508.0223.2391)
ccc-utility64 (Version: 2011.0508.224.2391)
CCleaner (Version: 4.03)
Chronicles of Albian (x32 Version: 2.2.0.95)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Cisco EAP-FAST Module (x32 Version: 2.2.14)
Cisco LEAP Module (x32 Version: 1.0.19)
Cisco PEAP Module (x32 Version: 1.1.6)
CodeBlocks (HKCU Version: 12.11)
Counter-Strike 1.6 (x32)
Cradle of Rome 2 (x32 Version: 2.2.0.95)
CyberLink YouCam (x32 Version: 3.5.1.4119)
D3DX10 (x32 Version: 15.4.2368.0902)
DAEMON Tools Lite (x32 Version: 4.45.1.0236)
Destinations (x32 Version: 130.0.0.0)
DeviceDiscovery (x32 Version: 130.0.372.000)
Diablo III (x32 Version: 1.0.6.13644)
Die Gilde 2 (x32 Version: 1.20)
DivX-Setup (x32 Version: 2.6.1.8)
DocMgr (x32 Version: 130.0.000.000)
DocProc (x32 Version: 13.0.0.0)
dows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (Version: 05/31/2012 7.1.2.0)
Dropbox (HKCU Version: 2.0.22)
eLicenser Control (x32)
ESU for Microsoft Windows 7 SP1 (x32 Version: 2.1.1)
Farm Frenzy (x32 Version: 2.2.0.95)
FATE (x32 Version: 2.2.0.97)
Fax (x32 Version: 130.0.418.000)
GameSpy Arcade (x32)
GNU Solfege 3.18.7 (x32)
Google Chrome (HKCU Version: 27.0.1453.116)
Google Earth (x32 Version: 7.0.3.8542)
Google Update Helper (x32 Version: 1.3.21.145)
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95)
GPBaseService2 (x32 Version: 130.0.371.000)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
HitmanPro.Alert (Version: 2.0.10.44)
HP Auto (Version: 1.0.12935.3667)
HP Client Services (Version: 1.1.12938.3539)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Document Manager 2.0 (Version: 2.0)
HP Documentation (x32 Version: 1.1.0.0)
HP Games (x32 Version: 1.0.2.5)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP Launch Box (Version: 1.0.11)
HP Officejet 4500 G510g-m (Version: 13.0)
HP On Screen Display (x32 Version: 1.1.2)
HP Power Manager (x32 Version: 1.2.3)
HP Quick Launch (x32 Version: 2.4.3)
HP QuickWeb (x32 Version: 3.1.0.9742)
HP Setup (x32 Version: 8.7.4751.3798)
HP Setup Manager (x32 Version: 1.1.13476.3753)
HP SimplePass PE 2011 (x32 Version: 5.3.0.163)
HP Smart Web Printing 4.5 (Version: 4.5)
HP Software Framework (x32 Version: 4.6.10.1)
HP Solution Center 13.0 (Version: 13.0)
HP Support Assistant (x32 Version: 7.0.39.15)
HP Update (x32 Version: 4.000.011.006)
HPDiagnosticAlert (x32 Version: 1.00.0000)
HPProductAssistant (x32 Version: 130.0.371.000)
HPSSupply (x32 Version: 130.0.371.000)
IDT Audio (x32 Version: 1.0.6341.0)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Display Audio Driver (x32 Version: 6.14.00.3074)
Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (x32 Version: 10.5.0.1026)
iTunes (Version: 11.0.1.12)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Jewel Quest Solitaire (x32 Version: 2.2.0.95)
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
KeePass Password Safe 2.22 (x32)
LAME v3.99.3 (for Windows) (x32)
Mah Jong Medley (x32 Version: 2.2.0.95)
MarketResearch (x32 Version: 130.0.374.000)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft .NET Framework 1.1 (x32)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1)
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1)
Mozilla Firefox 23.0 (x86 de) (x32 Version: 23.0)
Mozilla Maintenance Service (x32 Version: 23.0)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97)
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95)
Network64 (Version: 130.0.374.000)
Network64 (Version: 140.0.221.000)
Nokia Connectivity Cable Driver (x32 Version: 7.1.101.0)
Nokia Suite (x32 Version: 3.7.22.0)
NVIDIA PhysX (x32 Version: 9.09.0203)
OCR Software by I.R.I.S. 13.0 (Version: 13.0)
OpenOffice.org 3.3 (x32 Version: 3.3.9567)
Pando Media Booster (x32 Version: 2.6.0.1)
PC Connectivity Solution (x32 Version: 12.0.76.0)
Penguins! (x32 Version: 2.2.0.95)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)
Polar Bowler (x32 Version: 2.2.0.97)
PreSonus Studio One 2 x64 (Version: 2.0.4.17496)
PriMus Free 1.1 (Build 10306) (x32)
PX Profile Update (x32 Version: 1.00.1.)
Realtek Ethernet Controller Driver (x32 Version: 7.40.126.2011)
Realtek PCIE Card Reader (x32 Version: 6.1.7600.77)
Recovery Manager (x32 Version: 2.0.0)
Risen (x32 Version: 1.00.0000)
Samsung Printer Live Update (x32 Version: 1.01.00.04)
Scan (x32 Version: 13.0.0.0)
Shop for HP Supplies (Version: 13.0)
Skype Click to Call (x32 Version: 5.9.9216)
Skype™ 5.10 (x32 Version: 5.10.116)
Slingo Deluxe (x32 Version: 2.2.0.95)
SmartWebPrinting (x32 Version: 130.0.373.000)
SolutionCenter (x32 Version: 130.0.373.000)
Spotify (HKCU Version: 0.9.1.57.ge7405149)
Spybot - Search & Destroy (x32 Version: 1.6.2)
StarCraft II (x32 Version: 2.0.9.26147)
Status (x32 Version: 130.0.373.000)
Steinberg Cubase LE (x32)
swMSM (x32 Version: 12.0.0.1)
Synaptics TouchPad Driver (Version: 15.3.11.0)
System Requirements Lab for Intel (x32 Version: 4.5.13.0)
Toolbox (x32 Version: 130.0.648.000)
Tor 0.2.3.25 (x32)
TrayApp (x32 Version: 130.0.376.000)
TrueCrypt (x32 Version: 7.1a)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update Installer for WildTangent Games App (x32)
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
Vidalia 0.2.21 (x32)
VIP Access SDK (1.0.1.2) (x32 Version: 1.0.1.2)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)
WebReg (x32 Version: 130.0.132.017)
Wecker für Windows 6.5 (x32 Version: 6.5)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.16)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
WinRAR 4.01 (32-Bit) (x32 Version: 4.01.0)
Zuma Deluxe (x32 Version: 2.2.0.95)
==================== Restore Points =========================
24-06-2013 00:47:14 Removed Ubisoft Game Launcher
24-06-2013 10:27:18 Installed Java 7 Update 25
25-06-2013 14:06:27 Windows Update
02-07-2013 15:27:15 Windows Update
08-07-2013 13:18:04 Windows Update
11-07-2013 08:34:07 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2012-11-05 02:39 - 00444767 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
Task: {0AC60782-B791-4ACC-B03A-97B4A9B3D320} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {0D9498E3-626A-4842-A48C-CCE7E5144765} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001UA => C:\Users\***\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-27] (Google Inc.)
Task: {0F9989F7-3030-433B-BB2C-B16540FE792A} - System32\Tasks\{0339D05A-064B-445B-9D45-E72FCE10E9F7} => C:\SETUP.EXE No File
Task: {1B180CA8-E574-46C2-ACC4-1E564B84933E} - System32\Tasks\HPCeeScheduleForKai => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {1CE73B67-A4B5-4F60-AE73-A1669A4AB100} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-06-09] (Google Inc.)
Task: {1DD7BE4B-B7C1-438F-BC73-AC582E857009} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company)
Task: {1E4C7BB7-197C-492C-8327-71B64C7A58E1} - System32\Tasks\{F9B7E640-5430-4515-94E1-2B6ACCED6C67} => C:\SETUP.EXE No File
Task: {1E7FE284-B5C8-4929-9F37-451998DC3BFE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-06-09] (Google Inc.)
