| |
| |||||||
Log-Analyse und Auswertung: Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.netWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
17.09.2013, 21:09
| #1 |
 |  Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net Guten Abend allerseits. Ich habe ein leider nicht unerhebliches Problem. Wie in anderen Threads schon durchgekaut, habe ich Probleme mit aggressiven Werbeeinblendungen und POPUPs. Da es aber heisst, dass man nicht blind alle Schritte in anderen Threads befolgen soll, erstelle ich hiermit einen neuen. Mein System: Ich nutze FireFox in der aktuellsten Version Windows 7 Home Premium 64bit Avira Free Antivirus Malwarebytes AntiMalware Die letzten beiden jedoch "klassischerweise" erst NACH dem Befall installiert.  (Sorry!)Alle Programme, OS, ... immer Up-to-date! Die Symptome: In FireFox werden sehr aggressive Werbungen eingeblendet und zwar in jeder freien und sogar benutzten Flächen. Diese sind oben rechts mit dem kleinen "Schliessen-X" und unten mit dem Vermerk "Ad not by this site" versehen. Zudem klappen immer wieder PopUps auf in denen die Klassiker stehen wie "Ihr System ist verseucht", "Sie sind der 1000000 Besucher", usw. Zudem klappen oft PopUps auf die Werbung von der Site "gqs.donedrive.net..." schalten. Und zu guter Letzt werden in sämtlichen Texten von Websites Wörter oder Wortgruppen unterstrichen und beim darüberfahren öffnet sich ein vermeintliches Kontext-Menü mit einer vermeintlichen "Begriffserklärung" und weiteren Links die was weiss ich nicht wohin führen (nicht ausprobiert! *g*) Ich habe Malwarebytes Anti Malware durchlaufen lassen (Quick und Vollständiger Scan), welche auch einige Fieslinge entdeckt und beseitigt hat (Log folgt weiter unten). Nachfolgender, vollständiger Scan mit Avira hat nichts ergeben (keine Infektion festgestellt). So, genug der langen Worte, ich hoffe die Infos waren kurz und präzise genug. Hier noch die erstellten Logfiles: Malwarebytes Anti Malware: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.13.11 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 CyrusMaster :: CYWARE [Administrator] 14.09.2013 01:09:18 mbam-log-2013-09-14 (01-09-18).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 247272 Laufzeit: 1 Minute(n), 8 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 10 HKCR\CLSID\{11111111-1111-1111-1111-110411151154} (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{44444444-4444-4444-4444-440444154454} (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{55555555-5555-5555-5555-550455155554} (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0041554.BHO.1 (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411151154} (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110411151154} (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0041554.BHO (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0041554.Sandbox (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0041554.Sandbox.1 (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\InstalledBrowserExtensions\Lyrics (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 13 C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-bho.dll (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-bho64.dll (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\AppData\Local\Temp\a2zLyrics_1060-8102_v122.exe (PUP.Optional.Adtool) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\AppData\Local\Temp\LLcVm3Vz.exe.part (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\AppData\Local\Temp\nsg9875.tmp (PUP.Optional.Somoto.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\AppData\Local\Temp\nslB892.tmp (PUP.Optional.Somoto.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\AppData\Local\Temp\p161s5eq.exe.part (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\Downloads\DTLite4471-0333.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\Downloads\FreeYouTubeDownload.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\Downloads\FreeYouTubeDownload_3.2.11.812.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\Downloads\FreeYouTubeToMP3Converter31212.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\Downloads\SoftonicDownloader_fuer_winrar.exe (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\CyrusMaster\Downloads\winamp564_full_emusic-7plus_all.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 03
Ran by CyrusMaster (administrator) on CYWARE on 17-09-2013 20:57:40
Running from C:\Users\CyrusMaster\Downloads\Security\trojaner-board.de
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) c:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Creative Technology Ltd) C:\Windows\sysWow64\CtHdaSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(LogMeIn Inc.) C:\Program Files (x86)\Hamachi\hamachi-2.exe
(Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(LogMeIn Inc.) C:\Program Files (x86)\Hamachi\hamachi-2-ui.exe
(Tobias Erichsen) C:\Program Files (x86)\Tobias Erichsen\rtpMIDI\rtpMIDISvc.exe
(SoftThinks SAS) C:\Program Files (x86)\AlienRespawn\sftservice.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(SoftThinks - Dell) C:\Program Files (x86)\AlienRespawn\TOASTER.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
() C:\Program Files (x86)\AlienRespawn\COMPONENTS\SCHEDULER\STSERVICE.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
() C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Creative Technology Ltd) C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
(TeamSpeak Systems GmbH) C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2890000 2012-03-16] (Synaptics Incorporated)
HKLM\...\Run: [IntelPROSet] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4756240 2012-02-26] (Intel(R) Corporation)
HKLM\...\Run: [BLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [177936 2012-02-17] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [] - [x]
HKLM\...\Run: [Command Center Controllers] - C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12656 2012-06-15] (Alienware)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [7468784 2013-02-28] (Logitech Inc.)
HKCU\...\Run: [Google Update] - C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-19] (Google Inc.)
HKCU\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3551576 2013-09-17] (Electronic Arts)
MountPoints2: {32acd219-bae5-11e2-885c-606c6623e582} - G:\HTC_Sync_Manager_PC.exe
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-17] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation)
HKLM-x32\...\Run: [AlienwareOn-ScreenDisplay] - C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe [1636208 2011-12-02] ()
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Sound Blaster Recon3Di Control Panel] - c:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe [880640 2011-12-22] (Creative Technology Ltd)
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [76872 2012-06-26] (cyberlink)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Integrated Webcam Live! Central] - C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe [577536 2013-01-08] (Creative Technology Ltd)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-15] (Avira Operations GmbH & Co. KG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.alienwarearena.com/welcome-ch-g
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.alienwarearena.com/welcome-ch-g
BHO: a2zLyrics-1 - {11111111-1111-1111-1111-110411151154} - C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-bho64.dll No File
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\CyrusMaster\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\CyrusMaster\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\536c2ac1-a17c-4de1-a3f2-1b869a3be96c@2f6608a0-8c65-4bfe-8e2f-c65b5cc757cb.com
FF Extension: Bitdefender QuickScan - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: No Name - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-15] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-15] (Avira Operations GmbH & Co. KG)
S2 CLKMSVC10_9EC60124; C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [242448 2012-06-26] (CyberLink)
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [122880 2012-03-28] (Creative Technology Ltd)
R2 Hamachi2Svc; C:\Program Files (x86)\Hamachi\hamachi-2.exe [2470736 2013-06-28] (LogMeIn Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-02] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-25] ()
R2 rtpMIDIService; C:\Program Files (x86)\Tobias Erichsen\rtpMIDI\rtpMIDISvc.exe [1142272 2012-08-24] (Tobias Erichsen)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)
S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-15] (Avira Operations GmbH & Co. KG)
R3 cthda; C:\Windows\System32\drivers\cthda.sys [1052760 2012-03-28] (Creative Technology Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-11] (DT Soft Ltd)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28216 2012-11-20] (Intel Corporation)
S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.)
