Windows 7 Internet Explorer Standart Seite wird auf QV06 umgeleitet

Atrom · 03.08.2013, 13:22

Hallo zusammen.

Seit meinem letzten Download war im Internet Explorer plötzlich QV06 als Hauptseite eingestellt. Ich habe alle Addons gelöscht und Google als Hauptseite eingespeichert, aber es ist immer noch alles voll mit Werbung und der IE ist auch sehr langsam. Ich habe mich bereits auf eigene Faust im Internet schlau gemacht und den adscleaner und DDS installiert aber bin damit auch nicht sehr viel weiter gekommen. Die logs dazu sind auch unten dabei. Ich hoffe ihr könnt mir dabei weiter helfen.
Liebe Grüße Atrom

defogger:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:08 on 03/08/2013 (Mark)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013
Ran by Mark (administrator) on 03-08-2013 12:11:55
Running from C:\Users\Mark\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Wsys Co., Ltd.) C:\ProgramData\eSafe\eGdpSvc.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Micro-Star Int'l Co., Ltd.) c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(PC-Doctor, Inc.) C:\Program Files\AlienAutopsy\uaclauncher.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6412904 2011-11-03] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1157224 2011-10-20] (Realtek Semiconductor)
HKLM\...\Run: [] -  [x]
HKLM\...\Run: [Command Center Controllers] - C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12616 2011-12-15] (Alienware)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1807272 2013-07-27] (Valve Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKLM-x32\...\Run: [Dell Registration] - C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [241984 2011-10-20] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [203072 2011-10-20] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?gws_rd=cr
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: LyricXeeker - {17E58097-6CA5-448B-830F-2A19678248FB} - C:\Program Files (x86)\LyriXeeker\125.dll (LyriXeeker Tech)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: DealPly Shopping - {9cf699ca-2174-4ed8-bec1-ba82095edce0} - C:\Program Files (x86)\DealPly\DealPlyIE.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (DealPly  Shopping) - C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi\3.5.0.0_0
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [odnofacmifkjndflfmmplhckcbfjckhj] - C:\Program Files (x86)\LyriXeeker\125.crx

==================== Services (Whitelisted) =================

R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
R2 MSI_ODD_Service; c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe [76800 2011-10-05] (Micro-Star Int'l Co., Ltd.)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [891456 2013-08-02] (Wsys Co., Ltd.)
S2 dealplylive; C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe /svc [x]
S3 dealplylivem; C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe /medsvc [x]

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-09-04] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-09-04] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-02-11] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20130801.001\IDSvia64.sys [513184 2012-09-06] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20130801.001\IDSvia64.sys [513184 2012-09-06] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130801.034\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130801.034\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130801.034\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130801.034\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 NTIOLib_X64; C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [14136 2010-01-18] (MSI)
R3 NTIOLib_X64; C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [14136 2010-01-18] (MSI)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [100352 2011-09-15] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [216064 2011-09-15] (Renesas Electronics Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-03 12:10 - 2013-08-03 12:10 - 01781485 _____ (Farbar) C:\Users\Mark\Downloads\FRST64.exe
2013-08-03 12:08 - 2013-08-03 12:08 - 00000470 _____ C:\Users\Mark\Downloads\defogger_disable.log
2013-08-03 12:08 - 2013-08-03 12:08 - 00000000 _____ C:\Users\Mark\defogger_reenable
2013-08-03 12:06 - 2013-08-03 12:06 - 00050477 _____ C:\Users\Mark\Downloads\Defogger.exe
2013-08-02 21:07 - 2013-08-02 21:07 - 00000854 _____ C:\AdwCleaner[S2].txt
2013-08-02 21:04 - 2013-08-02 21:10 - 00014519 _____ C:\Users\Mark\Desktop\dds.txt
2013-08-02 21:04 - 2013-08-02 21:10 - 00004667 _____ C:\Users\Mark\Desktop\attach.txt
2013-08-02 21:02 - 2013-08-02 21:02 - 00700783 ____R (Swearware) C:\Users\Mark\Downloads\dds+.exe
2013-08-02 21:01 - 2013-08-02 21:01 - 00655200 _____ C:\Users\Mark\Downloads\setup.exe
2013-08-02 20:56 - 2013-08-02 20:56 - 00010347 _____ C:\AdwCleaner[S1].txt
2013-08-02 20:55 - 2013-08-02 20:55 - 00666633 _____ C:\Users\Mark\Downloads\adwcleaner06.exe
2013-08-02 18:18 - 2013-08-03 12:00 - 00000000 ____D C:\ProgramData\eSafe
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\ServerJarStorage
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\MCEdit-schematics
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\MCEdit-0.1.6.win32
2013-08-02 18:17 - 2013-08-03 11:59 - 00000898 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2013-08-02 18:17 - 2013-08-02 21:22 - 00000902 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-08-02 18:17 - 2013-08-02 18:17 - 00003898 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA
2013-08-02 18:17 - 2013-08-02 18:17 - 00003646 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
2013-08-02 18:17 - 2013-08-02 18:17 - 00003364 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-08-02 18:16 - 2013-08-03 12:00 - 00000386 _____ C:\Windows\Tasks\LyricXeeker Update.job
2013-08-02 18:16 - 2013-08-02 18:17 - 00000000 ____D C:\Program Files (x86)\LyriXeeker
2013-08-02 18:16 - 2013-08-02 18:16 - 00003032 _____ C:\Windows\System32\Tasks\LyricXeeker Update
2013-08-02 18:16 - 2013-08-02 18:16 - 00000000 ____D C:\Users\Mark\AppData\Local\Google
2013-07-29 21:01 - 2013-07-29 21:01 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Trine2
2013-07-29 20:59 - 2013-07-29 20:59 - 00000222 _____ C:\Users\Mark\Desktop\F1 2012.url
2013-07-29 20:49 - 2013-06-24 00:41 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-24 17:27 - 2013-07-24 17:27 - 00000221 _____ C:\Users\Mark\Desktop\Trine 2.url
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\Users\Mark\Documents\My Games
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\ProgramData\Codemasters
2013-07-24 07:02 - 2013-07-24 07:02 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero Deleted Scenes.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000222 _____ C:\Users\Mark\Desktop\Assassin's Creed Revelations.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Global Offensive.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Saints Row The Third.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2 - Multiplayer.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Assassin's Creed II.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Source.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero.url
2013-07-24 06:58 - 2013-07-24 06:58 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike.url
2013-07-22 17:59 - 2013-07-22 17:59 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2.url
2013-07-20 12:18 - 2013-07-20 12:18 - 01001338 _____ C:\Users\Mark\Desktop\SinglePlayerCommands-MC1.6.2_V5.0.zip
2013-07-17 18:55 - 2013-07-17 18:55 - 00000219 _____ C:\Users\Mark\Desktop\Team Fortress 2.url
2013-07-17 18:50 - 2013-07-17 18:50 - 00003120 _____ C:\Windows\System32\Tasks\{E81BC9DE-98DE-4E22-AB31-6DA0D5E69038}
2013-07-12 15:06 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 15:06 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 15:06 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-12 15:05 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 15:05 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 15:05 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 15:05 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 15:05 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 15:05 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 15:05 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 21:33 - 2013-07-11 21:33 - 00000000 ____D C:\4c53c8961b0478fb9962882ff0
2013-07-11 16:27 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 16:27 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 16:27 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 16:27 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 16:27 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 16:26 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 16:26 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 18:45 - 2013-07-10 18:45 - 13292297 _____ C:\Users\Mark\Desktop\ravands-converted-1373474728787.zip
2013-07-10 18:42 - 2013-07-10 18:43 - 52460484 _____ C:\Users\Mark\Desktop\ravands.zip
2013-07-10 15:18 - 2013-07-10 15:18 - 00065935 _____ C:\Users\Mark\Desktop\X-ray.rar
2013-07-10 15:17 - 2013-07-10 15:17 - 00066494 _____ C:\Users\Mark\Downloads\X-RayMod_v042.zip
2013-07-07 14:21 - 2013-07-07 14:21 - 53942177 _____ C:\Users\Mark\Desktop\Misa500-converted-1373199671883.zip
2013-07-07 14:15 - 2013-07-07 14:15 - 02570679 _____ C:\Users\Mark\Desktop\TextureEnder.jar
2013-07-07 14:09 - 2013-07-07 14:10 - 53886249 _____ C:\Users\Mark\Desktop\Misa500.zip
2013-07-07 14:06 - 2013-07-07 14:06 - 08625354 _____ C:\Users\Mark\Desktop\willpack3.zip
2013-07-07 13:57 - 2013-07-07 13:57 - 09628376 _____ C:\Users\Mark\Desktop\Romecraft GERMANIA 14.zip
2013-07-07 12:02 - 2013-07-07 12:02 - 00484992 _____ C:\Users\Mark\Desktop\Minecraft (1).exe
2013-07-04 20:51 - 2013-07-04 20:51 - 00000219 _____ C:\Users\Mark\Desktop\Dota 2.url
2013-07-04 19:03 - 2013-07-04 19:31 - 00000000 ____D C:\Users\Mark\Desktop\Neuer Ordner
2013-07-04 18:37 - 2013-07-04 18:37 - 00000000 ____D C:\Users\Mark\Documents\default
106