Task: {1F3CBD55-AD91-4BEF-85BF-4DA5554D0D35} - System32\Tasks\{69BFD3AE-8AE6-4C44-BC75-7C429EAC307D} => C:\Users\****\Downloads\Diablo 2 with Lord of Destruction (v1.13c) (Direct Play)\Diablo II Lord of Destruction (v1.13c)\Diablo II\Diablo II.exe [2011-01-05] (Blizzard North)
Task: {29D4928B-E5B5-4567-A0D2-EA64FB481EB7} - System32\Tasks\{C43B510E-6C9B-4C7F-866A-15987A642BB7} => C:\Users\****\Downloads\Diablo 2 with Lord of Destruction (v1.13c) (Direct Play)\Diablo II Lord of Destruction (v1.13c)\Diablo II\Diablo II.exe [2011-01-05] (Blizzard North)
Task: {3EFFE1AB-E3A9-4F78-B2F1-CCADF5D981A1} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {4095BAA1-FAD0-4E5F-83A2-22B23023E9BA} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {415D2339-C57F-4902-BA1A-DB0836AA18F0} - System32\Tasks\{FCB1C6FE-BFA3-45C6-ABA2-D75218AD0C6B} => C:\Users\****\Downloads\Diablo 2 with Lord of Destruction (v1.13c) (Direct Play)\Diablo II Lord of Destruction (v1.13c)\Diablo II\Diablo II.exe [2011-01-05] (Blizzard North)
Task: {50C31A8B-C93A-4550-98C0-42927C59548C} - System32\Tasks\User_Feed_Synchronization-{845D5F33-BF75-41E9-A20A-4D3E0EDECEC8} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {56662A8B-1B8A-4BD8-B299-926AD5CE80DD} - System32\Tasks\{FAFFC29D-5BDA-4C0D-847B-3458B13E0105} => C:\SETUP.EXE No File
Task: {6BB6FB41-0D54-4584-9C8A-7F525285B6BA} - System32\Tasks\{69EAA366-7291-4514-A74A-A12E50BFF844} => C:\Program Files (x86)\Internet Explorer\iexplore.exe [2013-05-29] (Microsoft Corporation)
Task: {6E07848C-88F7-4489-AF43-A820BD6DB191} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {7024EC70-42E4-40E0-B6A1-CB7CF859042C} - System32\Tasks\{D25A0714-2328-4F14-9825-F923A50CCE66} => C:\Users\****\Downloads\Diablo 2 with Lord of Destruction (v1.13c) (Direct Play)\Diablo II Lord of Destruction (v1.13c)\Diablo II\Diablo II.exe [2011-01-05] (Blizzard North)
Task: {7B6ADD76-E59D-451A-9B1A-0CBBB9F314E9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-06-10] (Hewlett-Packard)
Task: {7C581D43-C481-438E-B62F-E7A543FF724B} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {878326A2-C00D-4B96-8B8B-68C61987FA36} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => C:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {8A0813D1-5853-4DD4-B654-92F5BBA529BE} - System32\Tasks\{D7B71A86-1B44-4840-8898-E5C664E56EC2} => C:\Users\****\Downloads\Diablo 2 with Lord of Destruction (v1.13c) (Direct Play)\Diablo II Lord of Destruction (v1.13c)\Diablo II\Diablo II.exe [2011-01-05] (Blizzard North)
Task: {A576C383-A257-442F-85EC-0DBEDEB2D939} - System32\Tasks\{1E3AC909-F5E9-4DC3-AC40-A2E883711D05} => C:\Games\Redalert\RA95.EXE [2012-12-11] ()
Task: {B8E9C7DE-4179-4F37-8AF9-6A1AFA3DCA2A} - System32\Tasks\{0E9A5E3F-67E8-4976-8565-90E82C8A898E} => C:\Users\****\Desktop\AoE2noCD\EMPIRES2.EXE [2006-10-11] (Microsoft Corporation)
Task: {BEBE61D0-9F32-4DC4-9BCB-7EDC38DAEF7F} - System32\Tasks\{9A2F8FA5-36C2-4D84-839E-C57FB05BB0DF} => C:\Age of Empires II\EMPIRES2.EXE [2000-07-29] (Microsoft Corporation)
Task: {C166E58E-5566-4EB2-8A9A-58199BDA8C53} - System32\Tasks\{6945B8E2-A52F-4BD1-A6BB-9BABE0FDD688} => C:\Users\****\Desktop\AoE2noCD\EMPIRES2.EXE [2006-10-11] (Microsoft Corporation)
Task: {C81959F2-1FC6-4719-898B-05E8E274C344} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001Core => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-27] (Google Inc.)
Task: {C8294977-2064-4A9A-B848-3BB59EA531A6} - System32\Tasks\avast! Emergency Update => C:\Program Files (x86)\avast! Free Antivirus\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {CC684035-9BEA-4C75-AF32-4EF8C61C0247} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(Yes) => C:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe [2013-06-18] (Hewlett-Packard)
Task: {CDFB450E-F124-46E0-BB0B-0F86FB382951} - System32\Tasks\{CDF66152-503F-4C35-BB27-89D6A973D90D} => C:\Age of Empires II\EMPIRES2.EXE [2000-07-29] (Microsoft Corporation)
Task: {CEB61610-D005-4858-BFC2-593E735D18AC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {CF1A1BEA-90B2-46DC-8816-F9DF4914083E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(No) => C:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe [2013-06-18] (Hewlett-Packard)
Task: {E9DE52CC-6BDB-484D-83B8-11C402D3D07D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {F810B1B9-9051-477E-9AEF-AFF518E01346} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-06-19] (Piriform Ltd)
Task: {FCCB743A-5057-4537-B312-FBEEEDA9F2E0} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001Core.job => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001UA.job => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForKai.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/11/2013 05:50:52 PM) (Source: Application Hang) (User: )
Description: Programm FRST64.exe, Version 3.3.8.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1590
Startzeit: 01ce7e3f4485910a
Endzeit: 10
Anwendungspfad: C:\Users\Kai\Desktop\FRST64.exe
Berichts-ID:
Error: (07/11/2013 03:57:42 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/11/2013 03:55:47 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 77985
Error: (07/11/2013 03:55:47 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 77985
Error: (07/11/2013 03:55:47 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/11/2013 03:55:31 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 62385
Error: (07/11/2013 03:55:31 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 62385
Error: (07/11/2013 03:55:31 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/11/2013 03:55:16 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 46785
Error: (07/11/2013 03:55:16 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 46785
System errors:
=============
Error: (07/11/2013 04:03:20 PM) (Source: DCOM) (User: )
Description: {1F87137D-0E7C-44D5-8C73-4EFFB68962F2}
Error: (07/11/2013 03:47:11 PM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (07/11/2013 01:11:55 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (07/11/2013 01:11:55 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.
Error: (07/11/2013 01:08:13 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (07/11/2013 01:08:13 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst HP Support Assistant Service erreicht.
Error: (07/05/2013 08:36:12 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (07/04/2013 03:04:01 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (07/04/2013 03:04:01 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.
Error: (06/29/2013 01:08:49 AM) (Source: Service Control Manager) (User: )
Description: Dienst "TrueSuiteService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office Sessions:
=========================
Error: (07/11/2013 05:50:52 PM) (Source: Application Hang)(User: )
Description: FRST64.exe3.3.8.1159001ce7e3f4485910a10C:\Users\Kai\Desktop\FRST64.exe
Error: (07/11/2013 03:57:42 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/11/2013 03:55:47 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 77985
Error: (07/11/2013 03:55:47 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 77985
Error: (07/11/2013 03:55:47 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/11/2013 03:55:31 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 62385
Error: (07/11/2013 03:55:31 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 62385
Error: (07/11/2013 03:55:31 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/11/2013 03:55:16 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 46785
Error: (07/11/2013 03:55:16 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 46785
CodeIntegrity Errors:
===================================
Date: 2013-02-26 02:40:29.032
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-26 02:40:28.980
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-08-11 03:22:00.079
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-08-11 03:22:00.063
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-08-11 03:20:28.319
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-08-11 03:20:28.303
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-08-11 03:19:50.372
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-08-11 03:19:50.356
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\PeerGuardian2\pgfilter.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 29%
Total physical RAM: 6091.86 MB
Available physical RAM: 4292.52 MB
Total Pagefile: 12181.9 MB
Available Pagefile: 10274.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:678.21 GB) (Free:410.95 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:16.27 GB) (Free:1.76 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.08 GB) FAT32 (Disk=0 Partition=4)
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: F36AF300)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=678 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)
==================== End Of Log ============================
|
|
11.07.2013, 19:10
| #10 |
| /// the machine /// TB-Ausbilder | Zusätzliche Firewall sinnvoll? Adware Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST Logfile bitte
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.07.2013, 19:43
| #11 |
| | Zusätzliche Firewall sinnvoll? Tadaa: AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.305 - Datei am 11/07/2013 um 21:40:33 erstellt
# Aktualisiert am 11/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : **** - ****-HP
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\****\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\boost_interprocess
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16496
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v23.0 (de)
Datei : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\mibzh96l.default\prefs.js
[OK] Die Datei ist sauber.