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_ACCEL.sys [67184 2012-01-03] (STMicroelectronics)
R3 teVirtualMIDI64; C:\Windows\System32\DRIVERS\teVirtualMIDI64.sys [30208 2012-08-15] (Tobias Erichsen)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-17 20:57 - 2013-09-17 20:57 - 00000000 ____D C:\FRST
2013-09-17 20:56 - 2013-09-17 20:56 - 00000168 _____ C:\Users\CyrusMaster\defogger_reenable
2013-09-17 20:32 - 2013-09-17 20:32 - 98008335 _____ C:\Windows\SysWOW64\偠␃蹬—
2013-09-16 20:19 - 2013-09-16 21:49 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-09-16 20:19 - 2013-09-16 20:19 - 00003378 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-09-15 20:02 - 2013-09-15 20:02 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-15 20:02 - 2013-09-15 20:02 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Avira
2013-09-15 19:58 - 2013-09-15 19:58 - 00002064 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\ProgramData\Avira
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-15 19:57 - 2013-09-15 19:56 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-15 19:57 - 2013-09-15 19:56 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-15 19:57 - 2013-09-15 19:56 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-15 12:51 - 2013-09-15 12:51 - 00000000 ____D C:\Users\CyrusMaster\Documents\Meine empfangenen Dateien
2013-09-15 11:27 - 2013-09-15 11:27 - 00002035 _____ C:\Users\Public\Desktop\rtpMIDI.lnk
2013-09-15 11:27 - 2013-09-15 11:27 - 00000000 ____D C:\Program Files (x86)\Tobias Erichsen
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\ProgramData\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-09-14 01:05 - 2013-09-14 01:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Malwarebytes
2013-09-14 01:04 - 2013-09-17 20:54 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Security
2013-09-14 01:04 - 2013-09-14 01:04 - 00001107 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-14 01:04 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-13 19:45 - 2013-09-13 19:45 - 00003138 _____ C:\Windows\System32\Tasks\{EA9E473C-7A36-491D-88C7-8E479C24D828}
2013-09-13 17:41 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 17:41 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 17:41 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-13 17:41 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 17:41 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 17:41 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-13 17:41 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 17:41 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-13 17:41 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 17:41 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 17:41 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-13 17:41 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-13 16:50 - 2013-09-13 17:17 - 00000000 ____D C:\Users\CyrusMaster\Documents\Steuerfälle
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Information Factory
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Information Factory
2013-09-13 16:47 - 2013-09-13 16:47 - 00000000 ____D C:\Program Files (x86)\Steuer SGnP2012
2013-09-13 16:44 - 2013-09-13 16:46 - 31052352 _____ (Information Factory AG) C:\Users\CyrusMaster\Downloads\SGnP2012_installieren_windows.exe
2013-09-13 16:35 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-13 16:35 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-13 16:35 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-13 16:35 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-13 16:35 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-13 16:35 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-13 16:35 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-13 16:35 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-13 16:35 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-13 16:35 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-13 16:35 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-13 16:35 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-13 16:35 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-13 16:35 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-13 16:35 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-13 16:35 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 18:53 - 2009-10-11 21:58 - 01177600 _____ (AD) C:\Windows\SysWOW64\SYNSOEMU.DLL
2013-09-11 18:51 - 2013-09-11 18:51 - 00000000 ____D C:\ProgramData\VST3 Presets
2013-09-11 18:10 - 2013-09-11 18:10 - 00002140 _____ C:\Users\CyrusMaster\Desktop\Cubase 5.lnk
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg HALionOne
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\ProgramData\Steinberg
2013-09-11 18:09 - 2013-09-11 19:37 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Steinberg
2013-09-11 18:09 - 2013-09-11 18:52 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg Cubase 5
2013-09-11 18:09 - 2013-09-11 18:10 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-09-11 18:05 - 2013-09-17 20:31 - 00001838 _____ C:\Windows\Tasks\a2zLyrics-1-firefoxinstaller.job
2013-09-11 18:05 - 2013-09-17 20:31 - 00001302 _____ C:\Windows\Tasks\a2zLyrics-1-updater.job
2013-09-11 18:05 - 2013-09-17 20:31 - 00001206 _____ C:\Windows\Tasks\a2zLyrics-1-codedownloader.job
2013-09-11 18:05 - 2013-09-17 20:31 - 00001106 _____ C:\Windows\Tasks\a2zLyrics-1-enabler.job
2013-09-11 18:05 - 2013-09-14 02:14 - 00000000 ____D C:\Program Files (x86)\a2zLyrics-1
2013-09-11 18:05 - 2013-09-11 18:05 - 00004332 _____ C:\Windows\System32\Tasks\a2zLyrics-1-updater
2013-09-11 18:05 - 2013-09-11 18:05 - 00004236 _____ C:\Windows\System32\Tasks\a2zLyrics-1-codedownloader
2013-09-11 18:05 - 2013-09-11 18:05 - 00004136 _____ C:\Windows\System32\Tasks\a2zLyrics-1-enabler
2013-09-11 18:03 - 2013-09-11 18:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DAEMON Tools Lite
2013-09-11 18:03 - 2013-09-11 18:03 - 00283200 _____ (DT Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-09-11 18:03 - 2013-09-11 18:03 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-09-11 18:02 - 2013-09-11 18:05 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-09-10 22:43 - 2013-09-12 23:36 - 00000000 ____D C:\Users\CyrusMaster\Documents\UseNeXT
2013-09-10 22:43 - 2013-09-12 22:27 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\UseNeXT
2013-09-10 22:43 - 2013-09-10 22:43 - 00000000 ____D C:\Program Files (x86)\UseNeXT
2013-09-10 22:42 - 2013-09-10 22:43 - 05739736 _____ (Tangysoft Ltd. ) C:\Users\CyrusMaster\Downloads\UseNeXTSetup_5.53.exe
2013-09-08 15:24 - 2013-09-08 15:31 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2013-09-01 11:12 - 2013-09-01 11:20 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoft
2013-09-01 11:12 - 2013-09-01 11:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-09-01 11:12 - 2013-09-01 11:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoftIEHelpers
2013-09-01 00:28 - 2013-09-01 02:05 - 1479655542 _____ C:\Users\CyrusMaster\Downloads\The.Conjuring.WEBRip.MD.German.XviD-PsO.avi
2013-08-28 23:12 - 2013-09-15 23:20 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\vlc
2013-08-28 23:12 - 2013-08-28 23:12 - 23003252 _____ C:\Users\CyrusMaster\Downloads\vlc-2.0.8-win32.exe
2013-08-28 23:12 - 2013-08-28 23:12 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-08-28 23:07 - 2013-08-28 23:08 - 40064601 _____ C:\Users\CyrusMaster\Downloads\videorepair.zip
2013-08-28 23:00 - 2013-08-28 23:01 - 01319328 _____ (File Repair ) C:\Users\CyrusMaster\Downloads\file-repair-setup.exe
2013-08-25 16:00 - 2013-08-25 16:00 - 03820480 _____ C:\Users\CyrusMaster\Downloads\battlelog-web-plugins_2.1.7_115.exe
2013-08-23 21:26 - 2013-08-23 21:26 - 00000080 _____ C:\Users\CyrusMaster\Downloads\KeiNett_Launch.properties
2013-08-23 21:25 - 2013-08-23 21:25 - 00000000 ____D C:\Users\CyrusMaster\minecraft
2013-08-23 16:36 - 2013-08-23 16:36 - 02855296 _____ (MAGIX AG) C:\Users\CyrusMaster\Downloads\vita_solo_instruments_2_dlm.exe
2013-08-18 01:04 - 2013-08-18 01:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2013-09-17 20:57 - 2013-09-17 20:57 - 00000000 ____D C:\FRST
2013-09-17 20:56 - 2013-09-17 20:56 - 00000168 _____ C:\Users\CyrusMaster\defogger_reenable
2013-09-17 20:56 - 2013-03-19 15:10 - 00000000 ____D C:\Users\CyrusMaster
2013-09-17 20:54 - 2013-09-14 01:04 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Security
2013-09-17 20:54 - 2013-03-19 16:14 - 00000394 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-09-17 20:53 - 2013-03-23 14:00 - 00003460 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-09-17 20:53 - 2013-03-19 16:14 - 00003428 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-09-17 20:39 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-17 20:39 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-17 20:38 - 2013-03-19 16:16 - 00001144 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001UA.job
2013-09-17 20:36 - 2013-03-13 09:13 - 01634892 _____ C:\Windows\WindowsUpdate.log
2013-09-17 20:34 - 2013-03-19 17:26 - 00000000 ____D C:\Program Files (x86)\Origin
2013-09-17 20:34 - 2013-03-19 16:37 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\TS3Client
2013-09-17 20:33 - 2013-05-19 01:19 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\LogMeIn Hamachi
2013-09-17 20:32 - 2013-09-17 20:32 - 98008335 _____ C:\Windows\SysWOW64\偠␃蹬—
2013-09-17 20:32 - 2013-03-13 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-09-17 20:32 - 2013-03-13 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-09-17 20:32 - 2013-03-13 15:48 - 00000000 ____D C:\Program Files (x86)\AlienRespawn
2013-09-17 20:31 - 2013-09-11 18:05 - 00001838 _____ C:\Windows\Tasks\a2zLyrics-1-firefoxinstaller.job
2013-09-17 20:31 - 2013-09-11 18:05 - 00001302 _____ C:\Windows\Tasks\a2zLyrics-1-updater.job