==================== One Month Modified Files and Folders =======

2013-08-03 12:11 - 2013-08-03 12:11 - 00000000 ____D C:\FRST
2013-08-03 12:10 - 2013-08-03 12:10 - 01781485 _____ (Farbar) C:\Users\Mark\Downloads\FRST64.exe
2013-08-03 12:08 - 2013-08-03 12:08 - 00000470 _____ C:\Users\Mark\Downloads\defogger_disable.log
2013-08-03 12:08 - 2013-08-03 12:08 - 00000000 _____ C:\Users\Mark\defogger_reenable
2013-08-03 12:08 - 2012-08-11 12:57 - 00000000 ____D C:\Users\Mark
2013-08-03 12:06 - 2013-08-03 12:06 - 00050477 _____ C:\Users\Mark\Downloads\Defogger.exe
2013-08-03 12:04 - 2013-02-28 18:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-03 12:04 - 2010-11-21 08:50 - 03329076 _____ C:\Windows\system32\perfh007.dat
2013-08-03 12:04 - 2010-11-21 08:50 - 00965800 _____ C:\Windows\system32\perfc007.dat
2013-08-03 12:04 - 2009-07-14 07:13 - 00006248 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-03 12:04 - 2009-07-14 06:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-03 12:04 - 2009-07-14 06:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-03 12:00 - 2013-08-02 18:18 - 00000000 ____D C:\ProgramData\eSafe
2013-08-03 12:00 - 2013-08-02 18:16 - 00000386 _____ C:\Windows\Tasks\LyricXeeker Update.job
2013-08-03 12:00 - 2012-09-07 15:45 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-03 12:00 - 2012-01-23 22:25 - 01661826 _____ C:\Windows\WindowsUpdate.log
2013-08-03 11:59 - 2013-08-02 18:17 - 00000898 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2013-08-03 11:59 - 2012-08-13 20:59 - 00000000 ____D C:\Users\Mark\AppData\Local\LogMeIn Hamachi
2013-08-03 11:55 - 2012-01-23 22:22 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-03 11:55 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-03 11:55 - 2009-07-14 06:51 - 00075596 _____ C:\Windows\setupact.log
2013-08-02 21:22 - 2013-08-02 18:17 - 00000902 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-08-02 21:10 - 2013-08-02 21:04 - 00014519 _____ C:\Users\Mark\Desktop\dds.txt
2013-08-02 21:10 - 2013-08-02 21:04 - 00004667 _____ C:\Users\Mark\Desktop\attach.txt
2013-08-02 21:07 - 2013-08-02 21:07 - 00000854 _____ C:\AdwCleaner[S2].txt
2013-08-02 21:02 - 2013-08-02 21:02 - 00700783 ____R (Swearware) C:\Users\Mark\Downloads\dds+.exe
2013-08-02 21:01 - 2013-08-02 21:01 - 00655200 _____ C:\Users\Mark\Downloads\setup.exe
2013-08-02 20:59 - 2012-08-11 13:40 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Skype
2013-08-02 20:56 - 2013-08-02 20:56 - 00010347 _____ C:\AdwCleaner[S1].txt
2013-08-02 20:56 - 2013-06-06 16:18 - 00000995 _____ C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-02 20:55 - 2013-08-02 20:55 - 00666633 _____ C:\Users\Mark\Downloads\adwcleaner06.exe
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\ServerJarStorage
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\MCEdit-schematics
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\MCEdit-0.1.6.win32
2013-08-02 18:17 - 2013-08-02 18:17 - 00003898 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA
2013-08-02 18:17 - 2013-08-02 18:17 - 00003646 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
2013-08-02 18:17 - 2013-08-02 18:17 - 00003364 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-08-02 18:17 - 2013-08-02 18:16 - 00000000 ____D C:\Program Files (x86)\LyriXeeker
2013-08-02 18:16 - 2013-08-02 18:16 - 00003032 _____ C:\Windows\System32\Tasks\LyricXeeker Update
2013-08-02 18:16 - 2013-08-02 18:16 - 00000000 ____D C:\Users\Mark\AppData\Local\Google
2013-08-02 18:15 - 2013-02-18 15:09 - 00000000 ____D C:\Users\Mark\AppData\Roaming\.minecraft
2013-08-02 12:02 - 2013-05-22 13:59 - 00003460 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-07-29 21:01 - 2013-07-29 21:01 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Trine2
2013-07-29 21:01 - 2012-09-06 17:11 - 00257772 _____ C:\Windows\DirectX.log
2013-07-29 20:59 - 2013-07-29 20:59 - 00000222 _____ C:\Users\Mark\Desktop\F1 2012.url
2013-07-29 20:59 - 2012-09-07 16:11 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-07-25 13:04 - 2013-01-28 10:04 - 00000000 ____D C:\Program Files\AlienAutopsy
2013-07-25 13:04 - 2012-09-10 17:00 - 00000000 ____D C:\ProgramData\PCDr
2013-07-25 12:40 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-24 17:27 - 2013-07-24 17:27 - 00000221 _____ C:\Users\Mark\Desktop\Trine 2.url
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\Users\Mark\Documents\My Games
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\ProgramData\Codemasters
2013-07-24 07:02 - 2013-07-24 07:02 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero Deleted Scenes.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000222 _____ C:\Users\Mark\Desktop\Assassin's Creed Revelations.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Global Offensive.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Saints Row The Third.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2 - Multiplayer.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Assassin's Creed II.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Source.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero.url
2013-07-24 06:58 - 2013-07-24 06:58 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike.url
2013-07-22 17:59 - 2013-07-22 17:59 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2.url
2013-07-20 12:18 - 2013-07-20 12:18 - 01001338 _____ C:\Users\Mark\Desktop\SinglePlayerCommands-MC1.6.2_V5.0.zip
2013-07-20 11:57 - 2012-12-27 12:05 - 00000000 ____D C:\Users\Mark\AppData\Roaming\TS3Client
2013-07-17 18:55 - 2013-07-17 18:55 - 00000219 _____ C:\Users\Mark\Desktop\Team Fortress 2.url
2013-07-17 18:50 - 2013-07-17 18:50 - 00003120 _____ C:\Windows\System32\Tasks\{E81BC9DE-98DE-4E22-AB31-6DA0D5E69038}
2013-07-15 16:32 - 2010-11-21 05:47 - 00041190 _____ C:\Windows\PFRO.log
2013-07-12 19:29 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 19:29 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-12 14:59 - 2010-11-21 09:00 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 14:59 - 2009-07-14 06:45 - 00278856 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 21:33 - 2013-07-11 21:33 - 00000000 ____D C:\4c53c8961b0478fb9962882ff0
2013-07-10 18:45 - 2013-07-10 18:45 - 13292297 _____ C:\Users\Mark\Desktop\ravands-converted-1373474728787.zip
2013-07-10 18:43 - 2013-07-10 18:42 - 52460484 _____ C:\Users\Mark\Desktop\ravands.zip
2013-07-10 15:18 - 2013-07-10 15:18 - 00065935 _____ C:\Users\Mark\Desktop\X-ray.rar
2013-07-10 15:17 - 2013-07-10 15:17 - 00066494 _____ C:\Users\Mark\Downloads\X-RayMod_v042.zip
2013-07-07 14:21 - 2013-07-07 14:21 - 53942177 _____ C:\Users\Mark\Desktop\Misa500-converted-1373199671883.zip
2013-07-07 14:15 - 2013-07-07 14:15 - 02570679 _____ C:\Users\Mark\Desktop\TextureEnder.jar
2013-07-07 14:10 - 2013-07-07 14:09 - 53886249 _____ C:\Users\Mark\Desktop\Misa500.zip
2013-07-07 14:06 - 2013-07-07 14:06 - 08625354 _____ C:\Users\Mark\Desktop\willpack3.zip
2013-07-07 13:57 - 2013-07-07 13:57 - 09628376 _____ C:\Users\Mark\Desktop\Romecraft GERMANIA 14.zip
2013-07-07 12:02 - 2013-07-07 12:02 - 00484992 _____ C:\Users\Mark\Desktop\Minecraft (1).exe
2013-07-05 14:34 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-07-04 20:51 - 2013-07-04 20:51 - 00000219 _____ C:\Users\Mark\Desktop\Dota 2.url
2013-07-04 19:31 - 2013-07-04 19:03 - 00000000 ____D C:\Users\Mark\Desktop\Neuer Ordner
2013-07-04 19:30 - 2012-10-13 15:59 - 00000000 ____D C:\Users\Mark\Desktop\New Worlde
2013-07-04 18:37 - 2013-07-04 18:37 - 00000000 ____D C:\Users\Mark\Documents\default

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-02 19:00

==================== End Of Log ============================

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-08-2013
Ran by Mark at 2013-08-03 12:12:31
Running from C:\Users\Mark\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
Adobe AIR (x32 Version: 3.3.0.3670)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Reader X MUI (x32 Version: 10.0.0)
AlienAutopsy (Version: 3.3.6280.92)
Alienware Command Center (Version: 2.7.24.0)
Alienware Command Center (x32 Version: 2.7.24.0)
Alienware Product Registration (x32 Version: 1.1.3)
Ashampoo Burning Studio 2013 v.11.0.6 (x32 Version: 11.0.6)
Assassin's Creed II (x32)
Assassin's Creed Revelations (x32)
Burnout(TM) Paradise The Ultimate Box (x32 Version: 1.0.0.0)
Call of Duty: Modern Warfare 2 - Multiplayer (x32)
Call of Duty: Modern Warfare 2 (x32)
Counter-Strike (x32)
Counter-Strike: Condition Zero (x32)
Counter-Strike: Condition Zero Deleted Scenes (x32)
Counter-Strike: Global Offensive (x32)
Counter-Strike: Source (x32)
devolo dLAN Cockpit (x32 Version: 3.0.0.0)
Die Siedler II - Die nächste Generation (x32)
dLAN Cockpit (x32 Version: 3 (23.12.2010))
dLAN Cockpit (x32 Version: 3.23.12)
Dota 2 (x32)
F1 2012 (x32)
Fallen Earth (x32)
Google Update Helper (x32 Version: 1.3.23.0)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2462)
Java Auto Updater (x32 Version: 2.1.5.1)
Java(TM) 7 Update 1 (64-bit) (Version: 7.0.10)
Java(TM) 7 Update 1 (x32 Version: 7.0.10)
LogMeIn Hamachi (x32 Version: 2.1.0.374)
LyricXeeker (x32)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
MSI ODD Monitor (x32 Version: 1.0.0.5)
Norton Internet Security (x32 Version: 20.4.0.40)
Notepad++ (x32 Version: 6.2.3)
NVIDIA 3D Vision Treiber 285.66 (Version: 285.66)
NVIDIA Grafiktreiber 285.66 (Version: 285.66)
NVIDIA HD-Audiotreiber 1.2.24.0 (Version: 1.2.24.0)
NVIDIA Install Application (Version: 2.1002.46.235)
NVIDIA Optimus 1.5.20 (Version: 1.5.20)
NVIDIA PhysX (x32 Version: 9.11.0621)
NVIDIA PhysX-Systemsoftware 9.11.0621 (Version: 9.11.0621)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.8566)
NVIDIA Systemsteuerung 285.66 (Version: 285.66)
NVIDIA Update Components (Version: 1.5.20)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6494)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Saints Row: The Third (x32)
Skype™ 6.3 (x32 Version: 6.3.107)
Steam (x32 Version: 1.0.0.0)
Team Fortress 2 (x32)
TeamSpeak 3 Client (x32 Version: 3.0.10)
Trine 2 (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0)
World of Tanks - Common Test (x32)
World of Tanks (x32)
World of Warplanes (x32)
Worms Reloaded (x32)
Worms Revolution (x32)
Wsys Control 1.0.0.2598 (x32 Version: 1.0.0.2598)

==================== Restore Points  =========================

31-07-2013 16:22:52 Geplanter Prüfpunkt
31-07-2013 17:36:56 DirectX wurde installiert

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {00EF4951-846C-4BAA-9398-D27419A4EBBE} - System32\Tasks\{3B9F6EE3-E25B-4C87-B960-9F01F39700D0} => C:\Program Files (x86)\Kalypso\Imperium Romanum\Imperium Romanum.exe No File
Task: {086D10AC-19DF-45F7-A89D-9F99850788F8} - System32\Tasks\{DAD20D5E-A892-489B-A5B7-B83851C287AC} => C:\Program Files\Internet Explorer\iexplore.exe [2013-06-12] (Microsoft Corporation)
Task: {1C0A428F-1EC7-4E4C-BBE3-1F575E039245} - System32\Tasks\{5F3581CE-77AD-4D7D-AE3D-4E1542AA62F7} => C:\Program Files (x86)\Kalypso\Imperium Romanum\Imperium Romanum.exe No File
Task: {30B42719-BEBB-4429-BE0C-9FE321AFB78E} - System32\Tasks\{3200920A-54D8-4143-9A2D-531CB4F645F3} => C:\Program Files (x86)\Kalypso\Imperium Romanum\Imperium Romanum.exe No File
Task: {40A7469B-D3C7-4E7B-9624-8AEF5A369340} - System32\Tasks\DealPlyUpdate => C:\Program No File
Task: {54BF3442-FB0A-4A84-BBCA-4A5A700A4F8C} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\AlienAutopsy\uaclauncher.exe [2013-05-07] (PC-Doctor, Inc.)
Task: {5AB69C48-81D7-4916-BBEF-3809ABDBD412} - System32\Tasks\DealPlyLiveUpdateTaskMachineCore => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe No File
Task: {76FC7E37-4E7D-4009-BF43-07C20D3163EB} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\AlienAutopsy\sessionchecker.exe [2013-07-18] (PC-Doctor, Inc.)
Task: {7B97DBAA-7AFB-4A4B-B1B9-DDBFCE72189A} - System32\Tasks\DealPlyLiveUpdateTaskMachineUA => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe No File
Task: {86D8F676-201A-488C-8128-97F71ADECA42} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {931FA6B9-E821-429B-AEA4-D970EF6E50D3} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe [2013-06-04] (Symantec Corporation)
Task: {972AD7F1-F45C-4180-8B5B-1CA9CD56D03B} - System32\Tasks\{F8974EE9-C66F-4EDA-8E77-DDE83B4C8B4D} => C:\Program Files (x86)\Kalypso\Imperium Romanum\Imperium Romanum.exe No File
Task: {9A2F1769-6E09-4D2F-B37F-ED192C789A5E} - System32\Tasks\JavaUpdateSched => %COMMONPROGRAMFILES(x86)%\Java\Java Update\jusched.exe No File
Task: {AA5610E8-ACCA-42D8-8F9B-C1302CD51A14} - System32\Tasks\{474D05D0-E50A-4902-950E-C9CBDB4F7366} => C:\Program Files (x86)\Internet Explorer\iexplore.exe [2013-06-12] (Microsoft Corporation)
Task: {AD9E0840-3A17-4274-B0A6-F8D994EA5757} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe [2013-06-04] (Symantec Corporation)
Task: {C2538203-5507-4E6D-BE98-67C118734B68} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe [2013-06-04] (Symantec Corporation)
Task: {CBB88796-BD09-422F-9DB3-169046943557} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated)
Task: {D3C2F7D6-DCFC-4966-BD6B-D95AAAA1D74C} - System32\Tasks\LyricXeeker Update => C:\Program Files (x86)\LyriXeeker\LyriXupdate.exe [2013-07-27] (LyriXeeker Tech)
Task: {DA9BA69B-02BE-4B94-8D89-150323547A6E} - System32\Tasks\{B5413418-9E22-41C7-82C9-21FCE97169B0} => C:\Program Files (x86)\Kalypso\Imperium Romanum\Imperium Romanum.exe No File
Task: {F3E58122-078F-4743-A615-F2A74848761B} - System32\Tasks\{F72C2E4D-18CA-432C-AFD3-7BC916686ED7} => C:\Program Files (x86)\Kalypso\Imperium Romanum\Imperium Romanum.exe No File
Task: {FAA10320-8FE8-4685-8167-2818987B0A32} - System32\Tasks\Games\UpdateCheck_S-1-5-21-1277150531-3409653676-2563953427-1001
Task: {FF1D7BBB-3B82-4C6C-AAB6-F382501454E9} - System32\Tasks\SystemToolsDailyTest => C:\Windows\System32\uaclauncher.exe No File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe
Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe
Task: C:\Windows\Tasks\LyricXeeker Update.job => C:\Program Files (x86)\LyriXeeker\LyriXupdate.exe