-\\ Google Chrome v27.0.1453.116
Datei : C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Preferences
Gelöscht [l.31] : icon_url = "hxxp://www.ask.com/favicon.ico",
Gelöscht [l.34] : keyword = "ask.com",
Gelöscht [l.38] : search_url = "hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=[...]
Gelöscht [l.39] : suggest_url = "hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTer[...]
Gelöscht [l.2227] : homepage = "hxxp://www.searchnu.com/410",
*************************
AdwCleaner[S1].txt - [6373 octets] - [11/07/2013 21:40:33]
########## EOF - C:\AdwCleaner[S1].txt - [6433 octets] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 5.0.7 (07.11.2013:1) OS: Windows 7 Home Premium x64 Ran by **** on 11.07.2013 at 22:06:57,16 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{42218EA0-A1A3-4FAE-BBF7-7482498E8022} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{801DB2AE-1BC6-4D42-AC28-26024FC09C17} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{42218EA0-A1A3-4FAE-BBF7-7482498E8022} ~~~ Files ~~~ Folders ~~~ FireFox Emptied folder: C:\Users\****\AppData\Roaming\mozilla\firefox\profiles\mibzh96l.default\minidumps [16 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 11.07.2013 at 22:19:49,16 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2013 04
Ran by **** (administrator) on 12-07-2013 20:27:46
Running from C:\Users\****\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files (x86)\avast! Free Antivirus\AvastSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler64.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Spotify Ltd) C:\Users\****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(AVAST Software) C:\Program Files (x86)\avast! Free Antivirus\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [168216 2011-04-15] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [392472 2011-04-15] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [416024 2011-04-15] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [Spotify Web Helper] - "C:\Users\****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1104384 2013-07-09] (Spotify Ltd)
HKCU\...\Run: [Google Update] - "C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-06-27] (Google Inc.)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
MountPoints2: H - H:\LaunchU3.exe -a
MountPoints2: {520b6f0d-6e9c-11e1-b912-101f74ca483d} - H:\LaunchU3.exe -a
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586808 2011-04-08] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [318520 2011-01-27] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [avast] - "C:\Program Files (x86)\avast! Free Antivirus\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [KeePass 2 PreLoad] - "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload [1960448 2013-04-05] (Dominik Reichl)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
AppInit_DLLs: [0 ] ()
AppInit_DLLs-x32: [0 ] ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE64.dll (AVAST Software)
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - No Name - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM-x32 - No Name - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\mibzh96l.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\***\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\****\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
FF Extension: HTTPS-Everywhere - C:\Users\Kai\AppData\Roaming\Mozilla\Firefox\Profiles\mibzh96l.default\Extensions\https-everywhere@eff.org
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\mibzh96l.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files (x86)\avast! Free Antivirus\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files (x86)\avast! Free Antivirus\WebRep\FF
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://google.de/"
CHR DefaultSearchURL: (Ask) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR Plugin: (Shockwave Flash) - C:\Users\****\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.110\gcswf32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll No File
CHR Plugin: (Simple Pass 2011) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdhihajbmafmgilcciomnamcjfkdhikl\1.0_0\npwebsitelogon.dll (HP)
CHR Plugin: (Skype Toolbars) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files (x86)\avast! Free Antivirus\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [1759168 2013-07-11] (SurfRight B.V.)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2011-12-30] ()
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [279616 2011-12-29] (DT Soft Ltd)
R2 hmpalert; C:\Windows\system32\drivers\hmpalert.sys [17416 2013-07-11] ()
R2 hmpalert; C:\Windows\system32\drivers\hmpalert.sys [17416 2013-07-11] ()
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2011-12-30] ()
S3 PRESONUS_AUDIOBOX_MIDI; C:\Windows\System32\drivers\psabusbm.sys [37496 2009-12-04] (Ploytec GmbH)
S3 PRESONUS_AUDIOBOX_USB; C:\Windows\System32\Drivers\psabusbu.sys [462968 2009-12-04] (Ploytec GmbH)
S3 PRESONUS_AUDIOBOX_WDM; C:\Windows\System32\drivers\psabusba.sys [50808 2009-12-04] (Ploytec GmbH)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-11 22:19 - 2013-07-11 22:19 - 00001191 ____A C:\Users\****\Desktop\JRT.txt
2013-07-11 22:06 - 2013-07-11 22:06 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\Kai\Desktop\JRT.exe
2013-07-11 22:06 - 2013-07-11 22:06 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 22:02 - 2013-07-11 22:02 - 00006482 ____A C:\Users\****\Desktop\AdwCleaner[S1].txt
2013-07-11 21:40 - 2013-07-11 21:44 - 00006476 ____A C:\AdwCleaner[S1].txt
2013-07-11 21:38 - 2013-07-11 21:39 - 00662345 ____A C:\Users\****\Desktop\adwcleaner.exe
2013-07-11 16:00 - 2013-07-11 16:00 - 00000000 ____D C:\FRST
2013-07-11 14:32 - 2013-07-11 14:32 - 01777775 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-07-11 11:48 - 2013-06-24 04:48 - 00000000 ____D C:\Users\****\Desktop\Tor Browser
2013-07-11 11:46 - 2013-07-11 11:48 - 28110931 ____A (Igor Pavlov) C:\Users\****\Downloads\tor-browser-2.3.25-10_de.exe
2013-07-11 11:42 - 2013-05-29 07:36 - 01346560 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 11:42 - 2013-05-29 07:35 - 01392128 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 11:42 - 2013-05-29 07:34 - 01494528 ____A (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-11 11:42 - 2013-05-29 07:33 - 00237056 ____A (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-11 11:42 - 2013-05-29 07:29 - 00173056 ____A (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-11 11:42 - 2013-05-29 07:25 - 02382848 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 11:42 - 2013-05-29 07:25 - 00096768 ____A (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-11 11:42 - 2013-05-29 07:18 - 00248320 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 11:42 - 2013-05-29 03:41 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-11 11:42 - 2013-05-29 03:41 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 11:42 - 2013-05-29 03:41 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 11:42 - 2013-05-29 03:40 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-11 11:42 - 2013-05-29 03:37 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-11 11:42 - 2013-05-29 03:36 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-11 11:42 - 2013-05-29 03:33 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 11:42 - 2013-05-29 03:33 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-11 11:42 - 2013-05-29 03:29 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 11:41 - 2013-05-29 08:15 - 17829376 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 11:41 - 2013-05-29 07:50 - 10926080 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 11:41 - 2013-05-29 07:43 - 02312704 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 11:41 - 2013-05-29 07:31 - 00085504 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 11:41 - 2013-05-29 07:29 - 00816640 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 11:41 - 2013-05-29 07:29 - 00599040 ____A (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-11 11:41 - 2013-05-29 07:27 - 02147840 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 11:41 - 2013-05-29 07:27 - 00729088 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 11:41 - 2013-05-29 03:56 - 12333568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 11:41 - 2013-05-29 03:50 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 11:41 - 2013-05-29 03:48 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 11:41 - 2013-05-29 03:38 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 11:41 - 2013-05-29 03:35 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 11:41 - 2013-05-29 03:35 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 11:41 - 2013-05-29 03:33 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 11:38 - 2013-07-11 11:38 - 00486139 ____A C:\Users\****\Downloads\https-everywhere324-latest.zip