2013-09-17 20:31 - 2013-09-11 18:05 - 00001206 _____ C:\Windows\Tasks\a2zLyrics-1-codedownloader.job
2013-09-17 20:31 - 2013-09-11 18:05 - 00001106 _____ C:\Windows\Tasks\a2zLyrics-1-enabler.job
2013-09-17 20:31 - 2013-03-19 16:14 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-09-17 20:31 - 2013-03-13 15:44 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-17 20:31 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-17 20:31 - 2009-07-14 06:51 - 00060218 _____ C:\Windows\setupact.log
2013-09-16 23:05 - 2013-06-19 19:18 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-16 21:49 - 2013-09-16 20:19 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-09-16 20:19 - 2013-09-16 20:19 - 00003378 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-09-16 20:19 - 2013-03-19 16:14 - 00004248 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-09-16 19:56 - 2010-11-21 05:47 - 00036772 _____ C:\Windows\PFRO.log
2013-09-15 23:20 - 2013-08-28 23:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\vlc
2013-09-15 20:02 - 2013-09-15 20:02 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-15 20:02 - 2013-09-15 20:02 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Avira
2013-09-15 19:58 - 2013-09-15 19:58 - 00002064 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\ProgramData\Avira
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-15 19:56 - 2013-09-15 19:57 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-15 19:56 - 2013-09-15 19:57 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-15 19:56 - 2013-09-15 19:57 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-15 12:51 - 2013-09-15 12:51 - 00000000 ____D C:\Users\CyrusMaster\Documents\Meine empfangenen Dateien
2013-09-15 11:27 - 2013-09-15 11:27 - 00002035 _____ C:\Users\Public\Desktop\rtpMIDI.lnk
2013-09-15 11:27 - 2013-09-15 11:27 - 00000000 ____D C:\Program Files (x86)\Tobias Erichsen
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\ProgramData\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-09-15 11:23 - 2013-05-19 01:47 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Tools
2013-09-14 09:17 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-14 08:51 - 2010-11-21 08:50 - 00723330 _____ C:\Windows\system32\perfh007.dat
2013-09-14 08:51 - 2010-11-21 08:50 - 00158332 _____ C:\Windows\system32\perfc007.dat
2013-09-14 08:51 - 2009-07-14 07:13 - 01674486 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-14 02:14 - 2013-09-11 18:05 - 00000000 ____D C:\Program Files (x86)\a2zLyrics-1
2013-09-14 01:05 - 2013-09-14 01:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00001107 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-14 00:56 - 2013-05-19 01:11 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\QuickScan
2013-09-13 23:05 - 2013-06-19 19:18 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-13 23:05 - 2013-03-13 15:19 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-13 23:05 - 2013-03-13 15:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 20:02 - 2013-03-13 15:51 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-13 20:01 - 2013-03-30 11:58 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-09-13 19:45 - 2013-09-13 19:45 - 00003138 _____ C:\Windows\System32\Tasks\{EA9E473C-7A36-491D-88C7-8E479C24D828}
2013-09-13 19:40 - 2013-03-19 22:21 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-09-13 17:46 - 2013-03-19 16:14 - 00000000 ___RD C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 17:46 - 2013-03-19 16:14 - 00000000 ___RD C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 17:45 - 2009-07-14 06:45 - 00353112 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 17:41 - 2013-08-15 23:40 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 17:39 - 2013-04-06 12:49 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-13 17:17 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\Documents\Steuerfälle
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Information Factory
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Information Factory
2013-09-13 16:47 - 2013-09-13 16:47 - 00000000 ____D C:\Program Files (x86)\Steuer SGnP2012
2013-09-13 16:46 - 2013-09-13 16:44 - 31052352 _____ (Information Factory AG) C:\Users\CyrusMaster\Downloads\SGnP2012_installieren_windows.exe
2013-09-12 23:36 - 2013-09-10 22:43 - 00000000 ____D C:\Users\CyrusMaster\Documents\UseNeXT
2013-09-12 22:27 - 2013-09-10 22:43 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\UseNeXT
2013-09-11 20:22 - 2013-03-19 16:35 - 00000000 ____D C:\Program Files (x86)\TeamSpeak 3 Client
2013-09-11 19:37 - 2013-09-11 18:09 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Steinberg
2013-09-11 18:52 - 2013-09-11 18:09 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg Cubase 5
2013-09-11 18:51 - 2013-09-11 18:51 - 00000000 ____D C:\ProgramData\VST3 Presets
2013-09-11 18:10 - 2013-09-11 18:10 - 00002140 _____ C:\Users\CyrusMaster\Desktop\Cubase 5.lnk
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg HALionOne
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\ProgramData\Steinberg
2013-09-11 18:10 - 2013-09-11 18:09 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-09-11 18:05 - 2013-09-11 18:05 - 00004332 _____ C:\Windows\System32\Tasks\a2zLyrics-1-updater
2013-09-11 18:05 - 2013-09-11 18:05 - 00004236 _____ C:\Windows\System32\Tasks\a2zLyrics-1-codedownloader
2013-09-11 18:05 - 2013-09-11 18:05 - 00004136 _____ C:\Windows\System32\Tasks\a2zLyrics-1-enabler
2013-09-11 18:05 - 2013-09-11 18:03 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DAEMON Tools Lite
2013-09-11 18:05 - 2013-09-11 18:02 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-09-11 18:03 - 2013-09-11 18:03 - 00283200 _____ (DT Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-09-11 18:03 - 2013-09-11 18:03 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-09-11 17:49 - 2013-03-19 16:16 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001Core.job
2013-09-10 22:43 - 2013-09-10 22:43 - 00000000 ____D C:\Program Files (x86)\UseNeXT
2013-09-10 22:43 - 2013-09-10 22:42 - 05739736 _____ (Tangysoft Ltd. ) C:\Users\CyrusMaster\Downloads\UseNeXTSetup_5.53.exe
2013-09-08 15:31 - 2013-09-08 15:24 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2013-09-02 22:48 - 2013-05-19 01:17 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\.minecraft
2013-09-01 21:47 - 2013-05-19 01:49 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Games
2013-09-01 21:27 - 2013-05-19 01:52 - 00000000 ____D C:\Games
2013-09-01 11:20 - 2013-09-01 11:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoft
2013-09-01 11:20 - 2013-09-01 11:12 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-09-01 11:12 - 2013-09-01 11:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoftIEHelpers
2013-09-01 02:05 - 2013-09-01 00:28 - 1479655542 _____ C:\Users\CyrusMaster\Downloads\The.Conjuring.WEBRip.MD.German.XviD-PsO.avi
2013-08-28 23:12 - 2013-08-28 23:12 - 23003252 _____ C:\Users\CyrusMaster\Downloads\vlc-2.0.8-win32.exe
2013-08-28 23:12 - 2013-08-28 23:12 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-08-28 23:08 - 2013-08-28 23:07 - 40064601 _____ C:\Users\CyrusMaster\Downloads\videorepair.zip
2013-08-28 23:01 - 2013-08-28 23:00 - 01319328 _____ (File Repair ) C:\Users\CyrusMaster\Downloads\file-repair-setup.exe
2013-08-28 22:35 - 2013-05-12 21:56 - 00005120 _____ C:\Users\CyrusMaster\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-25 23:23 - 2013-06-24 20:11 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Skype
2013-08-25 16:12 - 2013-03-19 22:23 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-08-25 16:12 - 2013-03-19 20:01 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-08-25 16:12 - 2013-03-19 20:01 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-25 16:08 - 2013-03-19 20:01 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-08-25 16:00 - 2013-08-25 16:00 - 03820480 _____ C:\Users\CyrusMaster\Downloads\battlelog-web-plugins_2.1.7_115.exe
2013-08-23 21:26 - 2013-08-23 21:26 - 00000080 _____ C:\Users\CyrusMaster\Downloads\KeiNett_Launch.properties
2013-08-23 21:25 - 2013-08-23 21:25 - 00000000 ____D C:\Users\CyrusMaster\minecraft
2013-08-23 16:36 - 2013-08-23 16:36 - 02855296 _____ (MAGIX AG) C:\Users\CyrusMaster\Downloads\vita_solo_instruments_2_dlm.exe
2013-08-20 12:43 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-19 19:15 - 2013-03-30 14:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-18 01:04 - 2013-08-18 01:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-18 00:36 - 2013-03-20 21:54 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Adobe
Some content of TEMP:
====================
C:\Users\CyrusMaster\AppData\Local\Temp\bitool.dll
C:\Users\CyrusMaster\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\CyrusMaster\AppData\Local\Temp\i4jdel0.exe
C:\Users\CyrusMaster\AppData\Local\Temp\install_flashplayer11x32au_mssd_aih.exe
C:\Users\CyrusMaster\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\CyrusMaster\AppData\Local\Temp\rdp2wm0h.dll
C:\Users\CyrusMaster\AppData\Local\Temp\SkypeSetup.exe
C:\Users\CyrusMaster\AppData\Local\Temp\sonarinst.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-13 20:21