==================== Faulty Device Manager Devices =============

Name: Dell Wireless 1502 802.11b/g/n
Description: Dell Wireless 1502 802.11b/g/n
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Atheros Communications Inc.
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/03/2013 00:04:09 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (08/03/2013 00:04:09 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/03/2013 00:04:09 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/02/2013 09:16:36 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (08/02/2013 09:16:36 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/02/2013 09:16:36 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/02/2013 09:06:39 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (08/02/2013 09:06:39 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/02/2013 09:06:39 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (08/02/2013 05:37:21 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 10.0.9200.16635 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 15a4

Startzeit: 01ce8f9474ab9bac

Endzeit: 4

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID: 5993ee5d-fb89-11e2-8f2a-f04da2de3fdc


System errors:
=============
Error: (08/03/2013 11:59:23 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DealPly Live-Dienst (dealplylive)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/03/2013 11:57:15 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Wsys Service" wurde nicht richtig gestartet.

Error: (08/02/2013 09:11:55 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DealPly Live-Dienst (dealplylive)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/02/2013 09:09:46 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Wsys Service" wurde nicht richtig gestartet.

Error: (08/02/2013 09:01:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DealPly Live-Dienst (dealplylive)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/02/2013 08:59:44 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Wsys Service" wurde nicht richtig gestartet.

Error: (07/31/2013 06:17:23 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (07/29/2013 08:51:14 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800706be fehlgeschlagen: Windows-Tool zum Entfernen bösartiger Software x64 - Juli 2013 (KB890830)

Error: (07/29/2013 08:50:54 PM) (Source: DCOM) (User: )
Description: {06622D85-6856-4460-8DE1-A81921B41C4B}

Error: (07/29/2013 04:38:33 PM) (Source: DCOM) (User: )
Description: {C332C124-340D-4430-AA0D-C75602876FCC}


Microsoft Office Sessions:
=========================
Error: (08/03/2013 00:04:09 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (08/03/2013 00:04:09 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/03/2013 00:04:09 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/02/2013 09:16:36 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (08/02/2013 09:16:36 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/02/2013 09:16:36 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/02/2013 09:06:39 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (08/02/2013 09:06:39 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/02/2013 09:06:39 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (08/02/2013 05:37:21 PM) (Source: Application Hang)(User: )
Description: iexplore.exe10.0.9200.1663515a401ce8f9474ab9bac4C:\Program Files\Internet Explorer\iexplore.exe5993ee5d-fb89-11e2-8f2a-f04da2de3fdc


==================== Memory info =========================== 

Percentage of memory in use: 52%
Total physical RAM: 3990.79 MB
Available physical RAM: 1911.33 MB
Total Pagefile: 7979.75 MB
Available Pagefile: 5483.94 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:930.74 GB) (Free:753.95 GB) NTFS (Disk=0 Partition=3)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 932 GB) (Disk ID: A56771B0)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=752 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Gmer:

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-03 12:55:48
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 ST31000524AS rev.JC4A 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Mark\AppData\Local\Temp\pxldypoc.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560                                                                                   fffff80002fff000 8 bytes [00, 00, 10, 02, 4D, 6D, 43, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 576                                                                                   fffff80002fff010 29 bytes [60, DC, 34, 0E, A0, F8, FF, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                            0000000077bdfc90 5 bytes JMP 000000010027091c
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                          0000000077bdfdf4 5 bytes JMP 0000000100270048
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                   0000000077bdfe88 5 bytes JMP 00000001002702ee
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                0000000077bdffe4 5 bytes JMP 00000001002704b2
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                        0000000077be0018 5 bytes JMP 00000001002709fe
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                0000000077be0048 5 bytes JMP 0000000100270ae0
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                             0000000077be0064 5 bytes JMP 000000010002004c
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                0000000077be077c 5 bytes JMP 000000010027012a
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                    0000000077be086c 5 bytes JMP 0000000100270758
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                              0000000077be0884 5 bytes JMP 0000000100270676
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                  0000000077be0dd4 5 bytes JMP 00000001002703d0
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                            0000000077be1900 5 bytes JMP 0000000100270594
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                        0000000077be1bc4 5 bytes JMP 000000010027083a
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[924] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                               0000000077be1d50 5 bytes JMP 000000010027020c
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                              0000000077bdfc90 5 bytes JMP 000000010015091c
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                            0000000077bdfdf4 5 bytes JMP 0000000100150048
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                                                     0000000077bdfe88 5 bytes JMP 00000001001502ee
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                                  0000000077bdffe4 5 bytes JMP 00000001001504b2
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                          0000000077be0018 5 bytes JMP 00000001001509fe
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                                                  0000000077be0048 5 bytes JMP 0000000100150ae0
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                                               0000000077be0064 5 bytes JMP 000000010002004c
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                                  0000000077be077c 5 bytes JMP 000000010015012a
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                                                      0000000077be086c 5 bytes JMP 0000000100150758
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                                0000000077be0884 5 bytes JMP 0000000100150676
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                                    0000000077be0dd4 5 bytes JMP 00000001001503d0
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                              0000000077be1900 5 bytes JMP 0000000100150594
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                          0000000077be1bc4 5 bytes JMP 000000010015083a
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                                 0000000077be1d50 5 bytes JMP 000000010015020c
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                                                     0000000076ad1492 7 bytes JMP 00000001001e059e
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                                                000000007695524f 7 bytes JMP 0000000100150f52
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                                                    00000000769553d0 7 bytes JMP 00000001001e0210
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                                                   0000000076955677 1 byte JMP 00000001001e0048
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                                                   0000000076955679 5 bytes {JMP 0xffffffff8988a9d1}
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                                                          000000007695589a 7 bytes JMP 0000000100150ca6
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                                                          0000000076955a1d 7 bytes JMP 00000001001e03d8
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                                                     0000000076955c9b 7 bytes JMP 00000001001e012c
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                                                       0000000076955d87 7 bytes JMP 00000001001e02f4
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123                                      0000000076957240 7 bytes JMP 0000000100150e6e
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                       0000000077b91465 2 bytes [B9, 77]
.text     C:\ProgramData\eSafe\eGdpSvc.exe[1468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                      0000000077b914bb 2 bytes [B9, 77]
.text     ...                                                                                                                                                  * 2
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                            0000000077bdfc90 5 bytes JMP 000000010035091c
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                          0000000077bdfdf4 5 bytes JMP 0000000100350048
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                                   0000000077bdfe88 5 bytes JMP 00000001003502ee
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                0000000077bdffe4 5 bytes JMP 00000001003504b2
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                        0000000077be0018 5 bytes JMP 00000001003509fe
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                                0000000077be0048 5 bytes JMP 0000000100350ae0
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                             0000000077be0064 5 bytes JMP 000000010026004c
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                0000000077be077c 5 bytes JMP 000000010035012a
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                                    0000000077be086c 5 bytes JMP 0000000100350758
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                              0000000077be0884 5 bytes JMP 0000000100350676
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                  0000000077be0dd4 5 bytes JMP 00000001003503d0
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                            0000000077be1900 5 bytes JMP 0000000100350594
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                        0000000077be1bc4 5 bytes JMP 000000010035083a
.text     C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe[336] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                               0000000077be1d50 5 bytes JMP 000000010035020c
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                        0000000077bdfc90 5 bytes JMP 000000010038091c
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                      0000000077bdfdf4 5 bytes JMP 0000000100380048
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                               0000000077bdfe88 5 bytes JMP 00000001003802ee
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                            0000000077bdffe4 5 bytes JMP 00000001003804b2
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                    0000000077be0018 5 bytes JMP 00000001003809fe
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                            0000000077be0048 5 bytes JMP 0000000100380ae0
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                         0000000077be0064 5 bytes JMP 000000010002004c
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                            0000000077be077c 5 bytes JMP 000000010038012a
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                                0000000077be086c 5 bytes JMP 0000000100380758
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                          0000000077be0884 5 bytes JMP 0000000100380676
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                              0000000077be0dd4 5 bytes JMP 00000001003803d0
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                        0000000077be1900 5 bytes JMP 0000000100380594
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                    0000000077be1bc4 5 bytes JMP 000000010038083a
.text     c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe[1604] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                           0000000077be1d50 5 bytes JMP 000000010038020c
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                          0000000077bdfc90 5 bytes JMP 00000001001e091c
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                        0000000077bdfdf4 5 bytes JMP 00000001001e0048
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                 0000000077bdfe88 5 bytes JMP 00000001001e02ee
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                              0000000077bdffe4 5 bytes JMP 00000001001e04b2
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                      0000000077be0018 5 bytes JMP 00000001001e09fe
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                              0000000077be0048 5 bytes JMP 00000001001e0ae0
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                           0000000077be0064 5 bytes JMP 000000010002004c
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                              0000000077be077c 5 bytes JMP 00000001001e012a
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                  0000000077be086c 5 bytes JMP 00000001001e0758
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                            0000000077be0884 5 bytes JMP 00000001001e0676
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                0000000077be0dd4 5 bytes JMP 00000001001e03d0
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                          0000000077be1900 5 bytes JMP 00000001001e0594
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                      0000000077be1bc4 5 bytes JMP 00000001001e083a
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                             0000000077be1d50 5 bytes JMP 00000001001e020c
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                   0000000077b91465 2 bytes [B9, 77]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                  0000000077b914bb 2 bytes [B9, 77]
.text     ...                                                                                                                                                  * 2
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                 0000000076ad1492 7 bytes JMP 00000001001f04bc
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206            000000007695524f 7 bytes JMP 00000001001e0f52
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                00000000769553d0 7 bytes JMP 00000001001f0210
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149               0000000076955677 1 byte JMP 00000001001f0048
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151               0000000076955679 5 bytes {JMP 0xffffffff8989a9d1}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                      000000007695589a 7 bytes JMP 00000001001e0ca6
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                      0000000076955a1d 7 bytes JMP 00000001001f03d8
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                 0000000076955c9b 7 bytes JMP 00000001001f012c
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                   0000000076955d87 7 bytes JMP 00000001001f02f4
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1092] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123  0000000076957240 7 bytes JMP 00000001001e0e6e
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                0000000077bdfc90 5 bytes JMP 000000010009091c
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                              0000000077bdfdf4 5 bytes JMP 0000000100090048
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                       0000000077bdfe88 5 bytes JMP 00000001000902ee
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                    0000000077bdffe4 5 bytes JMP 00000001000904b2
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                            0000000077be0018 5 bytes JMP 00000001000909fe
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                    0000000077be0048 5 bytes JMP 0000000100090ae0
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                 0000000077be0064 5 bytes JMP 000000010002004c
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                    0000000077be077c 5 bytes JMP 000000010009012a
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                        0000000077be086c 5 bytes JMP 0000000100090758
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                  0000000077be0884 5 bytes JMP 0000000100090676
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                      0000000077be0dd4 5 bytes JMP 00000001000903d0
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                0000000077be1900 5 bytes JMP 0000000100090594
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                            0000000077be1bc4 5 bytes JMP 000000010009083a
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                   0000000077be1d50 5 bytes JMP 000000010009020c
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                  000000007695524f 7 bytes JMP 0000000100090f52
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                      00000000769553d0 7 bytes JMP 00000001000a0210
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                     0000000076955677 1 byte JMP 00000001000a0048
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                     0000000076955679 5 bytes {JMP 0xffffffff8974a9d1}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                            000000007695589a 7 bytes JMP 0000000100090ca6
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                            0000000076955a1d 7 bytes JMP 00000001000a03d8
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                       0000000076955c9b 7 bytes JMP 00000001000a012c
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                         0000000076955d87 7 bytes JMP 00000001000a02f4
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123        0000000076957240 7 bytes JMP 0000000100090e6e
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                       0000000076ad1492 7 bytes JMP 00000001000a0762
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                         0000000077b91465 2 bytes [B9, 77]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                        0000000077b914bb 2 bytes [B9, 77]
.text     ...                                                                                                                                                  * 2
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                       0000000077bdfc90 5 bytes JMP 000000010028091c
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                     0000000077bdfdf4 5 bytes JMP 0000000100280048
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                              0000000077bdfe88 5 bytes JMP 00000001002802ee
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                           0000000077bdffe4 5 bytes JMP 00000001002804b2
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                   0000000077be0018 5 bytes JMP 00000001002809fe
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                           0000000077be0048 5 bytes JMP 0000000100280ae0
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                        0000000077be0064 5 bytes JMP 000000010002004c
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                           0000000077be077c 5 bytes JMP 000000010028012a
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                               0000000077be086c 5 bytes JMP 0000000100280758
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                         0000000077be0884 5 bytes JMP 0000000100280676
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                             0000000077be0dd4 5 bytes JMP 00000001002803d0
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                       0000000077be1900 5 bytes JMP 0000000100280594
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                   0000000077be1bc4 5 bytes JMP 000000010028083a
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                          0000000077be1d50 5 bytes JMP 000000010028020c
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                              0000000076ad1492 7 bytes JMP 000000010029059e
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                         000000007695524f 7 bytes JMP 0000000100280f52
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                             00000000769553d0 7 bytes JMP 0000000100290210
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                            0000000076955677 1 byte JMP 0000000100290048
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                            0000000076955679 5 bytes {JMP 0xffffffff8993a9d1}
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                                   000000007695589a 7 bytes JMP 0000000100280ca6
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                                   0000000076955a1d 7 bytes JMP 00000001002903d8
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                              0000000076955c9b 7 bytes JMP 000000010029012c
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                                0000000076955d87 7 bytes JMP 00000001002902f4
.text     C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2800] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123               0000000076957240 7 bytes JMP 0000000100280e6e
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                              0000000077bdfc90 5 bytes JMP 000000010029091c
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                            0000000077bdfdf4 5 bytes JMP 0000000100290048
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                     0000000077bdfe88 5 bytes JMP 00000001002902ee
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                  0000000077bdffe4 5 bytes JMP 00000001002904b2
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                          0000000077be0018 5 bytes JMP 00000001002909fe
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                  0000000077be0048 5 bytes JMP 0000000100290ae0
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                               0000000077be0064 5 bytes JMP 000000010002004c
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                  0000000077be077c 5 bytes JMP 000000010029012a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                      0000000077be086c 5 bytes JMP 0000000100290758
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                0000000077be0884 5 bytes JMP 0000000100290676
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                    0000000077be0dd4 5 bytes JMP 00000001002903d0
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                              0000000077be1900 5 bytes JMP 0000000100290594
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                          0000000077be1bc4 5 bytes JMP 000000010029083a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[4084] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                 0000000077be1d50 5 bytes JMP 000000010029020c
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                    0000000077bdfc90 5 bytes JMP 00000001001d091c
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                  0000000077bdfdf4 5 bytes JMP 00000001001d0048
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                                           0000000077bdfe88 5 bytes JMP 00000001001d02ee
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                        0000000077bdffe4 5 bytes JMP 00000001001d04b2
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                0000000077be0018 5 bytes JMP 00000001001d09fe
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                                        0000000077be0048 5 bytes JMP 00000001001d0ae0
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                                     0000000077be0064 5 bytes JMP 000000010002004c
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                        0000000077be077c 5 bytes JMP 00000001001d012a
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                                            0000000077be086c 5 bytes JMP 00000001001d0758
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                      0000000077be0884 5 bytes JMP 00000001001d0676
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                          0000000077be0dd4 5 bytes JMP 00000001001d03d0
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                    0000000077be1900 5 bytes JMP 00000001001d0594
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                0000000077be1bc4 5 bytes JMP 00000001001d083a
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                       0000000077be1d50 5 bytes JMP 00000001001d020c
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                                      000000007695524f 7 bytes JMP 00000001001d0f52
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                                          00000000769553d0 7 bytes JMP 0000000100260210
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                                         0000000076955677 1 byte JMP 0000000100260048
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                                         0000000076955679 5 bytes {JMP 0xffffffff8990a9d1}
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                                                000000007695589a 7 bytes JMP 00000001001d0ca6
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                                                0000000076955a1d 7 bytes JMP 00000001002603d8
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                                           0000000076955c9b 7 bytes JMP 000000010026012c
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                                             0000000076955d87 7 bytes JMP 00000001002602f4
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123                            0000000076957240 7 bytes JMP 00000001001d0e6e
.text     C:\Users\Mark\Downloads\gmer_2.1.19163.exe[6380] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                                           0000000076ad1492 7 bytes JMP 00000001002604bc