2013-07-11 11:38 - 2013-07-11 10:19 - 00504251 ____A C:\Users\****\Desktop\https-everywhere-latest.xpi
2013-07-11 11:30 - 2013-07-11 18:35 - 00000000 ____D C:\Users\****\AppData\Roaming\tor
2013-07-11 11:18 - 2013-07-11 18:36 - 00000000 ____D C:\Users\****\AppData\Local\Vidalia
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Users\****\AppData\Local\Tor
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Program Files (x86)\Vidalia Bridge Bundle
2013-07-11 11:16 - 2013-07-11 11:17 - 09636506 ____A C:\Users\****\Downloads\vidalia-bridge-bundle-0.2.3.25-0.2.21.exe
2013-07-10 16:17 - 2013-07-10 16:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-10 15:51 - 2013-06-05 05:34 - 03153920 ____A (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 15:51 - 2013-06-04 08:00 - 00624128 ____A (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 15:51 - 2013-06-04 06:53 - 00509440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 15:51 - 2013-05-06 08:03 - 01887744 ____A (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 15:51 - 2013-05-06 06:56 - 01620480 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 15:50 - 2013-04-10 01:34 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 15:50 - 2013-04-03 00:51 - 01643520 ____A (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-09 18:03 - 2013-07-12 20:08 - 00000504 ____A C:\Windows\setupact.log
2013-07-09 18:03 - 2013-07-09 18:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 12:03 - 2013-07-09 12:05 - 04396440 ____A (Piriform Ltd) C:\Users\****\Downloads\ccsetup403.exe
2013-07-08 16:16 - 2013-07-08 16:26 - 00008836 ____A C:\Users\****\Desktop\ESTA Auftragsnummer.odt
2013-07-03 20:46 - 2013-07-11 13:04 - 00000000 ____D C:\Program Files (x86)\HitmanPro.Alert
2013-07-03 20:46 - 2013-07-11 11:24 - 00540104 ____A (SurfRight) C:\Windows\SysWOW64\hmpalert.dll
2013-07-03 20:46 - 2013-07-11 11:24 - 00494784 ____A (SurfRight) C:\Windows\system32\hmpalert.dll
2013-07-03 20:46 - 2013-07-11 11:24 - 00017416 ____A C:\Windows\system32\Drivers\hmpalert.sys
2013-07-03 20:46 - 2013-07-03 20:46 - 00000000 ____D C:\ProgramData\HitmanPro.Alert
2013-07-03 20:45 - 2013-07-03 20:45 - 01751952 ____A (SurfRight B.V.) C:\Users\****\Downloads\hmpalert.exe
2013-07-03 20:40 - 2013-07-03 20:40 - 00002019 ____A C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-07-03 20:39 - 2013-07-03 20:39 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-03 20:32 - 2013-07-03 20:32 - 07872648 ____A (Adobe Systems Inc.) C:\Users\****\Downloads\Shockwave_Installer_Slim.exe
2013-07-03 17:42 - 2013-07-03 18:03 - 00000000 ____D C:\Users\****\Skrupelloser Scheiß
2013-06-28 14:30 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-26 22:22 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-26 22:22 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-06-26 20:50 - 2013-06-26 20:51 - 08340864 ____A (PortableApps.com) C:\Users\****\Downloads\ClamWinPortable_0.97.8_English.paf.exe
2013-06-26 20:23 - 2013-06-26 20:23 - 00903080 ____A (Oracle Corporation) C:\Users\****\Downloads\jxpiinstall.exe
2013-06-26 20:21 - 2013-06-26 20:21 - 00000000 ____D C:\Users\****\AppData\Roaming\Oracle
2013-06-24 12:28 - 2013-06-24 12:28 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-24 00:47 - 2013-06-24 00:47 - 00002768 ____A C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-06-24 00:46 - 2013-06-24 00:46 - 04378864 ____A (Piriform Ltd) C:\Users\****\Downloads\ccsetup402.exe
2013-06-20 17:48 - 2013-06-20 17:48 - 00376576 ____A C:\Users\****\Downloads\wot_safe_surfing-20130515-fx.zip
2013-06-13 21:48 - 2013-06-13 21:48 - 00001105 ____A C:\Users\****\Desktop\KeePass 2.lnk
2013-06-13 21:48 - 2013-06-13 21:48 - 00000000 ____D C:\Program Files (x86)\KeePass Password Safe 2
2013-06-13 21:47 - 2013-06-13 21:48 - 02475400 ____A (Dominik Reichl ) C:\Users\****\Downloads\KeePass-2.22-Setup(1).exe
2013-06-13 21:45 - 2013-06-13 21:46 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22(1).zip
2013-06-13 21:22 - 2013-06-13 21:25 - 58084984 ____A (PortableApps.com) C:\Users\****\Downloads\PortableApps.com_Suite_Light_Setup_1.6.1_German.exe
2013-06-13 20:05 - 2013-06-13 20:06 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22.zip
2013-06-12 12:08 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-06-12 12:08 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-06-12 12:08 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-06-12 12:08 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-06-12 12:08 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 12:08 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 12:08 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 12:08 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-06-12 12:08 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 12:08 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 12:08 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-06-12 12:08 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 12:08 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-06-12 12:08 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-06-12 12:08 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 12:08 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 12:08 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 12:08 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-06-12 12:08 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\system32\d3d11.dll
==================== One Month Modified Files and Folders =======
2013-07-12 20:26 - 2012-09-03 20:03 - 00001112 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001UA.job
2013-07-12 20:18 - 2011-11-05 18:51 - 00003914 ____A C:\Windows\System32\Tasks\User_Feed_Synchronization-{845D5F33-BF75-41E9-A20A-4D3E0EDECEC8}
2013-07-12 20:16 - 2012-06-09 12:37 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-12 20:16 - 2009-07-14 06:45 - 00031856 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-12 20:16 - 2009-07-14 06:45 - 00031856 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-12 20:13 - 2012-03-11 05:12 - 01614764 ____A C:\Windows\WindowsUpdate.log
2013-07-12 20:10 - 2012-07-10 13:14 - 00004196 ____A C:\Windows\System32\Tasks\avast! Emergency Update
2013-07-12 20:08 - 2013-07-09 18:03 - 00000504 ____A C:\Windows\setupact.log
2013-07-12 20:08 - 2012-06-09 12:37 - 00001100 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-12 20:08 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 23:44 - 2012-03-18 20:38 - 00000000 ____D C:\Users\****\AppData\Roaming\Spotify
2013-07-11 22:19 - 2013-07-11 22:19 - 00001191 ____A C:\Users\*****\Desktop\JRT.txt
2013-07-11 22:06 - 2013-07-11 22:06 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\Kai\Desktop\JRT.exe
2013-07-11 22:06 - 2013-07-11 22:06 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 22:02 - 2013-07-11 22:02 - 00006482 ____A C:\Users\****\Desktop\AdwCleaner[S1].txt
2013-07-11 21:44 - 2013-07-11 21:40 - 00006476 ____A C:\AdwCleaner[S1].txt
2013-07-11 21:39 - 2013-07-11 21:38 - 00662345 ____A C:\Users\****\Desktop\adwcleaner.exe
2013-07-11 18:36 - 2013-07-11 11:18 - 00000000 ____D C:\Users\****\AppData\Local\Vidalia
2013-07-11 18:35 - 2013-07-11 11:30 - 00000000 ____D C:\Users\****\AppData\Roaming\tor
2013-07-11 17:24 - 2012-09-03 20:03 - 00001060 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001Core.job
2013-07-11 16:00 - 2013-07-11 16:00 - 00000000 ____D C:\FRST
2013-07-11 15:47 - 2013-06-11 23:19 - 00000000 ____D C:\Users\****\AppData\Roaming\KeePass