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-09-2013 03 Ran by CyrusMaster at 2013-09-17 20:58:16 Running from C:\Users\CyrusMaster\Downloads\Security\trojaner-board.de Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= a2zLyrics-1 (x32 Version: 1.28.153.2) Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.174) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168) Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7) Advanced Audio FX Engine (x32 Version: 1.12.05) AlienAutopsy (Version: 3.1.5907.16) AlienRespawn - Support Software (x32 Version: 9.4.67) AlienRespawn (x32 Version: 9.4.67) Alienware Command Center (Version: 2.8.8.0) Alienware Command Center (x32 Version: 2.8.8.0) Alienware On-Screen Display (x32 Version: 0.32.0.2C) Apple Software Update (x32 Version: 2.1.1.116) Avira Free Antivirus (x32 Version: 13.0.0.4052) Battlefield 1942™ (x32 Version: 1.6.20.0) Battlefield 3™ (x32 Version: 1.6.0.0) Battlelog Web Plugins (x32 Version: 2.1.7) Bonjour (Version: 2.0.2.0) Bonjour-Druckdienste (Version: 2.0.2.0) Command & Conquer™ 3 Tiberium Wars and Kane's Wrath (x32 Version: 1.0.0.0) Crysis(R) (x32 Version: 1.00.0000) Crysis® 2 (x32 Version: 1.9.0.0) CyberLink PowerDVD 9.6 (x32 Version: 9.6.1.5425) DAEMON Tools Lite (x32 Version: 4.47.1.0333) Dead Island (x32) Dota 2 Test (x32) EMSC (x32 Version: 0.0.0.22C) Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.31.0) Free YouTube Download version 3.2.11.812 (x32 Version: 3.2.11.812) Free YouTube to MP3 Converter version 3.12.12.827 (x32 Version: 3.12.12.827) GameSpy Comrade (x32 Version: 1.5.0.156) Google Chrome Canary (HKCU Version: 31.0.1632.1) Integrated Webcam Live! Central (x32 Version: 2.01.18) Intel PROSet Wireless Intel(R) Management Engine Components (x32 Version: 8.0.1.1399) Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 15.1.0.0096) Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (Version: 2.1.0.0140) Intel(R) Rapid Storage Technology (x32 Version: 11.7.0.1013) Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.3.214) Intel® PROSet/Wireless WiFi-Software (Version: 15.01.0000.0830) Intel® Trusted Connect Service Client (Version: 1.23.219.2) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Left 4 Dead 2 (x32) Logitech Gaming Software (Version: 8.45.88) Logitech Gaming Software 8.45 (Version: 8.45.88) LogMeIn Hamachi (x32 Version: 2.1.0.374) MAGIX Burn routines (Version: 11.0.0.233) MAGIX Content und Soundpools (x32 Version: 1.0.0.0) MAGIX Goya burnR (MSI) (Version: 4.3.2.0) MAGIX Goya burnR (MSI) (x32 Version: 4.3.2.0) MAGIX Music Maker 2013 (Version: 19.0.0.29) MAGIX Music Maker 2013 (x32 Version: 19.0.0.29) MAGIX Music Maker 2013 Soundpools (Version: 1.0.0.0) MAGIX Music Maker 2013 Update (Version: 19.0.6.58) MAGIX Screenshare (Version: 4.3.6.1987) MAGIX Screenshare (x32 Version: 4.3.6.1987) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) MinecraftAlpha (x32) Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1) Mozilla Maintenance Service (x32 Version: 23.0.1) MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0) MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0) NVIDIA 3D Vision Controller-Treiber 311.06 (Version: 311.06) NVIDIA 3D Vision Treiber 311.06 (Version: 311.06) NVIDIA Grafiktreiber 311.06 (Version: 311.06) NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0) NVIDIA Install Application (Version: 2.1002.108.688) NVIDIA PhysX (x32 Version: 9.12.1031) NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106) NVIDIA Systemsteuerung 311.06 (Version: 311.06) NVIDIA Update 1.11.3 (Version: 1.11.3) NVIDIA Update Components (Version: 1.11.3) Origin (x32 Version: 9.1.13.85) PhoenixRC (x32 Version: 4.0.10) PunkBuster Services (x32 Version: 0.986) rtpMIDI (x32 Version: 1.0.9.225) Skype™ 5.8 (x32 Version: 5.8.158) Sound Blaster Recon3Di (x32 Version: 1.00.08) Sound Blaster Recon3Di Extras (x32 Version: 1.0) ST Microelectronics 3 Axis Digital Accelerometer Solution (x32 Version: 4.12.0018) Steam (x32 Version: 1.0.0.0) Steinberg Cubase 5 (x32 Version: 5.1.0) Steinberg Drum Loop Expansion 01 (x32 Version: 1.0.0.1) Steinberg Groove Agent ONE Content (x32 Version: 1.0.0.003) Steinberg HALionOne (x32 Version: 1.1.0.457) Steinberg HALionOne Additional Content Set 01 (x32 Version: 1.0.0.001) Steinberg HALionOne Expression Set (x32 Version: 1.0.1.0) Steinberg HALionOne GM Drum Set (x32 Version: 1.0.1.457) Steinberg HALionOne GM Set (x32 Version: 1.0.1.457) Steinberg HALionOne Pro Set (x32 Version: 1.0.1.457) Steinberg HALionOne Studio Drum Set (x32 Version: 1.0.1.457) Steinberg HALionOne Studio Set (x32 Version: 1.0.1.457) Steinberg LoopMash Content (x32 Version: 1.0.0.005) Steinberg REVerence Content 01 (x32 Version: 1.0.0.006) Steuer 2012 13.0.3 (x32 Version: 13.0.3) Streamripper (Remove only) (x32) Synaptics Pointing Device Driver (Version: 16.0.4.0) TeamSpeak 3 Client (x32 Version: 3.0.12) TeamViewer 8 (x32 Version: 8.0.20935) Text-To-Speech-Runtime (x32 Version: 1.0.0.0) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) UseNeXT by Tangysoft (x32) Vita 2 (Version: 1.0.0.0) Vita Rock Drums (Version: 1.0.0.0) Vita String Ensemble (Version: 1.0.0.0) VLC media player 2.0.8 (x32 Version: 2.0.8) Winamp (x32 Version: 5.64 ) Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1) WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0) WinRAR 4.20 (64-Bit) (Version: 4.20.0) ==================== Restore Points ========================= 13-09-2013 15:38:47 Windows Update 13-09-2013 17:40:21 Removed MAGIX Burn routines 15-09-2013 09:26:13 Installed Bonjour Print Services 15-09-2013 09:26:52 Installed rtpMIDI ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started Task: {0515056F-8DAD-49A6-8E77-BC82FF59822D} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\AlienAutopsy\pcdrcui.exe [2011-12-14] (PC-Doctor, Inc.) Task: {05B9C2B3-B156-43BD-A8A1-FC1EED0932D0} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\AlienAutopsy\uaclauncher.exe [2011-12-14] (PC-Doctor, Inc.) Task: {0F107A7E-6A9F-4CD7-94EB-B9BE740D96BE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001UA => C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-19] (Google Inc.) Task: {219C135A-DBB9-4401-B13B-BD3B6AFD795C} - System32\Tasks\a2zLyrics-1-enabler => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-enabler.exe Task: {325077C2-97C3-4C30-86DD-C355D3217308} - System32\Tasks\a2zLyrics-1-updater => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-updater.exe Task: {365653E2-0A99-41DC-BE2F-8E5C794BC415} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2008-07-30] (Apple Inc.) Task: {3C8B4F65-AB3D-4D7A-8192-EFD8EC31CE8F} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation) Task: {4493BB8B-FD74-4F44-90D8-55FB3DF419A3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-13] (Adobe Systems Incorporated) Task: {59BE6C7F-0487-45E1-8BB3-9423E0D5D9FD} - System32\Tasks\PCDEventLauncher => C:\Program Files\AlienAutopsy\sessionchecker.exe [2011-12-14] (PC-Doctor, Inc.) Task: {6F19E76F-5CAC-442D-AB5D-F9C9E4E44016} - System32\Tasks\a2zLyrics-1-firefoxinstaller => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-firefoxinstaller.exe Task: {76B9DF51-C718-40FB-8C01-F00CADAB5408} - System32\Tasks\PCDoctorBackgroundMonitorTask-Delay => C:\Program Files\AlienAutopsy\uaclauncher.exe [2011-12-14] (PC-Doctor, Inc.) Task: {B7E526F5-2373-49BC-899D-86293CEB864F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001Core => C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-19] (Google Inc.) Task: {C0CA5056-549A-4EDF-915F-A50083EE9863} - System32\Tasks\a2zLyrics-1-codedownloader => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-codedownloader.exe Task: C:\Windows\Tasks\a2zLyrics-1-codedownloader.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-codedownloader.exe Task: C:\Windows\Tasks\a2zLyrics-1-enabler.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-enabler.exe Task: C:\Windows\Tasks\a2zLyrics-1-firefoxinstaller.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-firefoxinstaller.exe Task: C:\Windows\Tasks\a2zLyrics-1-updater.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-updater.exe Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001Core.job => C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001UA.job => C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job => C:\Program Files\AlienAutopsy\uaclauncher.exe Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\AlienAutopsy\uaclauncher.exe Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\AlienAutopsy\pcdrcui.exe ==================== Loaded Modules (whitelisted) ============= 2013-03-13 15:43 - 2013-01-19 09:03 - 15053264 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2013-03-13 15:44 - 2013-01-18 17:00 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2013-03-13 17:59 - 2012-03-16 06:12 - 00727312 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll 2013-03-13 17:59 - 2012-03-16 06:12 - 00229648 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll 2013-03-13 17:59 - 2012-03-16 06:12 - 00060688 _____ (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll 2012-02-26 11:19 - 2012-02-26 11:19 - 00168448 _____ (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\PsRegApi.dll 2012-02-26 11:52 - 2012-02-26 11:52 - 00190464 _____ (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\LangResources\DEU\FrWrkDEU.dll 2012-02-26 11:33 - 2012-02-26 11:33 - 05613056 _____ (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\FrameworkPlugins\ConnMgr.dll 2012-02-26 11:54 - 2012-02-26 11:54 - 00676352 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\LangResources\DEU\IntWADEU.dll 2012-02-26 11:20 - 2012-02-26 11:20 - 00284160 _____ (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\TraceAPI.DLL 2012-02-26 11:26 - 2012-02-26 11:26 - 00545792 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\MurocApi.dll 2012-02-26 11:22 - 2012-02-26 11:22 - 00104448 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\IntStngs.dll 2012-02-26 11:18 - 2012-02-26 11:18 - 00020992 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\S24MUDLL.dll 2012-02-26 11:24 - 2012-02-26 11:24 - 01051136 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\PfMgrApi.dll 2012-02-26 11:18 - 2012-02-26 11:18 - 00102400 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\DbEngine.dll 2013-03-13 15:40 - 2013-03-13 15:40 - 00099184 _____ (Alienware) C:\Windows\Microsoft.Net\assembly\GAC_MSIL\AlienLabsTools\v4.0_2.8.8.0__bebb3c8816410241\AlienLabsTools.dll 