---- EOF - GMER 2.1 ----

dds:

Code:

ATTFilter

DDS (Ver_2012-11-20.01) - NTFS_AMD64 
Internet Explorer: 10.0.9200.16635
Run by Mark at 21:09:57 on 2013-08-02
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3991.2437 [GMT 2:00]
.
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\ProgramData\eSafe\eGdpSvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe
C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
C:\Program Files (x86)\Skype\Updater\Updater.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxps://www.google.de/?gws_rd=cr
uDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
mWinlogon: Userinit = userinit.exe
BHO: LyricXeeker: {17E58097-6CA5-448B-830F-2A19678248FB} - C:\Program Files (x86)\LyriXeeker\125.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll
BHO: DealPly Shopping: {9cf699ca-2174-4ed8-bec1-ba82095edce0} - 
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll
uRun: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
mRun: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
TCP: NameServer = 192.168.178.1
TCP: Interfaces\{1B117D54-2D73-41FE-8F42-A21C0CD18E4E} : DHCPNameServer = 192.168.178.1
TCP: Interfaces\{1D62BBB2-33C8-4AAA-BDA3-F46411A0CC60} : DHCPNameServer = 192.168.178.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
AppInit_DLLs= C:\Windows\SysWOW64\nvinit.dll
SSODL: WebCheck - <orphaned>
x64-mStart Page = hxxp://www.google.com
x64-mDefault_Page_URL = hxxp://www.google.com
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /MAXX4 
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [Command Center Controllers] "C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe"
x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
x64-DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2012-1-24 28992]
R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1404000.028\symds64.sys [2013-6-9 493656]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1404000.028\symefa64.sys [2013-6-9 1139800]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [2013-7-17 1393240]
R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\Windows\System32\drivers\NISx64\1404000.028\ccsetx64.sys [2013-6-9 169048]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20130801.001\IDSviA64.sys [2013-8-2 513184]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1404000.028\ironx64.sys [2013-6-9 224416]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NISx64\1404000.028\symnets.sys [2013-6-9 433752]
R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2012-1-24 98208]
R2 DevoloNetworkService;devolo Network Service;C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [2010-12-23 3304768]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2013-6-28 2470736]
R2 MSI_ODD_Service;MSI_ODD_Service;C:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe [2011-10-5 76800]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe [2013-6-9 144368]
R2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-2-28 161384]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-20 381248]
R2 WsysSvc;Wsys Service;C:\ProgramData\eSafe\eGdpSvc.exe [2013-8-2 891456]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-2-12 138912]
R3 IntcDAud;Intel(R) Display-Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-1-24 317440]
R3 NTIOLib_X64;NTIOLib_X64;C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [2010-1-18 14136]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-1-24 539240]
R3 rusb3hub;Renesas Electronics USB 3.0 Hub Driver (Version 3.0);C:\Windows\System32\drivers\rusb3hub.sys [2012-1-24 100352]
R3 rusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver (Version 3.0);C:\Windows\System32\drivers\rusb3xhc.sys [2012-1-24 216064]
S2 AlienFusionService;Alienware Fusion Service;C:\Program Files\Alienware\Command Center\AlienFusionService.exe [2011-12-15 14664]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 dealplylive;DealPly Live-Dienst (dealplylive);C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe /svc --> C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe  [?]
S3 BrSerIb;Brother Serial Interface Driver(WDM);C:\Windows\System32\drivers\BrSerIb.sys [2012-12-4 95344]
S3 BrUsbSIb;Brother Serial USB Driver(WDM);C:\Windows\System32\drivers\BrUsbSib.sys [2012-12-4 21872]
S3 dealplylivem;DealPly Live-Dienst (dealplylivem);C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe /medsvc --> C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe  [?]
S3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2012-1-24 158976]
S3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;C:\Windows\System32\drivers\nvstusb.sys [2012-1-24 291648]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
.
=============== Created Last 30 ================
.
2013-08-02 16:18:12	--------	d-----w-	C:\ProgramData\eSafe
2013-08-02 16:16:57	--------	d-----w-	C:\Users\Mark\AppData\Local\Google
2013-08-02 16:16:56	--------	d-----w-	C:\Program Files (x86)\LyriXeeker
2013-07-29 19:01:48	--------	d-----w-	C:\Users\Mark\AppData\Roaming\Trine2
2013-07-24 12:22:10	--------	d-----w-	C:\ProgramData\Codemasters
2013-07-12 13:06:00	2706432	----a-w-	C:\Windows\SysWow64\mshtml.tlb
2013-07-12 13:06:00	2706432	----a-w-	C:\Windows\System32\mshtml.tlb
2013-07-11 19:33:04	--------	d-----w-	C:\4c53c8961b0478fb9962882ff0
2013-07-11 14:26:50	1643520	----a-w-	C:\Windows\System32\DWrite.dll
2013-07-11 14:26:50	1247744	----a-w-	C:\Windows\SysWow64\DWrite.dll
.
==================== Find3M  ====================
.
2013-06-19 14:00:02	177312	----a-w-	C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2013-06-12 15:04:46	71048	----a-w-	C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 15:04:46	692104	----a-w-	C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-11 23:43:37	1767936	----a-w-	C:\Windows\SysWow64\wininet.dll
2013-06-11 23:43:00	2877440	----a-w-	C:\Windows\SysWow64\jscript9.dll
2013-06-11 23:42:58	61440	----a-w-	C:\Windows\SysWow64\iesetup.dll
2013-06-11 23:42:58	109056	----a-w-	C:\Windows\SysWow64\iesysprep.dll
2013-06-11 23:26:20	2241024	----a-w-	C:\Windows\System32\wininet.dll
2013-06-11 23:25:16	3958784	----a-w-	C:\Windows\System32\jscript9.dll
2013-06-11 23:25:13	67072	----a-w-	C:\Windows\System32\iesetup.dll
2013-06-11 23:25:13	136704	----a-w-	C:\Windows\System32\iesysprep.dll
2013-06-11 22:51:45	71680	----a-w-	C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-06-11 22:50:58	89600	----a-w-	C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-05 19:53:55	9728	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-06-05 03:34:27	3153920	----a-w-	C:\Windows\System32\win32k.sys
2013-06-04 06:00:13	624128	----a-w-	C:\Windows\System32\qedit.dll
2013-06-04 04:53:07	509440	----a-w-	C:\Windows\SysWow64\qedit.dll
2013-05-23 05:25:28	1139800	----a-w-	C:\Windows\System32\drivers\NISx64\1404000.028\symefa64.sys
2013-05-21 05:02:00	493656	----a-w-	C:\Windows\System32\drivers\NISx64\1404000.028\symds64.sys
2013-05-16 05:02:14	796760	----a-w-	C:\Windows\System32\drivers\NISx64\1404000.028\srtsp64.sys
2013-05-13 05:51:01	184320	----a-w-	C:\Windows\System32\cryptsvc.dll
2013-05-13 05:51:00	1464320	----a-w-	C:\Windows\System32\crypt32.dll
2013-05-13 05:51:00	139776	----a-w-	C:\Windows\System32\cryptnet.dll
2013-05-13 05:50:40	52224	----a-w-	C:\Windows\System32\certenc.dll
2013-05-13 04:45:55	140288	----a-w-	C:\Windows\SysWow64\cryptsvc.dll
2013-05-13 04:45:55	1160192	----a-w-	C:\Windows\SysWow64\crypt32.dll
2013-05-13 04:45:55	103936	----a-w-	C:\Windows\SysWow64\cryptnet.dll
2013-05-13 03:43:55	1192448	----a-w-	C:\Windows\System32\certutil.exe
2013-05-13 03:08:10	903168	----a-w-	C:\Windows\SysWow64\certutil.exe
2013-05-13 03:08:06	43008	----a-w-	C:\Windows\SysWow64\certenc.dll
2013-05-10 05:49:27	30720	----a-w-	C:\Windows\System32\cryptdlg.dll
2013-05-10 03:20:54	24576	----a-w-	C:\Windows\SysWow64\cryptdlg.dll
2013-05-08 06:39:01	1910632	----a-w-	C:\Windows\System32\drivers\tcpip.sys
2013-05-06 06:03:49	1887744	----a-w-	C:\Windows\System32\WMVDECOD.DLL
2013-05-06 04:56:35	1620480	----a-w-	C:\Windows\SysWow64\WMVDECOD.DLL
.
============= FINISH: 21:10:37,35 ===============