2013-07-11 14:32 - 2013-07-11 14:32 - 01777775 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-07-11 13:05 - 2009-07-14 06:45 - 00302296 ____A C:\Windows\system32\FNTCACHE.DAT
2013-07-11 13:04 - 2013-07-03 20:46 - 00000000 ____D C:\Program Files (x86)\HitmanPro.Alert
2013-07-11 13:04 - 2013-05-17 15:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-11 13:04 - 2012-05-18 22:57 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 13:04 - 2012-05-18 22:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-11 13:03 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 13:03 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 12:11 - 2013-06-11 23:36 - 00004702 ____A C:\Users\****\Desktop\Datenbank.kdbx
2013-07-11 11:53 - 2011-07-16 07:32 - 00664868 ____A C:\Windows\system32\perfh007.dat
2013-07-11 11:53 - 2011-07-16 07:32 - 00135004 ____A C:\Windows\system32\perfc007.dat
2013-07-11 11:53 - 2009-07-14 07:13 - 01549542 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 11:48 - 2013-07-11 11:46 - 28110931 ____A (Igor Pavlov) C:\Users\****\Downloads\tor-browser-2.3.25-10_de.exe
2013-07-11 11:43 - 2012-02-07 18:56 - 78185248 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 11:38 - 2013-07-11 11:38 - 00486139 ____A C:\Users\****\Downloads\https-everywhere324-latest.zip
2013-07-11 11:24 - 2013-07-03 20:46 - 00540104 ____A (SurfRight) C:\Windows\SysWOW64\hmpalert.dll
2013-07-11 11:24 - 2013-07-03 20:46 - 00494784 ____A (SurfRight) C:\Windows\system32\hmpalert.dll
2013-07-11 11:24 - 2013-07-03 20:46 - 00017416 ____A C:\Windows\system32\Drivers\hmpalert.sys
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Users\****\AppData\Local\Tor
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Program Files (x86)\Vidalia Bridge Bundle
2013-07-11 11:17 - 2013-07-11 11:16 - 09636506 ____A C:\Users\****\Downloads\vidalia-bridge-bundle-0.2.3.25-0.2.21.exe
2013-07-11 10:19 - 2013-07-11 11:38 - 00504251 ____A C:\Users\****\Desktop\https-everywhere-latest.xpi
2013-07-10 16:17 - 2013-07-10 16:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-09 18:03 - 2013-07-09 18:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 18:03 - 2012-03-18 20:42 - 00000000 ____D C:\Users\****\AppData\Local\Spotify
2013-07-09 12:06 - 2012-03-06 08:59 - 00000822 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 12:06 - 2012-03-06 08:59 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 12:05 - 2013-07-09 12:03 - 04396440 ____A (Piriform Ltd) C:\Users\Kai\Downloads\ccsetup403.exe
2013-07-08 22:26 - 2012-06-18 08:23 - 00007600 ____A C:\Users\****\AppData\Local\Resmon.ResmonCfg
2013-07-08 17:14 - 2011-11-05 18:52 - 00000000 ____D C:\Users\****\Documents\Youcam
2013-07-08 16:26 - 2013-07-08 16:16 - 00008836 ____A C:\Users\****\Desktop\ESTA Auftragsnummer.odt
2013-07-08 15:24 - 2012-01-09 18:15 - 00000000 ____A C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-07-04 23:12 - 2012-01-06 16:24 - 00000000 ____D C:\Program Files (x86)\avast! Free Antivirus
2013-07-03 20:46 - 2013-07-03 20:46 - 00000000 ____D C:\ProgramData\HitmanPro.Alert
2013-07-03 20:45 - 2013-07-03 20:45 - 01751952 ____A (SurfRight B.V.) C:\Users\****\Downloads\hmpalert.exe
2013-07-03 20:40 - 2013-07-03 20:40 - 00002019 ____A C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-07-03 20:40 - 2011-11-06 14:35 - 00000000 ____D C:\Users\****\AppData\Local\Adobe
2013-07-03 20:39 - 2013-07-03 20:39 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-03 20:39 - 2011-07-15 22:16 - 00000000 ____D C:\ProgramData\Adobe
2013-07-03 20:33 - 2011-07-15 22:10 - 00000000 ____D C:\Windows\SysWOW64\Adobe
2013-07-03 20:32 - 2013-07-03 20:32 - 07872648 ____A (Adobe Systems Inc.) C:\Users\****\Downloads\Shockwave_Installer_Slim.exe
2013-07-03 18:24 - 2013-04-02 18:39 - 00000000 ____D C:\Users\****\AppData\Local\HP
2013-07-03 18:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-03 18:03 - 2013-07-03 17:42 - 00000000 ____D C:\Users\****\Skrupelloser Scheiß
2013-07-03 17:42 - 2011-11-05 18:46 - 00000000 ____D C:\Users\****
2013-07-03 17:19 - 2012-09-03 20:03 - 00004078 ____A C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001UA
2013-07-03 17:19 - 2012-09-03 20:03 - 00003682 ____A C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001Core
2013-07-02 16:01 - 2012-02-06 18:19 - 00000324 ____A C:\Windows\Tasks\HPCeeScheduleForKai.job
2013-07-01 20:14 - 2012-02-06 18:19 - 00003174 ____A C:\Windows\System32\Tasks\HPCeeScheduleForKai
2013-07-01 20:14 - 2012-01-02 12:21 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log
2013-06-29 01:08 - 2009-07-14 07:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-28 14:30 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-28 14:30 - 2013-06-26 22:22 - 00000175 ____A C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-28 14:30 - 2013-06-26 22:22 - 00000175 ____A C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-06-28 14:30 - 2013-06-11 22:22 - 00189936 ____A C:\Windows\system32\Drivers\aswVmm.sys
2013-06-28 14:30 - 2012-01-06 16:24 - 01030952 ____A (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-06-28 14:30 - 2012-01-06 16:24 - 00378944 ____A (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-06-26 20:51 - 2013-06-26 20:50 - 08340864 ____A (PortableApps.com) C:\Users\****\Downloads\ClamWinPortable_0.97.8_English.paf.exe
2013-06-26 20:23 - 2013-06-26 20:23 - 00903080 ____A (Oracle Corporation) C:\Users\****\Downloads\jxpiinstall.exe
2013-06-26 20:22 - 2012-01-03 02:10 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-26 20:21 - 2013-06-26 20:21 - 00000000 ____D C:\Users\****\AppData\Roaming\Oracle
2013-06-24 12:28 - 2013-06-24 12:28 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-24 12:28 - 2012-11-04 22:52 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-24 12:28 - 2012-11-04 22:52 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-24 12:28 - 2012-11-04 22:52 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-24 12:28 - 2012-09-08 09:31 - 00867240 ____A (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-06-24 12:28 - 2012-01-03 02:10 - 00789416 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-06-24 12:14 - 2011-11-05 18:50 - 00068104 ____A C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-24 04:48 - 2013-07-11 11:48 - 00000000 ____D C:\Users\****\Desktop\Tor Browser
2013-06-24 02:49 - 2012-08-11 22:31 - 00000000 ____D C:\Users\****\Desktop\Registry Saves
2013-06-24 02:47 - 2011-07-15 22:20 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-24 02:46 - 2013-03-26 20:01 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2013-06-24 00:57 - 2012-01-06 16:19 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-06-24 00:51 - 2012-05-05 03:15 - 00000000 ____D C:\Users\****\AppData\Local\CrashDumps
2013-06-24 00:47 - 2013-06-24 00:47 - 00002768 ____A C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-06-24 00:46 - 2013-06-24 00:46 - 04378864 ____A (Piriform Ltd) C:\Users\****\Downloads\ccsetup402.exe
2013-06-23 19:18 - 2012-02-17 19:35 - 00000000 ____D C:\Program Files (x86)\StarCraft II
2013-06-20 17:48 - 2013-06-20 17:48 - 00376576 ____A C:\Users\****\Downloads\wot_safe_surfing-20130515-fx.zip
2013-06-18 16:36 - 2012-08-17 16:42 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-18 16:36 - 2011-07-15 22:03 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-13 21:48 - 2013-06-13 21:48 - 00001105 ____A C:\Users\****\Desktop\KeePass 2.lnk
2013-06-13 21:48 - 2013-06-13 21:48 - 00000000 ____D C:\Program Files (x86)\KeePass Password Safe 2
2013-06-13 21:48 - 2013-06-13 21:47 - 02475400 ____A (Dominik Reichl ) C:\Users\****\Downloads\KeePass-2.22-Setup(1).exe
2013-06-13 21:46 - 2013-06-13 21:45 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22(1).zip
2013-06-13 21:25 - 2013-06-13 21:22 - 58084984 ____A (PortableApps.com) C:\Users\****\Downloads\PortableApps.com_Suite_Light_Setup_1.6.1_German.exe
2013-06-13 20:06 - 2013-06-13 20:05 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22.zip
2013-06-13 19:51 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-03 00:15
==================== End Of Log ============================
--- --- --- |
|
12.07.2013, 20:56
| #12 |
| /// the machine /// TB-Ausbilder | Zusätzliche Firewall sinnvoll?ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.07.2013, 09:33
| #13 |