2013-03-13 15:40 - 2013-03-13 15:40 - 00013168 _____ (Alienware) C:\Windows\Microsoft.Net\assembly\GAC_MSIL\AlienLabs.CommandCenter.RemotingService\v4.0_2.8.8.0__bebb3c8816410241\AlienLabs.CommandCenter.RemotingService.dll 2013-03-13 15:40 - 2013-03-13 15:40 - 00019824 _____ (Alienware) C:\Windows\Microsoft.Net\assembly\GAC_MSIL\AlienLabs.CommandCenter.RemotingService.Domain\v4.0_2.8.8.0__bebb3c8816410241\AlienLabs.CommandCenter.RemotingService.Domain.dll 2013-03-13 15:40 - 2013-03-13 15:40 - 00076144 _____ (Alienware) C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Alienlabs.CommandCenter.Tools\v4.0_2.8.8.0__bebb3c8816410241\Alienlabs.CommandCenter.Tools.dll 2013-03-13 15:43 - 2013-01-19 09:03 - 26929440 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.DLL 2013-08-09 18:42 - 2013-09-12 10:31 - 00362336 _____ (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Resource_de.dll 2013-05-19 01:43 - 2013-09-12 10:31 - 03031904 _____ (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_StaticRes.dll 2013-05-19 01:43 - 2013-09-12 10:22 - 00095584 _____ (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.dll 2009-12-18 18:07 - 2009-12-18 18:07 - 00577536 _____ () C:\Program Files (x86)\Alienware On-Screen Display\EMSC.dll 2010-04-02 21:12 - 2010-04-02 21:12 - 00217088 _____ (TODO: <Company name>) C:\Program Files (x86)\Alienware On-Screen Display\VistaLaterAPI.dll 2009-12-18 18:07 - 2009-12-18 18:07 - 00200704 _____ (Dell) C:\Program Files (x86)\Alienware On-Screen Display\CCBiosSupportAPI.dll 2011-09-17 04:04 - 2011-09-17 04:04 - 00238080 _____ (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTLoadRs.dll 2011-12-23 02:31 - 2011-12-23 02:31 - 00593920 _____ () C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\de-DE\SBRcni.resources.dll 2011-11-10 04:49 - 2011-11-10 04:49 - 00036864 _____ ( ) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\Interop.CTSndCr.dll 2011-10-21 02:54 - 2011-10-21 02:54 - 00249344 _____ (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\HKDetect.dll 2011-12-01 18:57 - 2011-12-01 18:57 - 00526848 _____ (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTAudEp.dll 2013-03-21 19:03 - 2011-10-18 20:08 - 00238080 ____N (Creative Technology Ltd) C:\Program Files (x86)\Integrated Webcam\Live! Central\CTLoadRs.dll 2013-03-21 19:03 - 2013-01-08 13:19 - 00055808 ____N (Creative Technology Ltd.) C:\Program Files (x86)\Integrated Webcam\Live! Central\CtPinMgr.dll 2012-01-10 06:27 - 2012-01-10 06:27 - 00064000 _____ (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTGetPdt.dll 2013-03-13 15:47 - 2012-03-28 04:52 - 00470016 _____ (Creative Technology Ltd) C:\Windows\SysWOW64\CtHdaCtl.dll 2013-02-27 17:15 - 2013-09-11 20:22 - 00230376 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\soundbackends\directsound_win32.dll 2013-02-27 17:15 - 2013-09-11 20:22 - 00237032 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win32.dll 2013-02-27 17:15 - 2013-09-11 20:22 - 00159208 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\plugins\appscanner_plugin.dll 2013-02-27 17:15 - 2013-09-11 20:22 - 00431080 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\plugins\clientquery_plugin.dll 2013-09-11 20:22 - 2013-09-11 20:22 - 00555496 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\plugins\teamspeak_control_plugin.dll 2010-11-21 05:24 - 2010-11-21 05:24 - 01435648 _____ (Microsoft Corporation) C:\Windows\System32\Speech\Common\sapi.dll 2013-08-18 10:13 - 2013-08-18 10:13 - 00361472 _____ (Intel Corporation) C:\Windows\assembly\NativeImages_v4.0.30319_32\IAStorUtil\f8ad6e2c79b5b7efa9117bf8bbc915c5\IAStorUtil.ni.dll 2013-07-12 09:04 - 2013-07-12 09:04 - 00026112 _____ (Intel Corp.) C:\Windows\assembly\NativeImages_v4.0.30319_32\IAStorCommon\45793e8a32d2bc1d655c276ec387212c\IAStorCommon.ni.dll 2013-08-18 01:04 - 2013-08-18 01:04 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2013-09-11 18:05 - 2013-09-11 18:05 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ==================== Alternate Data Streams (whitelisted) ========== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (09/17/2013 08:53:17 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: pcdrsysinfocsmi.p5x, Version: 6.0.5907.16, Zeitstempel: 0x4ee78569 Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.4940, Zeitstempel: 0x4ca2e32e Ausnahmecode: 0x40000015 Fehleroffset: 0x000000000004267f ID des fehlerhaften Prozesses: 0x167c Startzeit der fehlerhaften Anwendung: 0xpcdrsysinfocsmi.p5x0 Pfad der fehlerhaften Anwendung: pcdrsysinfocsmi.p5x1 Pfad des fehlerhaften Moduls: pcdrsysinfocsmi.p5x2 Berichtskennung: pcdrsysinfocsmi.p5x3 Error: (09/17/2013 08:32:06 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/16/2013 08:21:11 PM) (Source: Application Hang) (User: ) Description: Programm Cubase5.exe, Version 5.1.0.105 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 18cc Startzeit: 01ceb30692d46e21 Endzeit: 15 Anwendungspfad: C:\Program Files (x86)\Steinberg\Cubase 5\Cubase5.exe Berichts-ID: 82bb5665-1efc-11e3-baf2-606c6623e582 Error: (09/16/2013 08:14:13 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: pcdrsysinfocsmi.p5x, Version: 6.0.5907.16, Zeitstempel: 0x4ee78569 Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.4940, Zeitstempel: 0x4ca2e32e Ausnahmecode: 0x40000015 Fehleroffset: 0x000000000004267f ID des fehlerhaften Prozesses: 0x1754 Startzeit der fehlerhaften Anwendung: 0xpcdrsysinfocsmi.p5x0 Pfad der fehlerhaften Anwendung: pcdrsysinfocsmi.p5x1 Pfad des fehlerhaften Moduls: pcdrsysinfocsmi.p5x2 Berichtskennung: pcdrsysinfocsmi.p5x3 Error: (09/16/2013 07:57:39 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/15/2013 07:36:42 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 4009 Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 4009 Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (09/15/2013 03:06:35 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 2995 System errors: ============= Error: (09/15/2013 03:06:31 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AudioEndpointBuilder erreicht. Error: (09/15/2013 01:56:01 PM) (Source: Service Control Manager) (User: ) Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (09/15/2013 10:51:50 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet: %%-2147196306 Error: (09/13/2013 09:13:34 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet: %%-2147196306 Error: (08/29/2013 08:47:44 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet: %%-2147196306 Error: (08/27/2013 08:56:53 PM) (Source: Service Control Manager) (User: ) Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (08/25/2013 07:00:24 PM) (Source: bowser) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "KÖNIG-PC", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{36B6953D-B726-416E-9BF3-F3F383EA36F9}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (08/23/2013 09:19:33 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Sound Core3D Service" ist vom Dienst "Sound Core3D(CtHda.sys)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (08/23/2013 09:19:33 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Sound Core3D(CtHda.sys)" wurde aufgrund folgenden Fehlers nicht gestartet: %%1058 Error: (08/23/2013 09:02:38 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht. Microsoft Office Sessions: ========================= Error: (09/17/2013 08:53:17 PM) (Source: Application Error)(User: ) Description: pcdrsysinfocsmi.p5x6.0.5907.164ee78569MSVCR90.dll9.0.30729.49404ca2e32e40000015000000000004267f167c01ceb3d729bd749bC:\Program Files\AlienAutopsy\pcdrsysinfocsmi.p5xC:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll694ba772-1fca-11e3-b571-606c6623e582 Error: (09/17/2013 08:32:06 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/16/2013 08:21:11 PM) (Source: Application Hang)(User: ) Description: Cubase5.exe5.1.0.10518cc01ceb30692d46e2115C:\Program Files (x86)\Steinberg\Cubase 5\Cubase5.exe82bb5665-1efc-11e3-baf2-606c6623e582 Error: (09/16/2013 08:14:13 PM) (Source: Application Error)(User: ) Description: pcdrsysinfocsmi.p5x6.0.5907.164ee78569MSVCR90.dll9.0.30729.49404ca2e32e40000015000000000004267f175401ceb3088a5cdccaC:\Program Files\AlienAutopsy\pcdrsysinfocsmi.p5xC:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllca3427a2-1efb-11e3-baf2-606c6623e582 Error: (09/16/2013 07:57:39 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/15/2013 07:36:42 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 4009 Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 4009 Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (09/15/2013 03:06:35 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 2995 ==================== Memory info =========================== Percentage of memory in use: 22% Total physical RAM: 12238.31 MB Available physical RAM: 9461.76 MB Total Pagefile: 24474.81 MB Available Pagefile: 21178.91 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:456.98 GB) (Free:247.86 GB) NTFS Drive d: (DATAPART1) (Fixed) (Total:29.81 GB) (Free:15.41 GB) NTFS Drive e: (HOBBIT_PART1) (CDROM) (Total:38.71 GB) (Free:0 GB) UDF ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: D6A2CF77) Partition 1: (Not Active) - (Size=39 MB) - (Type=DE) Partition 2: (Active) - (Size=9 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=457 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 30 GB) (Disk ID: D6A2C3F3) Partition 1: (Not Active) - (Size=30 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-17 21:20:41