attach:

Code:

ATTFilter

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume2
Install Date: 11.08.2012 12:57:30
System Uptime: 02.08.2013 21:08:06 (0 hours ago)
.
Motherboard: Alienware |  | 08PG26
Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz | CPU 1 | 3300/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 931 GiB total, 753,715 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Dell Wireless 1502 802.11b/g/n
Device ID: PCI\VEN_168C&DEV_002B&SUBSYS_02041028&REV_01\4&21A0897D&0&00E2
Manufacturer: Atheros Communications Inc.
Name: Dell Wireless 1502 802.11b/g/n
PNP Device ID: PCI\VEN_168C&DEV_002B&SUBSYS_02041028&REV_01\4&21A0897D&0&00E2
Service: athr
.
==== System Restore Points ===================
.
RP88: 31.07.2013 18:22:52 - Geplanter Prüfpunkt
RP89: 31.07.2013 19:36:56 - DirectX wurde installiert
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Reader X MUI
AlienAutopsy
Alienware Command Center
Alienware Product Registration
Ashampoo Burning Studio 2013 v.11.0.6
Assassin's Creed II
Assassin's Creed Revelations
Burnout(TM) Paradise The Ultimate Box
Call of Duty: Modern Warfare 2
Call of Duty: Modern Warfare 2 - Multiplayer
Counter-Strike
Counter-Strike: Condition Zero
Counter-Strike: Condition Zero Deleted Scenes
Counter-Strike: Global Offensive
Counter-Strike: Source
devolo dLAN Cockpit
Die Siedler II - Die nächste Generation
dLAN Cockpit
Dota 2
F1 2012
Fallen Earth
Google Update Helper
Intel(R) Processor Graphics
Java Auto Updater
Java(TM) 7 Update 1
Java(TM) 7 Update 1 (64-bit)
LogMeIn Hamachi
LyricXeeker
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Office 2010
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MSI ODD Monitor
Norton Internet Security
Notepad++
NVIDIA 3D Vision Treiber 285.66
NVIDIA Grafiktreiber 285.66
NVIDIA HD-Audiotreiber 1.2.24.0
NVIDIA Install Application
NVIDIA Optimus 1.5.20
NVIDIA PhysX
NVIDIA PhysX-Systemsoftware 9.11.0621
NVIDIA Stereoscopic 3D Driver
NVIDIA Systemsteuerung 285.66
NVIDIA Update Components
Realtek High Definition Audio Driver
Saints Row: The Third
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Skype™ 6.3
Steam
Team Fortress 2
TeamSpeak 3 Client
Trine 2
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
WinRAR 4.20 (32-Bit)
World of Tanks
World of Tanks - Common Test
World of Warplanes
Worms Reloaded
Worms Revolution
Wsys Control 1.0.0.2598
.
==== End Of File ===========================

adwcleaner:

Code:

ATTFilter

# AdwCleaner v2.306 - Datei am 02/08/2013 um 20:56:26 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Mark - MARK-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Mark\Downloads\adwcleaner06.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Desinfiziert : C:\Users\Mark\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Datei Desinfiziert : C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Datei Desinfiziert : C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Datei Desinfiziert : C:\Users\Mark\Desktop\Internet Explorer.lnk
Datei Gelöscht : C:\user.js
Gelöscht mit Neustart : C:\ProgramData\eSafe
Ordner Gelöscht : C:\Program Files (x86)\DealPly
Ordner Gelöscht : C:\Program Files (x86)\DealPlyLive
Ordner Gelöscht : C:\ProgramData\DealPlyLive
Ordner Gelöscht : C:\Users\Mark\AppData\Local\DealPlyLive
Ordner Gelöscht : C:\Users\Mark\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\Mark\AppData\Roaming\DealPly
Ordner Gelöscht : C:\Users\Mark\AppData\Roaming\eIntaller
Ordner Gelöscht : C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly

***** [Registrierungsdatenbank] *****

Daten Gelöscht : HKLM\...\StartMenuInternet\IEXPLORE.EXE [(Default)] = C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST31000524AS_9VPF01RAXXXX9VPF01RA&ts=1375460218
Schlüssel Gelöscht : HKCU\Software\DealPly
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickCtrl.9
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.Update3WebControl.3
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CredentialDialogMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CredentialDialogMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\Software\DealPly
Schlüssel Gelöscht : HKLM\Software\eSafeSecControl
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=3
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=9
Schlüssel Gelöscht : HKLM\Software\qvo6Software
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{0D89DE71-3D99-4288-84DC-F18F1047A7D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1E0C9B2A-6447-452C-B012-2314A0C29412}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{34A8CEB6-89BB-49F1-B5E4-0D0D6C21F3B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3A4DBD3A-98CC-41CE-AD21-352D42B6F754}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4F8A50F6-69DE-4BE3-A33A-A1079B9AC0DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{501CB57A-D4E2-4855-96AD-EDB0A9083395}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6FF2C4DD-77A4-4BB5-BA4C-B42DEFBF9137}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{83ABA270-8390-4CA6-AE48-FC089F55629E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8B218A5F-1A3D-4347-94EF-A79575EB8094}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9BDB5E09-4BBA-4422-8C2B-529B281C32B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C536F080-57B7-46D6-8894-C647553F2889}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FFCC53E6-2655-47FC-A89B-54E8D7F305D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16635

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST31000524AS_9VPF01RAXXXX9VPF01RA&ts=1375460218 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST31000524AS_9VPF01RAXXXX9VPF01RA&ts=1375460218 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST31000524AS_9VPF01RAXXXX9VPF01RA&ts=1375460218 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST31000524AS_9VPF01RAXXXX9VPF01RA&ts=1375460218 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST31000524AS_9VPF01RAXXXX9VPF01RA&ts=1375460218 --> hxxp://www.google.com

*************************

AdwCleaner[S1].txt - [10252 octets] - [02/08/2013 20:56:26]

########## EOF - C:\AdwCleaner[S1].txt - [10313 octets] ##########

schrauber · 03.08.2013, 13:50

Hi,

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Und ein frisches Frst log bitte.

Atrom · 03.08.2013, 14:15

Danke für die schnelle Antwort!

Jrt:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.3.1 (08.02.2013:3)
OS: Windows 7 Home Premium x64
Ran by Mark on 03.08.2013 at 15:02:31,70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Successfully stopped: [Service] dealplylive 
Successfully deleted: [Service] dealplylive 
Successfully stopped: [Service] dealplylivem 
Successfully deleted: [Service] dealplylivem 



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\dealplylive.exe
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\dealplylive
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dealplylive
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\esafeseccontrol
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{17E58097-6CA5-448B-830F-2A19678248FB}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\esafe"
Successfully deleted: [Folder] "C:\Program Files (x86)\lyrixeeker"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.08.2013 at 15:05:55,45
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Frst:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013
Ran by Mark (administrator) on 03-08-2013 15:09:52
Running from C:\Users\Mark\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Micro-Star Int'l Co., Ltd.) c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6412904 2011-11-03] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1157224 2011-10-20] (Realtek Semiconductor)
HKLM\...\Run: [] -  [x]
HKLM\...\Run: [Command Center Controllers] - C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12616 2011-12-15] (Alienware)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1807272 2013-07-27] (Valve Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKLM-x32\...\Run: [Dell Registration] - C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [241984 2011-10-20] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [203072 2011-10-20] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?gws_rd=cr
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: DealPly Shopping - {9cf699ca-2174-4ed8-bec1-ba82095edce0} - C:\Program Files (x86)\DealPly\DealPlyIE.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (DealPly  Shopping) - C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi\3.5.0.0_0
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [odnofacmifkjndflfmmplhckcbfjckhj] - C:\Program Files (x86)\LyriXeeker\125.crx

==================== Services (Whitelisted) =================

R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
R2 MSI_ODD_Service; c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe [76800 2011-10-05] (Micro-Star Int'l Co., Ltd.)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
S2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [x]