| | Zusätzliche Firewall sinnvoll? ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=9fe03113ba82f243809d860f135dc153 # engine=14370 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-07-13 12:41:12 # local_time=2013-07-13 02:41:12 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776573 100 94 23272 125305922 0 0 # scanned=324521 # found=2 # cleaned=0 # scan_time=16541 sh=208960E23B20A42224002D229711A89B25C83E2C ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\BrothersoftExtremeCT.zip" sh=208960E23B20A42224002D229711A89B25C83E2C ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\BrothersoftExtremeCT.zip" Results of screen317's Security Check version 0.99.68 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` MVPS Hosts File Spybot - Search & Destroy Java 7 Update 25 Adobe Flash Player 11.7.700.224 Adobe Reader XI Mozilla Firefox (23.0) Google Chrome 28.0.1500.71 Google Chrome 28.0.1500.72 ````````Process Check: objlist.exe by Laurent```````` Spybot Teatimer.exe is disabled! avast! Free Antivirus AvastSvc.exe avast! Free Antivirus AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2013 04
Ran by **** (administrator) on 13-07-2013 10:20:20
Running from C:\Users\****\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files (x86)\avast! Free Antivirus\AvastSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler64.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Spotify Ltd) C:\Users\****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(AVAST Software) C:\Program Files (x86)\avast! Free Antivirus\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\agcp.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [168216 2011-04-15] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [392472 2011-04-15] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [416024 2011-04-15] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [Spotify Web Helper] - "C:\Users\****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1104384 2013-07-09] (Spotify Ltd)
HKCU\...\Run: [Google Update] - "C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-06-27] (Google Inc.)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
MountPoints2: H - H:\LaunchU3.exe -a
MountPoints2: {520b6f0d-6e9c-11e1-b912-101f74ca483d} - H:\LaunchU3.exe -a
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586808 2011-04-08] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [318520 2011-01-27] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [avast] - "C:\Program Files (x86)\avast! Free Antivirus\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [KeePass 2 PreLoad] - "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload [1960448 2013-04-05] (Dominik Reichl)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
AppInit_DLLs: [0 ] ()
AppInit_DLLs-x32: [0 ] ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE64.dll (AVAST Software)
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - No Name - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\avast! Free Antivirus\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM-x32 - No Name - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\mibzh96l.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\****\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\****\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
FF Extension: HTTPS-Everywhere - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\mibzh96l.default\Extensions\https-everywhere@eff.org
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\mibzh96l.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files (x86)\avast! Free Antivirus\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files (x86)\avast! Free Antivirus\WebRep\FF
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://google.de/"
CHR DefaultSearchURL: (Ask) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR Plugin: (Shockwave Flash) - C:\Users\****\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.110\gcswf32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\****\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll No File
CHR Plugin: (Simple Pass 2011) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdhihajbmafmgilcciomnamcjfkdhikl\1.0_0\npwebsitelogon.dll (HP)
CHR Plugin: (Skype Toolbars) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files (x86)\avast! Free Antivirus\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [1759168 2013-07-11] (SurfRight B.V.)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2011-12-30] ()
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [279616 2011-12-29] (DT Soft Ltd)
R2 hmpalert; C:\Windows\system32\drivers\hmpalert.sys [17416 2013-07-11] ()
R2 hmpalert; C:\Windows\system32\drivers\hmpalert.sys [17416 2013-07-11] ()
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2011-12-30] ()
S3 PRESONUS_AUDIOBOX_MIDI; C:\Windows\System32\drivers\psabusbm.sys [37496 2009-12-04] (Ploytec GmbH)
S3 PRESONUS_AUDIOBOX_USB; C:\Windows\System32\Drivers\psabusbu.sys [462968 2009-12-04] (Ploytec GmbH)
S3 PRESONUS_AUDIOBOX_WDM; C:\Windows\System32\drivers\psabusba.sys [50808 2009-12-04] (Ploytec GmbH)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-13 10:19 - 2013-07-13 10:19 - 00000922 ____A C:\Users\****\Desktop\checkup.txt
2013-07-13 09:48 - 2013-07-13 09:49 - 00890988 ____A C:\Users\****\Desktop\SecurityCheck.exe
2013-07-12 22:01 - 2013-07-12 22:01 - 02347384 ____A (ESET) C:\Users\Kai\Downloads\esetsmartinstaller_enu.exe
2013-07-12 22:01 - 2013-07-12 22:01 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-11 22:19 - 2013-07-12 20:41 - 00001193 ____A C:\Users\****\Desktop\JRT.txt
2013-07-11 22:06 - 2013-07-11 22:06 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\****\Desktop\JRT.exe
2013-07-11 22:06 - 2013-07-11 22:06 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 22:02 - 2013-07-11 22:02 - 00006482 ____A C:\Users\****\Desktop\AdwCleaner[S1].txt
2013-07-11 21:40 - 2013-07-11 21:44 - 00006476 ____A C:\AdwCleaner[S1].txt
2013-07-11 21:38 - 2013-07-11 21:39 - 00662345 ____A C:\Users\****\Desktop\adwcleaner.exe
2013-07-11 16:00 - 2013-07-11 16:00 - 00000000 ____D C:\FRST
2013-07-11 14:32 - 2013-07-11 14:32 - 01777775 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-07-11 11:48 - 2013-06-24 04:48 - 00000000 ____D C:\Users\****\Desktop\Tor Browser
2013-07-11 11:46 - 2013-07-11 11:48 - 28110931 ____A (Igor Pavlov) C:\Users\****\Downloads\tor-browser-2.3.25-10_de.exe
2013-07-11 11:42 - 2013-05-29 07:36 - 01346560 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 11:42 - 2013-05-29 07:35 - 01392128 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 11:42 - 2013-05-29 07:34 - 01494528 ____A (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-11 11:42 - 2013-05-29 07:33 - 00237056 ____A (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-11 11:42 - 2013-05-29 07:29 - 00173056 ____A (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-11 11:42 - 2013-05-29 07:25 - 02382848 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 11:42 - 2013-05-29 07:25 - 00096768 ____A (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-11 11:42 - 2013-05-29 07:18 - 00248320 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 11:42 - 2013-05-29 03:41 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-11 11:42 - 2013-05-29 03:41 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 11:42 - 2013-05-29 03:41 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 11:42 - 2013-05-29 03:40 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-11 11:42 - 2013-05-29 03:37 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-11 11:42 - 2013-05-29 03:36 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-11 11:42 - 2013-05-29 03:33 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 11:42 - 2013-05-29 03:33 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-11 11:42 - 2013-05-29 03:29 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 11:41 - 2013-05-29 08:15 - 17829376 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 11:41 - 2013-05-29 07:50 - 10926080 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 11:41 - 2013-05-29 07:43 - 02312704 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 11:41 - 2013-05-29 07:31 - 00085504 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 11:41 - 2013-05-29 07:29 - 00816640 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 11:41 - 2013-05-29 07:29 - 00599040 ____A (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-11 11:41 - 2013-05-29 07:27 - 02147840 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 11:41 - 2013-05-29 07:27 - 00729088 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 11:41 - 2013-05-29 03:56 - 12333568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 11:41 - 2013-05-29 03:50 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 11:41 - 2013-05-29 03:48 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 11:41 - 2013-05-29 03:38 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 11:41 - 2013-05-29 03:35 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 11:41 - 2013-05-29 03:35 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 11:41 - 2013-05-29 03:33 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 11:38 - 2013-07-11 11:38 - 00486139 ____A C:\Users\****\Downloads\https-everywhere324-latest.zip