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000079 ATA_____ rev.DEM1 465.76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\CYRUSM~1\AppData\Local\Temp\uwldqpow.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000071af1a22 2 bytes [AF, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000071af1ad0 2 bytes [AF, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000071af1b08 2 bytes [AF, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000071af1bba 2 bytes [AF, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000071af1bda 2 bytes [AF, 71]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759b1465 2 bytes [9B, 75]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759b14bb 2 bytes [9B, 75]
.text ... * 2
.text C:\Program Files (x86)\AlienRespawn\sftservice.EXE[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759b1465 2 bytes [9B, 75]
.text C:\Program Files (x86)\AlienRespawn\sftservice.EXE[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759b14bb 2 bytes [9B, 75]
.text ... * 2
.text C:\Program Files (x86)\AlienRespawn\TOASTER.EXE[2872] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759b1465 2 bytes [9B, 75]
.text C:\Program Files (x86)\AlienRespawn\TOASTER.EXE[2872] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759b14bb 2 bytes [9B, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759b1465 2 bytes [9B, 75]
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759b14bb 2 bytes [9B, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3704] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759b1465 2 bytes [9B, 75]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3704] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759b14bb 2 bytes [9B, 75]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6536] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759b1465 2 bytes [9B, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6536] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759b14bb 2 bytes [9B, 75]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{476981B4-465E-4BAD-88A6-45BFF31178C9}\Connection@Name isatap.{BABB2170-0770-4718-B3E0-96AF5DE5D263}
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}\Connection@Name isatap.{EBA8E956-5B75-4004-947A-7E0ED45A6888}
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{F7921434-4A93-414E-B5A1-3D1AE25A7861}?\Device\{4DCBAB5A-7E96-45F1-A702-C4061B9902FF}?\Device\{90B264F9-62A3-4E32-9022-F40BC78F6F7A}?\Device\{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}?\Device\{476981B4-465E-4BAD-88A6-45BFF31178C9}?\Device\{4F8AE80C-60DF-4A0E-A1B1-E1D7572D5552}?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{F7921434-4A93-414E-B5A1-3D1AE25A7861}"?"{4DCBAB5A-7E96-45F1-A702-C4061B9902FF}"?"{90B264F9-62A3-4E32-9022-F40BC78F6F7A}"?"{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}"?"{476981B4-465E-4BAD-88A6-45BFF31178C9}"?"{4F8AE80C-60DF-4A0E-A1B1-E1D7572D5552}"?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{F7921434-4A93-414E-B5A1-3D1AE25A7861}?\Device\TCPIP6TUNNEL_{4DCBAB5A-7E96-45F1-A702-C4061B9902FF}?\Device\TCPIP6TUNNEL_{90B264F9-62A3-4E32-9022-F40BC78F6F7A}?\Device\TCPIP6TUNNEL_{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}?\Device\TCPIP6TUNNEL_{476981B4-465E-4BAD-88A6-45BFF31178C9}?\Device\TCPIP6TUNNEL_{4F8AE80C-60DF-4A0E-A1B1-E1D7572D5552}?
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\606c6623e582
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\606c6623e582@8c77125caffd 0x42 0xF4 0x3F 0x35 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{476981B4-465E-4BAD-88A6-45BFF31178C9}@InterfaceName isatap.{BABB2170-0770-4718-B3E0-96AF5DE5D263}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{476981B4-465E-4BAD-88A6-45BFF31178C9}@ReusableType 0
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}@InterfaceName isatap.{EBA8E956-5B75-4004-947A-7E0ED45A6888}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}@ReusableType 0
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\606c6623e582 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\606c6623e582@8c77125caffd 0x42 0xF4 0x3F 0x35 ...
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\CyrusMaster\Downloads\Games\Minecraft-crack-1.0.0\Minecraft Cracken\Deadly\xb4s Minecraft Alpha Custom Installer.exe 1
---- EOF - GMER 2.1 ----
Ich bedanke mich im Voraus herzlichst für die Hilfe und verbleibe indessen mit freundlichen Grüssen Sandro |
|
17.09.2013, 21:21
| #2 |
| /// the machine /// TB-Ausbilder    | Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net hi,
__________________Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
17.09.2013, 22:04
| #3 |
| | Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net Herzlichen Dank für die schnelle Unterstützung @ Schrauber.
__________________Ohne jetzt noch lange Bauchpinseln zu wollen, trotzdem ein hochachtungsvolles "Respekt" an Dich. Habe einige Deiner Aktivitäten hier im Forum verfolgt.. Einfach nur nice.  Also, hier die LOGs: AdwCleaner hat 2 Logs erstellt. Beim Scan musste ich wegen einem "fehlerhaften Modul", das entfernt werden soll, neu starten. Gesagt, getan. AdwCleanerR0: Code:
ATTFilter # AdwCleaner v3.004 - Bericht erstellt am 17/09/2013 um 22:40:17
# Updated 15/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : CyrusMaster - CYWARE
# Gestartet von : C:\Users\CyrusMaster\Downloads\Security\trojaner-board.de\Cleaner\adwcleaner.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gefunden C:\ProgramData\simplitec
Ordner Gefunden C:\Users\CyrusMaster\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden C:\Users\CyrusMaster\AppData\Roaming\simplitec
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gefunden : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : [x64] HKCU\Software\InstalledBrowserExtensions
Schlüssel Gefunden : [x64] HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\prefs.js ]
Zeile gefunden : user_pref("extensions.crossrider.bic", "14113c0c1434dc07d92ffed0aa30bb46");
*************************
AdwCleaner[R0].txt - [2380 octets] - [17/09/2013 22:40:17]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [2440 octets] ##########
Code:
ATTFilter # AdwCleaner v3.004 - Bericht erstellt am 17/09/2013 um 22:41:16
# Updated 15/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : CyrusMaster - CYWARE
# Gestartet von : C:\Users\CyrusMaster\Downloads\Security\trojaner-board.de\Cleaner\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\simplitec
Ordner Gelöscht : C:\Users\CyrusMaster\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\CyrusMaster\AppData\Roaming\simplitec
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.crossrider.bic", "14113c0c1434dc07d92ffed0aa30bb46");
*************************
AdwCleaner[R0].txt - [2536 octets] - [17/09/2013 22:40:17]
AdwCleaner[S0].txt - [2335 octets] - [17/09/2013 22:41:16]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2395 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.1 (09.15.2013:1)
OS: Windows 7 Home Premium x64
Ran by CyrusMaster on 17.09.2013 at 22:51:15.77
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110411151154}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422152254}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{55555555-5555-5555-5555-550455155554}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466156654}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{22222222-2222-2222-2222-220422152254}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660466156654}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{55555555-5555-5555-5555-550455155554}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660466156654}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660466156654}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411151154}
~~~ Files
Successfully deleted: [File] C:\Windows\Tasks\a2zLyrics-1-codedownloader.job
Successfully deleted: [File] C:\Windows\Tasks\a2zLyrics-1-enabler.job
Successfully deleted: [File] C:\Windows\Tasks\a2zLyrics-1-firefoxinstaller.job
Successfully deleted: [File] C:\Windows\Tasks\a2zLyrics-1-updater.job
~~~ Folders
Successfully deleted: [Folder] "C:\Program Files (x86)\a2zlyrics-1"
~~~ FireFox
Emptied folder: C:\Users\CyrusMaster\AppData\Roaming\mozilla\firefox\profiles\acqrr591.default\minidumps [88 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 17.09.2013 at 22:52:37.34
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 03
Ran by CyrusMaster (administrator) on CYWARE on 17-09-2013 22:53:13
Running from C:\Users\CyrusMaster\Downloads\Security\trojaner-board.de\Scanner
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) c:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Creative Technology Ltd) C:\Windows\sysWow64\CtHdaSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(LogMeIn Inc.) C:\Program Files (x86)\Hamachi\hamachi-2.exe
(Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Tobias Erichsen) C:\Program Files (x86)\Tobias Erichsen\rtpMIDI\rtpMIDISvc.exe
(SoftThinks SAS) C:\Program Files (x86)\AlienRespawn\sftservice.EXE
(LogMeIn Inc.) C:\Program Files (x86)\Hamachi\hamachi-2-ui.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(SoftThinks - Dell) C:\Program Files (x86)\AlienRespawn\TOASTER.EXE
() C:\Program Files (x86)\AlienRespawn\COMPONENTS\SCHEDULER\STSERVICE.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
() C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Creative Technology Ltd) C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
(Microsoft Corporation) C:\Windows\system32\cmd.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2890000 2012-03-16] (Synaptics Incorporated)
HKLM\...\Run: [IntelPROSet] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4756240 2012-02-26] (Intel(R) Corporation)
HKLM\...\Run: [BLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [177936 2012-02-17] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [] - [x]
HKLM\...\Run: [Command Center Controllers] - C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12656 2012-06-15] (Alienware)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [7468784 2013-02-28] (Logitech Inc.)
HKCU\...\Run: [Google Update] - C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-19] (Google Inc.)