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-09-04] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-09-04] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-02-11] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20130802.001\IDSvia64.sys [513184 2012-09-06] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20130802.001\IDSvia64.sys [513184 2012-09-06] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130802.006\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130802.006\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130802.006\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130802.006\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 NTIOLib_X64; C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [14136 2010-01-18] (MSI)
R3 NTIOLib_X64; C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [14136 2010-01-18] (MSI)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [100352 2011-09-15] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [216064 2011-09-15] (Renesas Electronics Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-03 15:02 - 2013-08-03 15:02 - 00000000 ____D C:\Windows\ERUNT
2013-08-03 15:01 - 2013-08-03 15:01 - 00560986 _____ (Oleg N. Scherbakov) C:\Users\Mark\Downloads\JRT.exe
2013-08-03 13:09 - 2013-08-03 13:09 - 00024360 _____ C:\Users\Mark\Desktop\defogger_disable.lnk
2013-08-03 12:55 - 2013-08-03 12:55 - 00038767 _____ C:\Users\Mark\Downloads\gmer.txt
2013-08-03 12:55 - 2013-08-03 12:55 - 00000498 _____ C:\Users\Mark\Desktop\gmer.lnk
2013-08-03 12:17 - 2013-08-03 12:17 - 00377856 _____ C:\Users\Mark\Downloads\gmer_2.1.19163.exe
2013-08-03 12:12 - 2013-08-03 12:12 - 00029261 _____ C:\Users\Mark\Desktop\FRST.txt
2013-08-03 12:12 - 2013-08-03 12:12 - 00017719 _____ C:\Users\Mark\Desktop\Addition.txt
2013-08-03 12:11 - 2013-08-03 12:11 - 00000000 ____D C:\FRST
2013-08-03 12:10 - 2013-08-03 12:10 - 01781485 _____ (Farbar) C:\Users\Mark\Downloads\FRST64.exe
2013-08-03 12:08 - 2013-08-03 12:08 - 00000470 _____ C:\Users\Mark\Downloads\defogger_disable.log
2013-08-03 12:08 - 2013-08-03 12:08 - 00000000 _____ C:\Users\Mark\defogger_reenable
2013-08-03 12:06 - 2013-08-03 12:06 - 00050477 _____ C:\Users\Mark\Downloads\Defogger.exe
2013-08-02 21:07 - 2013-08-02 21:07 - 00000854 _____ C:\AdwCleaner[S2].txt
2013-08-02 21:04 - 2013-08-02 21:10 - 00014519 _____ C:\Users\Mark\Desktop\dds.txt
2013-08-02 21:04 - 2013-08-02 21:10 - 00004667 _____ C:\Users\Mark\Desktop\attach.txt
2013-08-02 21:02 - 2013-08-02 21:02 - 00700783 ____R (Swearware) C:\Users\Mark\Downloads\dds+.exe
2013-08-02 21:01 - 2013-08-02 21:01 - 00655200 _____ C:\Users\Mark\Downloads\setup.exe
2013-08-02 20:56 - 2013-08-02 20:56 - 00010347 _____ C:\AdwCleaner[S1].txt
2013-08-02 20:55 - 2013-08-02 20:55 - 00666633 _____ C:\Users\Mark\Downloads\adwcleaner06.exe
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\ServerJarStorage
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\MCEdit-schematics
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\MCEdit-0.1.6.win32
2013-08-02 18:17 - 2013-08-03 14:22 - 00000902 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-08-02 18:17 - 2013-08-03 13:03 - 00000898 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2013-08-02 18:17 - 2013-08-02 18:17 - 00003898 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA
2013-08-02 18:17 - 2013-08-02 18:17 - 00003646 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
2013-08-02 18:17 - 2013-08-02 18:17 - 00003364 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-08-02 18:16 - 2013-08-03 13:03 - 00000386 _____ C:\Windows\Tasks\LyricXeeker Update.job
2013-08-02 18:16 - 2013-08-02 18:16 - 00003032 _____ C:\Windows\System32\Tasks\LyricXeeker Update
2013-08-02 18:16 - 2013-08-02 18:16 - 00000000 ____D C:\Users\Mark\AppData\Local\Google
2013-07-29 21:01 - 2013-07-29 21:01 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Trine2
2013-07-29 20:59 - 2013-07-29 20:59 - 00000222 _____ C:\Users\Mark\Desktop\F1 2012.url
2013-07-29 20:49 - 2013-06-24 00:41 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-24 17:27 - 2013-07-24 17:27 - 00000221 _____ C:\Users\Mark\Desktop\Trine 2.url
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\Users\Mark\Documents\My Games
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\ProgramData\Codemasters
2013-07-24 07:02 - 2013-07-24 07:02 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero Deleted Scenes.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000222 _____ C:\Users\Mark\Desktop\Assassin's Creed Revelations.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Global Offensive.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Saints Row The Third.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2 - Multiplayer.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Assassin's Creed II.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Source.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero.url
2013-07-24 06:58 - 2013-07-24 06:58 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike.url
2013-07-22 17:59 - 2013-07-22 17:59 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2.url
2013-07-20 12:18 - 2013-07-20 12:18 - 01001338 _____ C:\Users\Mark\Desktop\SinglePlayerCommands-MC1.6.2_V5.0.zip
2013-07-17 18:55 - 2013-07-17 18:55 - 00000219 _____ C:\Users\Mark\Desktop\Team Fortress 2.url
2013-07-17 18:50 - 2013-07-17 18:50 - 00003120 _____ C:\Windows\System32\Tasks\{E81BC9DE-98DE-4E22-AB31-6DA0D5E69038}
2013-07-12 15:06 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 15:06 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 15:06 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-12 15:05 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 15:05 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 15:05 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 15:05 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 15:05 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 15:05 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 15:05 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 21:33 - 2013-07-11 21:33 - 00000000 ____D C:\4c53c8961b0478fb9962882ff0
2013-07-11 16:27 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 16:27 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 16:27 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 16:27 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 16:27 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 16:26 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 16:26 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 18:45 - 2013-07-10 18:45 - 13292297 _____ C:\Users\Mark\Desktop\ravands-converted-1373474728787.zip
2013-07-10 18:42 - 2013-07-10 18:43 - 52460484 _____ C:\Users\Mark\Desktop\ravands.zip
2013-07-10 15:18 - 2013-07-10 15:18 - 00065935 _____ C:\Users\Mark\Desktop\X-ray.rar
2013-07-10 15:17 - 2013-07-10 15:17 - 00066494 _____ C:\Users\Mark\Downloads\X-RayMod_v042.zip
2013-07-07 14:21 - 2013-07-07 14:21 - 53942177 _____ C:\Users\Mark\Desktop\Misa500-converted-1373199671883.zip
2013-07-07 14:15 - 2013-07-07 14:15 - 02570679 _____ C:\Users\Mark\Desktop\TextureEnder.jar
2013-07-07 14:09 - 2013-07-07 14:10 - 53886249 _____ C:\Users\Mark\Desktop\Misa500.zip
2013-07-07 14:06 - 2013-07-07 14:06 - 08625354 _____ C:\Users\Mark\Desktop\willpack3.zip
2013-07-07 13:57 - 2013-07-07 13:57 - 09628376 _____ C:\Users\Mark\Desktop\Romecraft GERMANIA 14.zip
2013-07-07 12:02 - 2013-07-07 12:02 - 00484992 _____ C:\Users\Mark\Desktop\Minecraft (1).exe
2013-07-04 20:51 - 2013-07-04 20:51 - 00000219 _____ C:\Users\Mark\Desktop\Dota 2.url
2013-07-04 19:03 - 2013-07-04 19:31 - 00000000 ____D C:\Users\Mark\Desktop\Neuer Ordner
2013-07-04 18:37 - 2013-07-04 18:37 - 00000000 ____D C:\Users\Mark\Documents\default
113

==================== One Month Modified Files and Folders =======

2013-08-03 15:05 - 2013-08-03 15:05 - 00001424 _____ C:\Users\Mark\Desktop\JRT.txt
2013-08-03 15:04 - 2013-02-28 18:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-03 15:03 - 2012-08-11 13:40 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Skype
2013-08-03 15:02 - 2013-08-03 15:02 - 00000000 ____D C:\Windows\ERUNT
2013-08-03 15:01 - 2013-08-03 15:01 - 00560986 _____ (Oleg N. Scherbakov) C:\Users\Mark\Downloads\JRT.exe
2013-08-03 14:59 - 2013-02-18 15:09 - 00000000 ____D C:\Users\Mark\AppData\Roaming\.minecraft
2013-08-03 14:22 - 2013-08-02 18:17 - 00000902 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-08-03 13:11 - 2010-11-21 08:50 - 03343618 _____ C:\Windows\system32\perfh007.dat
2013-08-03 13:11 - 2010-11-21 08:50 - 00970318 _____ C:\Windows\system32\perfc007.dat
2013-08-03 13:11 - 2009-07-14 07:13 - 00006248 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-03 13:11 - 2009-07-14 06:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-03 13:11 - 2009-07-14 06:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-03 13:09 - 2013-08-03 13:09 - 00024360 _____ C:\Users\Mark\Desktop\defogger_disable.lnk
2013-08-03 13:07 - 2012-01-23 22:25 - 01675427 _____ C:\Windows\WindowsUpdate.log
2013-08-03 13:04 - 2012-08-13 20:59 - 00000000 ____D C:\Users\Mark\AppData\Local\LogMeIn Hamachi
2013-08-03 13:03 - 2013-08-02 18:17 - 00000898 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2013-08-03 13:03 - 2013-08-02 18:16 - 00000386 _____ C:\Windows\Tasks\LyricXeeker Update.job
2013-08-03 13:03 - 2012-09-07 15:45 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-03 13:03 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-03 13:02 - 2012-01-23 22:22 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-03 13:02 - 2009-07-14 06:51 - 00075652 _____ C:\Windows\setupact.log
2013-08-03 12:55 - 2013-08-03 12:55 - 00038767 _____ C:\Users\Mark\Downloads\gmer.txt
2013-08-03 12:55 - 2013-08-03 12:55 - 00000498 _____ C:\Users\Mark\Desktop\gmer.lnk
2013-08-03 12:21 - 2013-05-22 13:59 - 00003460 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-08-03 12:17 - 2013-08-03 12:17 - 00377856 _____ C:\Users\Mark\Downloads\gmer_2.1.19163.exe
2013-08-03 12:12 - 2013-08-03 12:12 - 00029261 _____ C:\Users\Mark\Desktop\FRST.txt
2013-08-03 12:12 - 2013-08-03 12:12 - 00017719 _____ C:\Users\Mark\Desktop\Addition.txt
2013-08-03 12:11 - 2013-08-03 12:11 - 00000000 ____D C:\FRST
2013-08-03 12:10 - 2013-08-03 12:10 - 01781485 _____ (Farbar) C:\Users\Mark\Downloads\FRST64.exe
2013-08-03 12:08 - 2013-08-03 12:08 - 00000470 _____ C:\Users\Mark\Downloads\defogger_disable.log
2013-08-03 12:08 - 2013-08-03 12:08 - 00000000 _____ C:\Users\Mark\defogger_reenable
2013-08-03 12:08 - 2012-08-11 12:57 - 00000000 ____D C:\Users\Mark
2013-08-03 12:06 - 2013-08-03 12:06 - 00050477 _____ C:\Users\Mark\Downloads\Defogger.exe
2013-08-02 21:10 - 2013-08-02 21:04 - 00014519 _____ C:\Users\Mark\Desktop\dds.txt
2013-08-02 21:10 - 2013-08-02 21:04 - 00004667 _____ C:\Users\Mark\Desktop\attach.txt
2013-08-02 21:07 - 2013-08-02 21:07 - 00000854 _____ C:\AdwCleaner[S2].txt
2013-08-02 21:02 - 2013-08-02 21:02 - 00700783 ____R (Swearware) C:\Users\Mark\Downloads\dds+.exe
2013-08-02 21:01 - 2013-08-02 21:01 - 00655200 _____ C:\Users\Mark\Downloads\setup.exe
2013-08-02 20:56 - 2013-08-02 20:56 - 00010347 _____ C:\AdwCleaner[S1].txt
2013-08-02 20:56 - 2013-06-06 16:18 - 00000995 _____ C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-02 20:55 - 2013-08-02 20:55 - 00666633 _____ C:\Users\Mark\Downloads\adwcleaner06.exe
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\ServerJarStorage
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\MCEdit-schematics
2013-08-02 18:18 - 2013-08-02 18:18 - 00000000 ____D C:\Users\Mark\Desktop\MCEdit-0.1.6.win32
2013-08-02 18:17 - 2013-08-02 18:17 - 00003898 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA
2013-08-02 18:17 - 2013-08-02 18:17 - 00003646 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
2013-08-02 18:17 - 2013-08-02 18:17 - 00003364 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-08-02 18:16 - 2013-08-02 18:16 - 00003032 _____ C:\Windows\System32\Tasks\LyricXeeker Update
2013-08-02 18:16 - 2013-08-02 18:16 - 00000000 ____D C:\Users\Mark\AppData\Local\Google
2013-07-29 21:01 - 2013-07-29 21:01 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Trine2
2013-07-29 21:01 - 2012-09-06 17:11 - 00257772 _____ C:\Windows\DirectX.log
2013-07-29 20:59 - 2013-07-29 20:59 - 00000222 _____ C:\Users\Mark\Desktop\F1 2012.url
2013-07-29 20:59 - 2012-09-07 16:11 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-07-25 13:04 - 2013-01-28 10:04 - 00000000 ____D C:\Program Files\AlienAutopsy
2013-07-25 13:04 - 2012-09-10 17:00 - 00000000 ____D C:\ProgramData\PCDr
2013-07-25 12:40 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-24 17:27 - 2013-07-24 17:27 - 00000221 _____ C:\Users\Mark\Desktop\Trine 2.url
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\Users\Mark\Documents\My Games
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\ProgramData\Codemasters
2013-07-24 07:02 - 2013-07-24 07:02 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero Deleted Scenes.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000222 _____ C:\Users\Mark\Desktop\Assassin's Creed Revelations.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Global Offensive.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Saints Row The Third.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2 - Multiplayer.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Assassin's Creed II.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Source.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero.url
2013-07-24 06:58 - 2013-07-24 06:58 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike.url
2013-07-22 17:59 - 2013-07-22 17:59 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2.url
2013-07-20 12:18 - 2013-07-20 12:18 - 01001338 _____ C:\Users\Mark\Desktop\SinglePlayerCommands-MC1.6.2_V5.0.zip
2013-07-20 11:57 - 2012-12-27 12:05 - 00000000 ____D C:\Users\Mark\AppData\Roaming\TS3Client
2013-07-17 18:55 - 2013-07-17 18:55 - 00000219 _____ C:\Users\Mark\Desktop\Team Fortress 2.url
2013-07-17 18:50 - 2013-07-17 18:50 - 00003120 _____ C:\Windows\System32\Tasks\{E81BC9DE-98DE-4E22-AB31-6DA0D5E69038}
2013-07-15 16:32 - 2010-11-21 05:47 - 00041190 _____ C:\Windows\PFRO.log
2013-07-12 19:29 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 19:29 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-12 14:59 - 2010-11-21 09:00 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 14:59 - 2009-07-14 06:45 - 00278856 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 21:33 - 2013-07-11 21:33 - 00000000 ____D C:\4c53c8961b0478fb9962882ff0
2013-07-10 18:45 - 2013-07-10 18:45 - 13292297 _____ C:\Users\Mark\Desktop\ravands-converted-1373474728787.zip
2013-07-10 18:43 - 2013-07-10 18:42 - 52460484 _____ C:\Users\Mark\Desktop\ravands.zip
2013-07-10 15:18 - 2013-07-10 15:18 - 00065935 _____ C:\Users\Mark\Desktop\X-ray.rar
2013-07-10 15:17 - 2013-07-10 15:17 - 00066494 _____ C:\Users\Mark\Downloads\X-RayMod_v042.zip
2013-07-07 14:21 - 2013-07-07 14:21 - 53942177 _____ C:\Users\Mark\Desktop\Misa500-converted-1373199671883.zip
2013-07-07 14:15 - 2013-07-07 14:15 - 02570679 _____ C:\Users\Mark\Desktop\TextureEnder.jar
2013-07-07 14:10 - 2013-07-07 14:09 - 53886249 _____ C:\Users\Mark\Desktop\Misa500.zip
2013-07-07 14:06 - 2013-07-07 14:06 - 08625354 _____ C:\Users\Mark\Desktop\willpack3.zip
2013-07-07 13:57 - 2013-07-07 13:57 - 09628376 _____ C:\Users\Mark\Desktop\Romecraft GERMANIA 14.zip
2013-07-07 12:02 - 2013-07-07 12:02 - 00484992 _____ C:\Users\Mark\Desktop\Minecraft (1).exe
2013-07-05 14:34 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-07-04 20:51 - 2013-07-04 20:51 - 00000219 _____ C:\Users\Mark\Desktop\Dota 2.url
2013-07-04 19:31 - 2013-07-04 19:03 - 00000000 ____D C:\Users\Mark\Desktop\Neuer Ordner
2013-07-04 19:30 - 2012-10-13 15:59 - 00000000 ____D C:\Users\Mark\Desktop\New Worlde
2013-07-04 18:37 - 2013-07-04 18:37 - 00000000 ____D C:\Users\Mark\Documents\default