2013-07-11 11:38 - 2013-07-11 10:19 - 00504251 ____A C:\Users\****\Desktop\https-everywhere-latest.xpi
2013-07-11 11:30 - 2013-07-11 18:35 - 00000000 ____D C:\Users\****\AppData\Roaming\tor
2013-07-11 11:18 - 2013-07-11 18:36 - 00000000 ____D C:\Users\****\AppData\Local\Vidalia
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Users\****\AppData\Local\Tor
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Program Files (x86)\Vidalia Bridge Bundle
2013-07-11 11:16 - 2013-07-11 11:17 - 09636506 ____A C:\Users\****\Downloads\vidalia-bridge-bundle-0.2.3.25-0.2.21.exe
2013-07-10 16:17 - 2013-07-13 09:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-10 15:51 - 2013-06-05 05:34 - 03153920 ____A (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 15:51 - 2013-06-04 08:00 - 00624128 ____A (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 15:51 - 2013-06-04 06:53 - 00509440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 15:51 - 2013-05-06 08:03 - 01887744 ____A (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 15:51 - 2013-05-06 06:56 - 01620480 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 15:50 - 2013-04-10 01:34 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 15:50 - 2013-04-03 00:51 - 01643520 ____A (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-09 18:03 - 2013-07-12 20:50 - 00000616 ____A C:\Windows\setupact.log
2013-07-09 18:03 - 2013-07-09 18:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 12:03 - 2013-07-09 12:05 - 04396440 ____A (Piriform Ltd) C:\Users\Kai\Downloads\ccsetup403.exe
2013-07-08 16:16 - 2013-07-08 16:26 - 00008836 ____A C:\Users\Kai\Desktop\ESTA Auftragsnummer.odt
2013-07-03 20:46 - 2013-07-11 13:04 - 00000000 ____D C:\Program Files (x86)\HitmanPro.Alert
2013-07-03 20:46 - 2013-07-11 11:24 - 00540104 ____A (SurfRight) C:\Windows\SysWOW64\hmpalert.dll
2013-07-03 20:46 - 2013-07-11 11:24 - 00494784 ____A (SurfRight) C:\Windows\system32\hmpalert.dll
2013-07-03 20:46 - 2013-07-11 11:24 - 00017416 ____A C:\Windows\system32\Drivers\hmpalert.sys
2013-07-03 20:46 - 2013-07-03 20:46 - 00000000 ____D C:\ProgramData\HitmanPro.Alert
2013-07-03 20:45 - 2013-07-03 20:45 - 01751952 ____A (SurfRight B.V.) C:\Users\****\Downloads\hmpalert.exe
2013-07-03 20:40 - 2013-07-03 20:40 - 00002019 ____A C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-07-03 20:39 - 2013-07-03 20:39 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-03 20:32 - 2013-07-03 20:32 - 07872648 ____A (Adobe Systems Inc.) C:\Users\****\Downloads\Shockwave_Installer_Slim.exe
2013-07-03 17:42 - 2013-07-03 18:03 - 00000000 ____D C:\Users\****\Skrupelloser Scheiß
2013-06-28 14:30 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-26 22:22 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-26 22:22 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-06-26 20:50 - 2013-06-26 20:51 - 08340864 ____A (PortableApps.com) C:\Users\****\Downloads\ClamWinPortable_0.97.8_English.paf.exe
2013-06-26 20:23 - 2013-06-26 20:23 - 00903080 ____A (Oracle Corporation) C:\Users\Kai\Downloads\jxpiinstall.exe
2013-06-26 20:21 - 2013-06-26 20:21 - 00000000 ____D C:\Users\****\AppData\Roaming\Oracle
2013-06-24 12:28 - 2013-06-24 12:28 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-24 00:47 - 2013-06-24 00:47 - 00002768 ____A C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-06-24 00:46 - 2013-06-24 00:46 - 04378864 ____A (Piriform Ltd) C:\Users\****\Downloads\ccsetup402.exe
2013-06-20 17:48 - 2013-06-20 17:48 - 00376576 ____A C:\Users\****\Downloads\wot_safe_surfing-20130515-fx.zip
2013-06-13 21:48 - 2013-06-13 21:48 - 00001105 ____A C:\Users\****\Desktop\KeePass 2.lnk
2013-06-13 21:48 - 2013-06-13 21:48 - 00000000 ____D C:\Program Files (x86)\KeePass Password Safe 2
2013-06-13 21:47 - 2013-06-13 21:48 - 02475400 ____A (Dominik Reichl ) C:\Users\****\Downloads\KeePass-2.22-Setup(1).exe
2013-06-13 21:45 - 2013-06-13 21:46 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22(1).zip
2013-06-13 21:22 - 2013-06-13 21:25 - 58084984 ____A (PortableApps.com) C:\Users\****\Downloads\PortableApps.com_Suite_Light_Setup_1.6.1_German.exe
2013-06-13 20:05 - 2013-06-13 20:06 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22.zip
==================== One Month Modified Files and Folders ======
2013-07-13 10:19 - 2013-07-13 10:19 - 00000922 ____A C:\Users\****\Desktop\checkup.txt
2013-07-13 10:16 - 2012-06-09 12:37 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-13 09:58 - 2013-07-10 16:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-13 09:49 - 2013-07-13 09:48 - 00890988 ____A C:\Users\****\Desktop\SecurityCheck.exe
2013-07-13 09:35 - 2012-03-11 05:12 - 01659621 ____A C:\Windows\WindowsUpdate.log
2013-07-13 09:30 - 2012-09-03 20:03 - 00001112 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001UA.job
2013-07-13 09:16 - 2012-06-09 12:37 - 00001100 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-13 02:37 - 2013-06-11 23:19 - 00000000 ____D C:\Users\****\AppData\Roaming\KeePass
2013-07-13 02:36 - 2012-03-18 20:38 - 00000000 ____D C:\Users\****\AppData\Roaming\Spotify
2013-07-13 01:30 - 2012-09-03 20:03 - 00001060 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001Core.job
2013-07-13 01:25 - 2012-09-03 20:03 - 00004078 ____A C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001UA
2013-07-13 01:25 - 2012-09-03 20:03 - 00003682 ____A C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-294328175-2285325353-1936744399-1001Core
2013-07-12 23:34 - 2011-11-05 18:52 - 00000000 ____D C:\Users\****\Documents\Youcam
2013-07-12 22:01 - 2013-07-12 22:01 - 02347384 ____A (ESET) C:\Users\****\Downloads\esetsmartinstaller_enu.exe
2013-07-12 22:01 - 2013-07-12 22:01 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-12 20:50 - 2013-07-09 18:03 - 00000616 ____A C:\Windows\setupact.log
2013-07-12 20:41 - 2013-07-11 22:19 - 00001193 ____A C:\Users\****\Desktop\JRT.txt
2013-07-12 20:18 - 2011-11-05 18:51 - 00003914 ____A C:\Windows\System32\Tasks\User_Feed_Synchronization-{845D5F33-BF75-41E9-A20A-4D3E0EDECEC8}
2013-07-12 20:16 - 2009-07-14 06:45 - 00031856 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-12 20:16 - 2009-07-14 06:45 - 00031856 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-12 20:10 - 2012-07-10 13:14 - 00004196 ____A C:\Windows\System32\Tasks\avast! Emergency Update
2013-07-12 20:08 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 22:06 - 2013-07-11 22:06 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\****\Desktop\JRT.exe
2013-07-11 22:06 - 2013-07-11 22:06 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 22:02 - 2013-07-11 22:02 - 00006482 ____A C:\Users\****\Desktop\AdwCleaner[S1].txt
2013-07-11 21:44 - 2013-07-11 21:40 - 00006476 ____A C:\AdwCleaner[S1].txt
2013-07-11 21:39 - 2013-07-11 21:38 - 00662345 ____A C:\Users\****\Desktop\adwcleaner.exe
2013-07-11 18:36 - 2013-07-11 11:18 - 00000000 ____D C:\Users\****\AppData\Local\Vidalia
2013-07-11 18:35 - 2013-07-11 11:30 - 00000000 ____D C:\Users\****\AppData\Roaming\tor
2013-07-11 16:00 - 2013-07-11 16:00 - 00000000 ____D C:\FRST
2013-07-11 14:32 - 2013-07-11 14:32 - 01777775 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-07-11 13:05 - 2009-07-14 06:45 - 00302296 ____A C:\Windows\system32\FNTCACHE.DAT