HKCU\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3551576 2013-09-17] (Electronic Arts)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
MountPoints2: {32acd219-bae5-11e2-885c-606c6623e582} - G:\HTC_Sync_Manager_PC.exe
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-17] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation)
HKLM-x32\...\Run: [AlienwareOn-ScreenDisplay] - C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe [1636208 2011-12-02] ()
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Sound Blaster Recon3Di Control Panel] - c:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe [880640 2011-12-22] (Creative Technology Ltd)
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [76872 2012-06-26] (cyberlink)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Integrated Webcam Live! Central] - C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe [577536 2013-01-08] (Creative Technology Ltd)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-15] (Avira Operations GmbH & Co. KG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.alienwarearena.com/welcome-ch-g
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.alienwarearena.com/welcome-ch-g
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\CyrusMaster\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\CyrusMaster\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\536c2ac1-a17c-4de1-a3f2-1b869a3be96c@2f6608a0-8c65-4bfe-8e2f-c65b5cc757cb.com
FF Extension: Bitdefender QuickScan - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-15] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-15] (Avira Operations GmbH & Co. KG)
S2 CLKMSVC10_9EC60124; C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [242448 2012-06-26] (CyberLink)
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [122880 2012-03-28] (Creative Technology Ltd)
R2 Hamachi2Svc; C:\Program Files (x86)\Hamachi\hamachi-2.exe [2470736 2013-06-28] (LogMeIn Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-02] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-25] ()
R2 rtpMIDIService; C:\Program Files (x86)\Tobias Erichsen\rtpMIDI\rtpMIDISvc.exe [1142272 2012-08-24] (Tobias Erichsen)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)
S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-15] (Avira Operations GmbH & Co. KG)
R3 cthda; C:\Windows\System32\drivers\cthda.sys [1052760 2012-03-28] (Creative Technology Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-11] (DT Soft Ltd)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28216 2012-11-20] (Intel Corporation)
S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.)
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_ACCEL.sys [67184 2012-01-03] (STMicroelectronics)
R3 teVirtualMIDI64; C:\Windows\System32\DRIVERS\teVirtualMIDI64.sys [30208 2012-08-15] (Tobias Erichsen)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-17 22:52 - 2013-09-17 22:52 - 00002362 _____ C:\Users\CyrusMaster\Desktop\JRT.txt
2013-09-17 22:46 - 2013-09-17 22:46 - 00000000 ____D C:\Windows\ERUNT
2013-09-17 22:40 - 2013-09-17 22:41 - 00000000 ____D C:\AdwCleaner
2013-09-17 21:55 - 2013-09-17 21:55 - 00000000 _____ C:\Users\CyrusMaster\Desktop\Neues Textdokument.txt
2013-09-17 20:57 - 2013-09-17 20:57 - 00000000 ____D C:\FRST
2013-09-16 20:19 - 2013-09-16 21:49 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-09-16 20:19 - 2013-09-16 20:19 - 00003378 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-09-15 20:02 - 2013-09-15 20:02 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-15 20:02 - 2013-09-15 20:02 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Avira
2013-09-15 19:58 - 2013-09-15 19:58 - 00002064 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\ProgramData\Avira
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-15 19:57 - 2013-09-15 19:56 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-15 19:57 - 2013-09-15 19:56 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-15 19:57 - 2013-09-15 19:56 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-15 12:51 - 2013-09-15 12:51 - 00000000 ____D C:\Users\CyrusMaster\Documents\Meine empfangenen Dateien
2013-09-15 11:27 - 2013-09-15 11:27 - 00002035 _____ C:\Users\Public\Desktop\rtpMIDI.lnk
2013-09-15 11:27 - 2013-09-15 11:27 - 00000000 ____D C:\Program Files (x86)\Tobias Erichsen
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\ProgramData\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-09-14 01:05 - 2013-09-14 01:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Malwarebytes
2013-09-14 01:04 - 2013-09-17 20:54 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Security
2013-09-14 01:04 - 2013-09-14 01:04 - 00001107 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-14 01:04 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-13 19:45 - 2013-09-13 19:45 - 00003138 _____ C:\Windows\System32\Tasks\{EA9E473C-7A36-491D-88C7-8E479C24D828}
2013-09-13 17:41 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 17:41 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 17:41 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-13 17:41 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 17:41 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 17:41 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-13 17:41 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 17:41 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-13 17:41 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 17:41 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 17:41 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-13 17:41 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-13 16:50 - 2013-09-13 17:17 - 00000000 ____D C:\Users\CyrusMaster\Documents\Steuerfälle
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Information Factory
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Information Factory
2013-09-13 16:47 - 2013-09-13 16:47 - 00000000 ____D C:\Program Files (x86)\Steuer SGnP2012
2013-09-13 16:44 - 2013-09-13 16:46 - 31052352 _____ (Information Factory AG) C:\Users\CyrusMaster\Downloads\SGnP2012_installieren_windows.exe
2013-09-13 16:35 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-13 16:35 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-13 16:35 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-13 16:35 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-13 16:35 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-13 16:35 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-13 16:35 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-13 16:35 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-13 16:35 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-13 16:35 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-13 16:35 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-13 16:35 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-13 16:35 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-13 16:35 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-13 16:35 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-13 16:35 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 18:53 - 2009-10-11 21:58 - 01177600 _____ (AD) C:\Windows\SysWOW64\SYNSOEMU.DLL
2013-09-11 18:51 - 2013-09-11 18:51 - 00000000 ____D C:\ProgramData\VST3 Presets
2013-09-11 18:10 - 2013-09-11 18:10 - 00002140 _____ C:\Users\CyrusMaster\Desktop\Cubase 5.lnk
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg HALionOne
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\ProgramData\Steinberg
2013-09-11 18:09 - 2013-09-11 19:37 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Steinberg
2013-09-11 18:09 - 2013-09-11 18:52 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg Cubase 5
2013-09-11 18:09 - 2013-09-11 18:10 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-09-11 18:03 - 2013-09-11 18:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DAEMON Tools Lite
2013-09-11 18:03 - 2013-09-11 18:03 - 00283200 _____ (DT Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-09-11 18:03 - 2013-09-11 18:03 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-09-11 18:02 - 2013-09-11 18:05 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-09-10 22:43 - 2013-09-12 23:36 - 00000000 ____D C:\Users\CyrusMaster\Documents\UseNeXT
2013-09-10 22:43 - 2013-09-12 22:27 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\UseNeXT
2013-09-10 22:43 - 2013-09-10 22:43 - 00000000 ____D C:\Program Files (x86)\UseNeXT
2013-09-10 22:42 - 2013-09-10 22:43 - 05739736 _____ (Tangysoft Ltd. ) C:\Users\CyrusMaster\Downloads\UseNeXTSetup_5.53.exe
2013-09-08 15:24 - 2013-09-08 15:31 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2013-09-01 11:12 - 2013-09-01 11:20 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoft
2013-09-01 11:12 - 2013-09-01 11:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-09-01 00:28 - 2013-09-01 02:05 - 1479655542 _____ C:\Users\CyrusMaster\Downloads\The.Conjuring.WEBRip.MD.German.XviD-PsO.avi
2013-08-28 23:12 - 2013-09-15 23:20 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\vlc
2013-08-28 23:12 - 2013-08-28 23:12 - 23003252 _____ C:\Users\CyrusMaster\Downloads\vlc-2.0.8-win32.exe
2013-08-28 23:12 - 2013-08-28 23:12 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-08-28 23:07 - 2013-08-28 23:08 - 40064601 _____ C:\Users\CyrusMaster\Downloads\videorepair.zip
2013-08-28 23:00 - 2013-08-28 23:01 - 01319328 _____ (File Repair ) C:\Users\CyrusMaster\Downloads\file-repair-setup.exe
2013-08-25 16:00 - 2013-08-25 16:00 - 03820480 _____ C:\Users\CyrusMaster\Downloads\battlelog-web-plugins_2.1.7_115.exe
2013-08-23 21:26 - 2013-08-23 21:26 - 00000080 _____ C:\Users\CyrusMaster\Downloads\KeiNett_Launch.properties
2013-08-23 21:25 - 2013-08-23 21:25 - 00000000 ____D C:\Users\CyrusMaster\minecraft
2013-08-23 16:36 - 2013-08-23 16:36 - 02855296 _____ (MAGIX AG) C:\Users\CyrusMaster\Downloads\vita_solo_instruments_2_dlm.exe
2013-08-18 01:04 - 2013-08-18 01:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2013-09-17 22:52 - 2013-09-17 22:52 - 00002362 _____ C:\Users\CyrusMaster\Desktop\JRT.txt
2013-09-17 22:50 - 2013-05-19 01:19 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\LogMeIn Hamachi
2013-09-17 22:50 - 2013-03-19 17:26 - 00000000 ____D C:\Program Files (x86)\Origin
2013-09-17 22:50 - 2013-03-13 15:48 - 00000000 ____D C:\Program Files (x86)\AlienRespawn