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-02 19:00

==================== End Of Log ============================

--- --- ---

lg Atrom

schrauber · 04.08.2013, 09:38

Reste entfernen

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Atrom · 04.08.2013, 12:01

Ganz Herzlichen Dank!
funktioniert wieder alles wie vorher

Eset:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=8b8a88d9f4ab85489a643dd2c1207df9
# engine=14644
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-04 10:40:01
# local_time=2013-08-04 12:40:01 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 1962570 138209386 0 0
# compatibility_mode=5893 16776574 100 94 1962644 127242651 0 0
# scanned=216120
# found=1
# cleaned=0
# scan_time=5372
sh=5A779BC6E4899AC06ED7F72B55323D9DB0469AE6 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\59KFMAOB\base[1].htm"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.71  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Norton Internet Security   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Java(TM) 7 Update 1  
 Java version out of Date! 
````````Process Check: objlist.exe by Laurent````````  
 Norton ccSvcHst.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013
Ran by Mark (administrator) on 04-08-2013 12:59:24
Running from C:\Users\Mark\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Micro-Star Int'l Co., Ltd.) c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6412904 2011-11-03] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1157224 2011-10-20] (Realtek Semiconductor)
HKLM\...\Run: [] -  [x]
HKLM\...\Run: [Command Center Controllers] - C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12616 2011-12-15] (Alienware)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1807272 2013-07-27] (Valve Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe -update activex [814472 2013-06-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Dell Registration] - C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [241984 2011-10-20] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [203072 2011-10-20] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?gws_rd=cr
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: DealPly Shopping - {9cf699ca-2174-4ed8-bec1-ba82095edce0} - C:\Program Files (x86)\DealPly\DealPlyIE.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (DealPly  Shopping) - C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi\3.5.0.0_0
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [odnofacmifkjndflfmmplhckcbfjckhj] - C:\Program Files (x86)\LyriXeeker\125.crx

==================== Services (Whitelisted) =================

R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
R2 MSI_ODD_Service; c:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe [76800 2011-10-05] (Micro-Star Int'l Co., Ltd.)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
S2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [x]

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-09-04] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-09-04] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-02-11] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20130802.001\IDSvia64.sys [513184 2012-09-06] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20130802.001\IDSvia64.sys [513184 2012-09-06] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130803.004\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130803.004\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130803.004\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130803.004\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 NTIOLib_X64; C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [14136 2010-01-18] (MSI)
R3 NTIOLib_X64; C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [14136 2010-01-18] (MSI)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [100352 2011-09-15] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [216064 2011-09-15] (Renesas Electronics Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-04 11:07 - 2013-08-04 11:07 - 02347384 _____ (ESET) C:\Users\Mark\Downloads\esetsmartinstaller_enu.exe
2013-08-03 15:05 - 2013-08-03 15:05 - 00001424 _____ C:\Users\Mark\Desktop\JRT.txt
2013-08-03 15:02 - 2013-08-03 15:02 - 00000000 ____D C:\Windows\ERUNT
2013-08-03 15:01 - 2013-08-03 15:01 - 00560986 _____ (Oleg N. Scherbakov) C:\Users\Mark\Downloads\JRT.exe
2013-08-03 13:09 - 2013-08-03 13:09 - 00024360 _____ C:\Users\Mark\Desktop\defogger_disable.lnk
2013-08-03 12:55 - 2013-08-03 12:55 - 00038767 _____ C:\Users\Mark\Downloads\gmer.txt
2013-08-03 12:55 - 2013-08-03 12:55 - 00000498 _____ C:\Users\Mark\Desktop\gmer.lnk
2013-08-03 12:17 - 2013-08-03 12:17 - 00377856 _____ C:\Users\Mark\Downloads\gmer_2.1.19163.exe
2013-08-03 12:12 - 2013-08-03 12:12 - 00029261 _____ C:\Users\Mark\Desktop\FRST.txt
2013-08-03 12:12 - 2013-08-03 12:12 - 00017719 _____ C:\Users\Mark\Desktop\Addition.txt
2013-08-03 12:11 - 2013-08-03 12:11 - 00000000 ____D C:\FRST
2013-08-03 12:10 - 2013-08-03 12:10 - 01781485 _____ (Farbar) C:\Users\Mark\Downloads\FRST64.exe
2013-08-03 12:08 - 2013-08-03 12:08 - 00000470 _____ C:\Users\Mark\Downloads\defogger_disable.log
2013-08-03 12:08 - 2013-08-03 12:08 - 00000000 _____ C:\Users\Mark\defogger_reenable
2013-08-03 12:06 - 2013-08-03 12:06 - 00050477 _____ C:\Users\Mark\Downloads\Defogger.exe
2013-08-02 21:07 - 2013-08-02 21:07 - 00000854 _____ C:\AdwCleaner[S2].txt
2013-08-02 21:04 - 2013-08-02 21:10 - 00014519 _____ C:\Users\Mark\Desktop\dds.txt
2013-08-02 21:04 - 2013-08-02 21:10 - 00004667 _____ C:\Users\Mark\Desktop\attach.txt
2013-08-02 21:02 - 2013-08-02 21:02 - 00700783 ____R (Swearware) C:\Users\Mark\Downloads\dds+.exe
2013-08-02 21:01 - 2013-08-02 21:01 - 00655200 _____ C:\Users\Mark\Downloads\setup.exe
2013-08-02 20:56 - 2013-08-02 20:56 - 00010347 _____ C:\AdwCleaner[S1].txt
2013-08-02 20:55 - 2013-08-02 20:55 - 00666633 _____ C:\Users\Mark\Downloads\adwcleaner06.exe
2013-08-02 18:17 - 2013-08-04 12:22 - 00000902 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-08-02 18:17 - 2013-08-04 10:58 - 00000898 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2013-08-02 18:17 - 2013-08-02 18:17 - 00003898 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA
2013-08-02 18:17 - 2013-08-02 18:17 - 00003646 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
2013-08-02 18:17 - 2013-08-02 18:17 - 00003364 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-08-02 18:16 - 2013-08-04 10:58 - 00000386 _____ C:\Windows\Tasks\LyricXeeker Update.job
2013-08-02 18:16 - 2013-08-02 18:16 - 00003032 _____ C:\Windows\System32\Tasks\LyricXeeker Update
2013-08-02 18:16 - 2013-08-02 18:16 - 00000000 ____D C:\Users\Mark\AppData\Local\Google
2013-07-29 21:01 - 2013-07-29 21:01 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Trine2
2013-07-29 20:59 - 2013-07-29 20:59 - 00000222 _____ C:\Users\Mark\Desktop\F1 2012.url
2013-07-29 20:49 - 2013-06-24 00:41 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-24 17:27 - 2013-07-24 17:27 - 00000221 _____ C:\Users\Mark\Desktop\Trine 2.url
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\Users\Mark\Documents\My Games
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\ProgramData\Codemasters
2013-07-24 07:02 - 2013-07-24 07:02 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero Deleted Scenes.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000222 _____ C:\Users\Mark\Desktop\Assassin's Creed Revelations.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Global Offensive.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Saints Row The Third.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2 - Multiplayer.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Assassin's Creed II.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Source.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero.url
2013-07-24 06:58 - 2013-07-24 06:58 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike.url
2013-07-22 17:59 - 2013-07-22 17:59 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2.url
2013-07-20 12:18 - 2013-07-20 12:18 - 01001338 _____ C:\Users\Mark\Desktop\SinglePlayerCommands-MC1.6.2_V5.0.zip
2013-07-17 18:55 - 2013-07-17 18:55 - 00000219 _____ C:\Users\Mark\Desktop\Team Fortress 2.url
2013-07-17 18:50 - 2013-07-17 18:50 - 00003120 _____ C:\Windows\System32\Tasks\{E81BC9DE-98DE-4E22-AB31-6DA0D5E69038}
2013-07-12 15:06 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 15:06 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 15:06 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-12 15:05 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 15:05 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 15:05 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 15:05 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 15:05 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 15:05 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 15:05 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 15:05 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 15:05 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 15:05 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 21:33 - 2013-07-11 21:33 - 00000000 ____D C:\4c53c8961b0478fb9962882ff0
2013-07-11 16:27 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 16:27 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 16:27 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 16:27 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 16:27 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 16:26 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 16:26 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 18:45 - 2013-07-10 18:45 - 13292297 _____ C:\Users\Mark\Desktop\ravands-converted-1373474728787.zip
2013-07-10 18:42 - 2013-07-10 18:43 - 52460484 _____ C:\Users\Mark\Desktop\ravands.zip
2013-07-10 15:18 - 2013-07-10 15:18 - 00065935 _____ C:\Users\Mark\Desktop\X-ray.rar