2013-07-11 13:04 - 2013-07-03 20:46 - 00000000 ____D C:\Program Files (x86)\HitmanPro.Alert
2013-07-11 13:04 - 2013-05-17 15:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-11 13:04 - 2012-05-18 22:57 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 13:04 - 2012-05-18 22:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-11 13:03 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 13:03 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 12:11 - 2013-06-11 23:36 - 00004702 ____A C:\Users\****\Desktop\Datenbank.kdbx
2013-07-11 11:53 - 2011-07-16 07:32 - 00664868 ____A C:\Windows\system32\perfh007.dat
2013-07-11 11:53 - 2011-07-16 07:32 - 00135004 ____A C:\Windows\system32\perfc007.dat
2013-07-11 11:53 - 2009-07-14 07:13 - 01549542 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 11:48 - 2013-07-11 11:46 - 28110931 ____A (Igor Pavlov) C:\Users\****\Downloads\tor-browser-2.3.25-10_de.exe
2013-07-11 11:43 - 2012-02-07 18:56 - 78185248 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 11:38 - 2013-07-11 11:38 - 00486139 ____A C:\Users\****\Downloads\https-everywhere324-latest.zip
2013-07-11 11:24 - 2013-07-03 20:46 - 00540104 ____A (SurfRight) C:\Windows\SysWOW64\hmpalert.dll
2013-07-11 11:24 - 2013-07-03 20:46 - 00494784 ____A (SurfRight) C:\Windows\system32\hmpalert.dll
2013-07-11 11:24 - 2013-07-03 20:46 - 00017416 ____A C:\Windows\system32\Drivers\hmpalert.sys
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Users\****\AppData\Local\Tor
2013-07-11 11:18 - 2013-07-11 11:18 - 00000000 ____D C:\Program Files (x86)\Vidalia Bridge Bundle
2013-07-11 11:17 - 2013-07-11 11:16 - 09636506 ____A C:\Users\****\Downloads\vidalia-bridge-bundle-0.2.3.25-0.2.21.exe
2013-07-11 10:19 - 2013-07-11 11:38 - 00504251 ____A C:\Users\****\Desktop\https-everywhere-latest.xpi
2013-07-09 18:03 - 2013-07-09 18:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 18:03 - 2012-03-18 20:42 - 00000000 ____D C:\Users\****\AppData\Local\Spotify
2013-07-09 12:06 - 2012-03-06 08:59 - 00000822 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 12:06 - 2012-03-06 08:59 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 12:05 - 2013-07-09 12:03 - 04396440 ____A (Piriform Ltd) C:\Users\****\Downloads\ccsetup403.exe
2013-07-08 22:26 - 2012-06-18 08:23 - 00007600 ____A C:\Users\****\AppData\Local\Resmon.ResmonCfg
2013-07-08 16:26 - 2013-07-08 16:16 - 00008836 ____A C:\Users\****\Desktop\ESTA Auftragsnummer.odt
2013-07-08 15:24 - 2012-01-09 18:15 - 00000000 ____A C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-07-04 23:12 - 2012-01-06 16:24 - 00000000 ____D C:\Program Files (x86)\avast! Free Antivirus
2013-07-03 20:46 - 2013-07-03 20:46 - 00000000 ____D C:\ProgramData\HitmanPro.Alert
2013-07-03 20:45 - 2013-07-03 20:45 - 01751952 ____A (SurfRight B.V.) C:\Users\****\Downloads\hmpalert.exe
2013-07-03 20:40 - 2013-07-03 20:40 - 00002019 ____A C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-07-03 20:40 - 2011-11-06 14:35 - 00000000 ____D C:\Users\****\AppData\Local\Adobe
2013-07-03 20:39 - 2013-07-03 20:39 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-03 20:39 - 2011-07-15 22:16 - 00000000 ____D C:\ProgramData\Adobe
2013-07-03 20:33 - 2011-07-15 22:10 - 00000000 ____D C:\Windows\SysWOW64\Adobe
2013-07-03 20:32 - 2013-07-03 20:32 - 07872648 ____A (Adobe Systems Inc.) C:\Users\****\Downloads\Shockwave_Installer_Slim.exe
2013-07-03 18:24 - 2013-04-02 18:39 - 00000000 ____D C:\Users\****\AppData\Local\HP
2013-07-03 18:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-03 18:03 - 2013-07-03 17:42 - 00000000 ____D C:\Users\****\Skrupelloser Scheiß
2013-07-03 17:42 - 2011-11-05 18:46 - 00000000 ____D C:\Users\****
2013-07-02 16:01 - 2012-02-06 18:19 - 00000324 ____A C:\Windows\Tasks\HPCeeScheduleFor****.job
2013-07-01 20:14 - 2012-02-06 18:19 - 00003174 ____A C:\Windows\System32\Tasks\HPCeeScheduleFor****
2013-07-01 20:14 - 2012-01-02 12:21 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log
2013-06-29 01:08 - 2009-07-14 07:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-28 14:30 - 2013-06-28 14:30 - 00000175 ____A C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-06-28 14:30 - 2013-06-26 22:22 - 00000175 ____A C:\Windows\system32\Drivers\aswSP.sys.sum
2013-06-28 14:30 - 2013-06-26 22:22 - 00000175 ____A C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-06-28 14:30 - 2013-06-11 22:22 - 00189936 ____A C:\Windows\system32\Drivers\aswVmm.sys
2013-06-28 14:30 - 2012-01-06 16:24 - 01030952 ____A (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-06-28 14:30 - 2012-01-06 16:24 - 00378944 ____A (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-06-26 20:51 - 2013-06-26 20:50 - 08340864 ____A (PortableApps.com) C:\Users\****\Downloads\ClamWinPortable_0.97.8_English.paf.exe
2013-06-26 20:23 - 2013-06-26 20:23 - 00903080 ____A (Oracle Corporation) C:\Users\****\Downloads\jxpiinstall.exe
2013-06-26 20:22 - 2012-01-03 02:10 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-26 20:21 - 2013-06-26 20:21 - 00000000 ____D C:\Users\****\AppData\Roaming\Oracle
2013-06-24 12:28 - 2013-06-24 12:28 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-24 12:28 - 2012-11-04 22:52 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-24 12:28 - 2012-11-04 22:52 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-24 12:28 - 2012-11-04 22:52 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-24 12:28 - 2012-09-08 09:31 - 00867240 ____A (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-06-24 12:28 - 2012-01-03 02:10 - 00789416 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-06-24 12:14 - 2011-11-05 18:50 - 00068104 ____A C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-24 04:48 - 2013-07-11 11:48 - 00000000 ____D C:\Users\****\Desktop\Tor Browser
2013-06-24 02:49 - 2012-08-11 22:31 - 00000000 ____D C:\Users\****\Desktop\Registry Saves
2013-06-24 02:47 - 2011-07-15 22:20 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-24 02:46 - 2013-03-26 20:01 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2013-06-24 00:57 - 2012-01-06 16:19 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-06-24 00:51 - 2012-05-05 03:15 - 00000000 ____D C:\Users\****\AppData\Local\CrashDumps
2013-06-24 00:47 - 2013-06-24 00:47 - 00002768 ____A C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-06-24 00:46 - 2013-06-24 00:46 - 04378864 ____A (Piriform Ltd) C:\Users\****\Downloads\ccsetup402.exe
2013-06-23 19:18 - 2012-02-17 19:35 - 00000000 ____D C:\Program Files (x86)\StarCraft II
2013-06-20 17:48 - 2013-06-20 17:48 - 00376576 ____A C:\Users\****\Downloads\wot_safe_surfing-20130515-fx.zip
2013-06-18 16:36 - 2012-08-17 16:42 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-18 16:36 - 2011-07-15 22:03 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-13 21:48 - 2013-06-13 21:48 - 00001105 ____A C:\Users\****\Desktop\KeePass 2.lnk
2013-06-13 21:48 - 2013-06-13 21:48 - 00000000 ____D C:\Program Files (x86)\KeePass Password Safe 2
2013-06-13 21:48 - 2013-06-13 21:47 - 02475400 ____A (Dominik Reichl ) C:\Users\****\Downloads\KeePass-2.22-Setup(1).exe
2013-06-13 21:46 - 2013-06-13 21:45 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22(1).zip
2013-06-13 21:25 - 2013-06-13 21:22 - 58084984 ____A (PortableApps.com) C:\Users\****\Downloads\PortableApps.com_Suite_Light_Setup_1.6.1_German.exe
2013-06-13 20:06 - 2013-06-13 20:05 - 02256199 ____A C:\Users\****\Downloads\KeePass-2.22.zip
2013-06-13 19:51 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-13 04:03
==================== End Of Log ============================
--- --- --- |
|
13.07.2013, 10:28
| #14 |
| /// the machine /// TB-Ausbilder | Zusätzliche Firewall sinnvoll? Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.07.2013, 10:48
| #15 |
| | Zusätzliche Firewall sinnvoll? Vielen Dank! Also kann ich davon ausgehen, dass die gefundenen Würmer verschwunden sind und mein System ansonsten auch sauber ist? |
|
| Themen zu Zusätzliche Firewall sinnvoll? |
| benutzer, firewall, hallo zusammen, immer wieder, installiere, installieren, möglicherweise, nötig, sinnvoll, unnötig, verwenden, voll, windows-firewall, zusammen, zusätzliche |
Zusätzliche Firewall sinnvoll?
Linear-Darstellung