2013-07-10 15:17 - 2013-07-10 15:17 - 00066494 _____ C:\Users\Mark\Downloads\X-RayMod_v042.zip
2013-07-07 14:21 - 2013-07-07 14:21 - 53942177 _____ C:\Users\Mark\Desktop\Misa500-converted-1373199671883.zip
2013-07-07 14:15 - 2013-07-07 14:15 - 02570679 _____ C:\Users\Mark\Desktop\TextureEnder.jar
2013-07-07 14:09 - 2013-07-07 14:10 - 53886249 _____ C:\Users\Mark\Desktop\Misa500.zip
2013-07-07 14:06 - 2013-07-07 14:06 - 08625354 _____ C:\Users\Mark\Desktop\willpack3.zip
2013-07-07 13:57 - 2013-07-07 13:57 - 09628376 _____ C:\Users\Mark\Desktop\Romecraft GERMANIA 14.zip
2013-07-07 12:02 - 2013-07-07 12:02 - 00484992 _____ C:\Users\Mark\Desktop\Minecraft (1).exe
110

==================== One Month Modified Files and Folders =======

2013-08-04 12:50 - 2013-08-04 12:50 - 00891098 _____ C:\Users\Mark\Downloads\SecurityCheck.exe
2013-08-04 12:22 - 2013-08-02 18:17 - 00000902 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-08-04 12:08 - 2012-01-23 22:25 - 01715634 _____ C:\Windows\WindowsUpdate.log
2013-08-04 12:04 - 2013-02-28 18:14 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-04 11:13 - 2013-05-22 13:59 - 00003460 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-08-04 11:09 - 2010-11-21 08:50 - 03372702 _____ C:\Windows\system32\perfh007.dat
2013-08-04 11:09 - 2010-11-21 08:50 - 00979354 _____ C:\Windows\system32\perfc007.dat
2013-08-04 11:09 - 2009-07-14 07:13 - 00006248 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-04 11:08 - 2012-08-11 13:40 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Skype
2013-08-04 11:07 - 2013-08-04 11:07 - 02347384 _____ (ESET) C:\Users\Mark\Downloads\esetsmartinstaller_enu.exe
2013-08-04 11:05 - 2009-07-14 06:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-04 11:05 - 2009-07-14 06:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-04 10:58 - 2013-08-02 18:17 - 00000898 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2013-08-04 10:58 - 2013-08-02 18:16 - 00000386 _____ C:\Windows\Tasks\LyricXeeker Update.job
2013-08-04 10:58 - 2012-09-07 15:45 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-04 10:58 - 2012-08-13 20:59 - 00000000 ____D C:\Users\Mark\AppData\Local\LogMeIn Hamachi
2013-08-04 10:57 - 2012-01-23 22:22 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-04 10:57 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-04 10:57 - 2009-07-14 06:51 - 00075708 _____ C:\Windows\setupact.log
2013-08-03 19:22 - 2013-02-18 15:09 - 00000000 ____D C:\Users\Mark\AppData\Roaming\.minecraft
2013-08-03 15:05 - 2013-08-03 15:05 - 00001424 _____ C:\Users\Mark\Desktop\JRT.txt
2013-08-03 15:02 - 2013-08-03 15:02 - 00000000 ____D C:\Windows\ERUNT
2013-08-03 15:01 - 2013-08-03 15:01 - 00560986 _____ (Oleg N. Scherbakov) C:\Users\Mark\Downloads\JRT.exe
2013-08-03 13:09 - 2013-08-03 13:09 - 00024360 _____ C:\Users\Mark\Desktop\defogger_disable.lnk
2013-08-03 12:55 - 2013-08-03 12:55 - 00038767 _____ C:\Users\Mark\Downloads\gmer.txt
2013-08-03 12:55 - 2013-08-03 12:55 - 00000498 _____ C:\Users\Mark\Desktop\gmer.lnk
2013-08-03 12:17 - 2013-08-03 12:17 - 00377856 _____ C:\Users\Mark\Downloads\gmer_2.1.19163.exe
2013-08-03 12:12 - 2013-08-03 12:12 - 00029261 _____ C:\Users\Mark\Desktop\FRST.txt
2013-08-03 12:12 - 2013-08-03 12:12 - 00017719 _____ C:\Users\Mark\Desktop\Addition.txt
2013-08-03 12:11 - 2013-08-03 12:11 - 00000000 ____D C:\FRST
2013-08-03 12:10 - 2013-08-03 12:10 - 01781485 _____ (Farbar) C:\Users\Mark\Downloads\FRST64.exe
2013-08-03 12:08 - 2013-08-03 12:08 - 00000470 _____ C:\Users\Mark\Downloads\defogger_disable.log
2013-08-03 12:08 - 2013-08-03 12:08 - 00000000 _____ C:\Users\Mark\defogger_reenable
2013-08-03 12:08 - 2012-08-11 12:57 - 00000000 ____D C:\Users\Mark
2013-08-03 12:06 - 2013-08-03 12:06 - 00050477 _____ C:\Users\Mark\Downloads\Defogger.exe
2013-08-02 21:10 - 2013-08-02 21:04 - 00014519 _____ C:\Users\Mark\Desktop\dds.txt
2013-08-02 21:10 - 2013-08-02 21:04 - 00004667 _____ C:\Users\Mark\Desktop\attach.txt
2013-08-02 21:07 - 2013-08-02 21:07 - 00000854 _____ C:\AdwCleaner[S2].txt
2013-08-02 21:02 - 2013-08-02 21:02 - 00700783 ____R (Swearware) C:\Users\Mark\Downloads\dds+.exe
2013-08-02 21:01 - 2013-08-02 21:01 - 00655200 _____ C:\Users\Mark\Downloads\setup.exe
2013-08-02 20:56 - 2013-08-02 20:56 - 00010347 _____ C:\AdwCleaner[S1].txt
2013-08-02 20:56 - 2013-06-06 16:18 - 00000995 _____ C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-02 20:55 - 2013-08-02 20:55 - 00666633 _____ C:\Users\Mark\Downloads\adwcleaner06.exe
2013-08-02 18:17 - 2013-08-02 18:17 - 00003898 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA
2013-08-02 18:17 - 2013-08-02 18:17 - 00003646 _____ C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
2013-08-02 18:17 - 2013-08-02 18:17 - 00003364 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-08-02 18:16 - 2013-08-02 18:16 - 00003032 _____ C:\Windows\System32\Tasks\LyricXeeker Update
2013-08-02 18:16 - 2013-08-02 18:16 - 00000000 ____D C:\Users\Mark\AppData\Local\Google
2013-07-29 21:01 - 2013-07-29 21:01 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Trine2
2013-07-29 21:01 - 2012-09-06 17:11 - 00257772 _____ C:\Windows\DirectX.log
2013-07-29 20:59 - 2013-07-29 20:59 - 00000222 _____ C:\Users\Mark\Desktop\F1 2012.url
2013-07-29 20:59 - 2012-09-07 16:11 - 00000000 ____D C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-07-25 13:04 - 2013-01-28 10:04 - 00000000 ____D C:\Program Files\AlienAutopsy
2013-07-25 13:04 - 2012-09-10 17:00 - 00000000 ____D C:\ProgramData\PCDr
2013-07-25 12:40 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-24 17:27 - 2013-07-24 17:27 - 00000221 _____ C:\Users\Mark\Desktop\Trine 2.url
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\Users\Mark\Documents\My Games
2013-07-24 14:22 - 2013-07-24 14:22 - 00000000 ____D C:\ProgramData\Codemasters
2013-07-24 07:02 - 2013-07-24 07:02 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero Deleted Scenes.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000222 _____ C:\Users\Mark\Desktop\Assassin's Creed Revelations.url
2013-07-24 07:01 - 2013-07-24 07:01 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Global Offensive.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Saints Row The Third.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2 - Multiplayer.url
2013-07-24 07:00 - 2013-07-24 07:00 - 00000221 _____ C:\Users\Mark\Desktop\Assassin's Creed II.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000219 _____ C:\Users\Mark\Desktop\Counter-Strike Source.url
2013-07-24 06:59 - 2013-07-24 06:59 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike Condition Zero.url
2013-07-24 06:58 - 2013-07-24 06:58 - 00000218 _____ C:\Users\Mark\Desktop\Counter-Strike.url
2013-07-22 17:59 - 2013-07-22 17:59 - 00000221 _____ C:\Users\Mark\Desktop\Call of Duty Modern Warfare 2.url
2013-07-20 12:18 - 2013-07-20 12:18 - 01001338 _____ C:\Users\Mark\Desktop\SinglePlayerCommands-MC1.6.2_V5.0.zip
2013-07-20 11:57 - 2012-12-27 12:05 - 00000000 ____D C:\Users\Mark\AppData\Roaming\TS3Client
2013-07-17 18:55 - 2013-07-17 18:55 - 00000219 _____ C:\Users\Mark\Desktop\Team Fortress 2.url
2013-07-17 18:50 - 2013-07-17 18:50 - 00003120 _____ C:\Windows\System32\Tasks\{E81BC9DE-98DE-4E22-AB31-6DA0D5E69038}
2013-07-15 16:32 - 2010-11-21 05:47 - 00041190 _____ C:\Windows\PFRO.log
2013-07-12 19:29 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 19:29 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-12 14:59 - 2010-11-21 09:00 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 14:59 - 2009-07-14 06:45 - 00278856 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 21:33 - 2013-07-11 21:33 - 00000000 ____D C:\4c53c8961b0478fb9962882ff0
2013-07-10 18:45 - 2013-07-10 18:45 - 13292297 _____ C:\Users\Mark\Desktop\ravands-converted-1373474728787.zip
2013-07-10 18:43 - 2013-07-10 18:42 - 52460484 _____ C:\Users\Mark\Desktop\ravands.zip
2013-07-10 15:18 - 2013-07-10 15:18 - 00065935 _____ C:\Users\Mark\Desktop\X-ray.rar
2013-07-10 15:17 - 2013-07-10 15:17 - 00066494 _____ C:\Users\Mark\Downloads\X-RayMod_v042.zip
2013-07-07 14:21 - 2013-07-07 14:21 - 53942177 _____ C:\Users\Mark\Desktop\Misa500-converted-1373199671883.zip
2013-07-07 14:15 - 2013-07-07 14:15 - 02570679 _____ C:\Users\Mark\Desktop\TextureEnder.jar
2013-07-07 14:10 - 2013-07-07 14:09 - 53886249 _____ C:\Users\Mark\Desktop\Misa500.zip
2013-07-07 14:06 - 2013-07-07 14:06 - 08625354 _____ C:\Users\Mark\Desktop\willpack3.zip
2013-07-07 13:57 - 2013-07-07 13:57 - 09628376 _____ C:\Users\Mark\Desktop\Romecraft GERMANIA 14.zip
2013-07-07 12:02 - 2013-07-07 12:02 - 00484992 _____ C:\Users\Mark\Desktop\Minecraft (1).exe
2013-07-05 14:34 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-02 19:00

==================== End Of Log ============================

--- --- ---

lg Atrom

schrauber · 05.08.2013, 07:12

Java updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

S2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [x]

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Atrom · 06.08.2013, 12:21

Schon mal ganz herzlichen dank für deine Hilfe, alles sehr gut, ausführlich und verständlich erklärt, top!

zu der Fixlog.txt. die wurde erstellt und ich hab sie auch abgespeichert, aber nachdem ich Delfix ausgeführt hatte war die auch verschwunden, oder ich kann sie zumindest nicht mehr finden. Was soll ich dafür machen, bzw. ist die überhaupt noch wichtig? Wenn nicht bedanke ich mich noch mal recht herzlich und du kannst mich wieder aus den Abos löschen.

lg Atrom

schrauber · 06.08.2013, 16:40

Nee die ist nit wichtig. Gern Geschehen

06.08.2013, 16:40	#8
schrauber /// the machine /// TB-Ausbilder	Windows 7 Internet Explorer Standart Seite wird auf QV06 umgeleitet Nee die ist nit wichtig. Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows 7 Internet Explorer Standart Seite wird auf QV06 umgeleitet

Log-Analyse und Auswertung: Windows 7 Internet Explorer Standart Seite wird auf QV06 umgeleitet