2013-09-17 22:49 - 2013-03-13 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-09-17 22:49 - 2013-03-13 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-09-17 22:49 - 2013-03-13 15:44 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-17 22:49 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-17 22:49 - 2009-07-14 06:51 - 00060722 _____ C:\Windows\setupact.log
2013-09-17 22:48 - 2013-03-13 09:13 - 01646430 _____ C:\Windows\WindowsUpdate.log
2013-09-17 22:48 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-17 22:48 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-17 22:46 - 2013-09-17 22:46 - 00000000 ____D C:\Windows\ERUNT
2013-09-17 22:41 - 2013-09-17 22:40 - 00000000 ____D C:\AdwCleaner
2013-09-17 22:37 - 2013-03-19 16:16 - 00001144 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001UA.job
2013-09-17 22:28 - 2013-03-19 16:37 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\TS3Client
2013-09-17 22:05 - 2013-06-19 19:18 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-17 21:55 - 2013-09-17 21:55 - 00000000 _____ C:\Users\CyrusMaster\Desktop\Neues Textdokument.txt
2013-09-17 21:21 - 2013-03-19 15:10 - 00000000 ____D C:\Users\CyrusMaster
2013-09-17 20:57 - 2013-09-17 20:57 - 00000000 ____D C:\FRST
2013-09-17 20:54 - 2013-09-14 01:04 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Security
2013-09-17 20:54 - 2013-03-19 16:14 - 00000394 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-09-17 20:53 - 2013-03-23 14:00 - 00003460 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-09-17 20:53 - 2013-03-19 16:14 - 00003428 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-09-17 20:31 - 2013-03-19 16:14 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-09-16 21:49 - 2013-09-16 20:19 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-09-16 20:19 - 2013-09-16 20:19 - 00003378 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-09-16 20:19 - 2013-03-19 16:14 - 00004248 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-09-16 19:56 - 2010-11-21 05:47 - 00036772 _____ C:\Windows\PFRO.log
2013-09-15 23:20 - 2013-08-28 23:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\vlc
2013-09-15 20:02 - 2013-09-15 20:02 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-15 20:02 - 2013-09-15 20:02 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Avira
2013-09-15 19:58 - 2013-09-15 19:58 - 00002064 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\ProgramData\Avira
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-15 19:56 - 2013-09-15 19:57 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-15 19:56 - 2013-09-15 19:57 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-15 19:56 - 2013-09-15 19:57 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-15 12:51 - 2013-09-15 12:51 - 00000000 ____D C:\Users\CyrusMaster\Documents\Meine empfangenen Dateien
2013-09-15 11:27 - 2013-09-15 11:27 - 00002035 _____ C:\Users\Public\Desktop\rtpMIDI.lnk
2013-09-15 11:27 - 2013-09-15 11:27 - 00000000 ____D C:\Program Files (x86)\Tobias Erichsen
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\ProgramData\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-09-15 11:23 - 2013-05-19 01:47 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Tools
2013-09-14 09:17 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-14 08:51 - 2010-11-21 08:50 - 00723330 _____ C:\Windows\system32\perfh007.dat
2013-09-14 08:51 - 2010-11-21 08:50 - 00158332 _____ C:\Windows\system32\perfc007.dat
2013-09-14 08:51 - 2009-07-14 07:13 - 01674486 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-14 01:05 - 2013-09-14 01:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00001107 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-14 00:56 - 2013-05-19 01:11 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\QuickScan
2013-09-13 23:05 - 2013-06-19 19:18 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-13 23:05 - 2013-03-13 15:19 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-13 23:05 - 2013-03-13 15:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 20:02 - 2013-03-13 15:51 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-13 20:01 - 2013-03-30 11:58 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-09-13 19:45 - 2013-09-13 19:45 - 00003138 _____ C:\Windows\System32\Tasks\{EA9E473C-7A36-491D-88C7-8E479C24D828}
2013-09-13 19:40 - 2013-03-19 22:21 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-09-13 17:46 - 2013-03-19 16:14 - 00000000 ___RD C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 17:46 - 2013-03-19 16:14 - 00000000 ___RD C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 17:45 - 2009-07-14 06:45 - 00353112 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 17:41 - 2013-08-15 23:40 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 17:39 - 2013-04-06 12:49 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-13 17:17 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\Documents\Steuerfälle
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Information Factory
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Information Factory
2013-09-13 16:47 - 2013-09-13 16:47 - 00000000 ____D C:\Program Files (x86)\Steuer SGnP2012
2013-09-13 16:46 - 2013-09-13 16:44 - 31052352 _____ (Information Factory AG) C:\Users\CyrusMaster\Downloads\SGnP2012_installieren_windows.exe
2013-09-12 23:36 - 2013-09-10 22:43 - 00000000 ____D C:\Users\CyrusMaster\Documents\UseNeXT
2013-09-12 22:27 - 2013-09-10 22:43 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\UseNeXT
2013-09-11 20:22 - 2013-03-19 16:35 - 00000000 ____D C:\Program Files (x86)\TeamSpeak 3 Client
2013-09-11 19:37 - 2013-09-11 18:09 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Steinberg
2013-09-11 18:52 - 2013-09-11 18:09 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg Cubase 5
2013-09-11 18:51 - 2013-09-11 18:51 - 00000000 ____D C:\ProgramData\VST3 Presets
2013-09-11 18:10 - 2013-09-11 18:10 - 00002140 _____ C:\Users\CyrusMaster\Desktop\Cubase 5.lnk
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg HALionOne
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\ProgramData\Steinberg
2013-09-11 18:10 - 2013-09-11 18:09 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-09-11 18:05 - 2013-09-11 18:03 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DAEMON Tools Lite
2013-09-11 18:05 - 2013-09-11 18:02 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-09-11 18:03 - 2013-09-11 18:03 - 00283200 _____ (DT Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-09-11 18:03 - 2013-09-11 18:03 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-09-11 17:49 - 2013-03-19 16:16 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001Core.job
2013-09-10 22:43 - 2013-09-10 22:43 - 00000000 ____D C:\Program Files (x86)\UseNeXT
2013-09-10 22:43 - 2013-09-10 22:42 - 05739736 _____ (Tangysoft Ltd. ) C:\Users\CyrusMaster\Downloads\UseNeXTSetup_5.53.exe
2013-09-08 15:31 - 2013-09-08 15:24 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2013-09-02 22:48 - 2013-05-19 01:17 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\.minecraft
2013-09-01 21:47 - 2013-05-19 01:49 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Games
2013-09-01 21:27 - 2013-05-19 01:52 - 00000000 ____D C:\Games
2013-09-01 11:20 - 2013-09-01 11:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoft
2013-09-01 11:20 - 2013-09-01 11:12 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-09-01 02:05 - 2013-09-01 00:28 - 1479655542 _____ C:\Users\CyrusMaster\Downloads\The.Conjuring.WEBRip.MD.German.XviD-PsO.avi
2013-08-28 23:12 - 2013-08-28 23:12 - 23003252 _____ C:\Users\CyrusMaster\Downloads\vlc-2.0.8-win32.exe
2013-08-28 23:12 - 2013-08-28 23:12 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-08-28 23:08 - 2013-08-28 23:07 - 40064601 _____ C:\Users\CyrusMaster\Downloads\videorepair.zip
2013-08-28 23:01 - 2013-08-28 23:00 - 01319328 _____ (File Repair ) C:\Users\CyrusMaster\Downloads\file-repair-setup.exe
2013-08-28 22:35 - 2013-05-12 21:56 - 00005120 _____ C:\Users\CyrusMaster\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-25 23:23 - 2013-06-24 20:11 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Skype
2013-08-25 16:12 - 2013-03-19 22:23 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-08-25 16:12 - 2013-03-19 20:01 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-08-25 16:12 - 2013-03-19 20:01 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-25 16:08 - 2013-03-19 20:01 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-08-25 16:00 - 2013-08-25 16:00 - 03820480 _____ C:\Users\CyrusMaster\Downloads\battlelog-web-plugins_2.1.7_115.exe
2013-08-23 21:26 - 2013-08-23 21:26 - 00000080 _____ C:\Users\CyrusMaster\Downloads\KeiNett_Launch.properties
2013-08-23 21:25 - 2013-08-23 21:25 - 00000000 ____D C:\Users\CyrusMaster\minecraft
2013-08-23 16:36 - 2013-08-23 16:36 - 02855296 _____ (MAGIX AG) C:\Users\CyrusMaster\Downloads\vita_solo_instruments_2_dlm.exe
2013-08-20 12:43 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-19 19:15 - 2013-03-30 14:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-18 01:04 - 2013-08-18 01:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-18 00:36 - 2013-03-20 21:54 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Adobe
Some content of TEMP:
====================
C:\Users\CyrusMaster\AppData\Local\Temp\bitool.dll
C:\Users\CyrusMaster\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\CyrusMaster\AppData\Local\Temp\i4jdel0.exe
C:\Users\CyrusMaster\AppData\Local\Temp\install_flashplayer11x32au_mssd_aih.exe
C:\Users\CyrusMaster\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\CyrusMaster\AppData\Local\Temp\Quarantine.exe
C:\Users\CyrusMaster\AppData\Local\Temp\rdp2wm0h.dll
C:\Users\CyrusMaster\AppData\Local\Temp\SkypeSetup.exe
C:\Users\CyrusMaster\AppData\Local\Temp\sonarinst.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-13 20:21
==================== End Of Log ============================
Thx und Grüsse Sandro |
|
18.09.2013, 10:13
| #4 |
| /// the machine /// TB-Ausbilder | Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net perfekt ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.09.2013, 20:31
| #5 |
| | Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net Hi Schrauber. Leider, sind die Werbeeinblendungen noch immer nicht ganz verschwunden. Diese werden zwar nicht mehr so oft eingeblendet wie zuvor, aber leider trotzdem noch immer. Ich habe zwar einen POPUP-Blocker installiert der das Laden des Inhalts verhindert, doch n leeres Frame ist trotzdem da mit dem "Ads not by this site"-Vermerk. Ausserdem werden noch immer Wörter/Wortkombinationen doppelt unterstrichen und das vermeintliche Kontext-Menü wird noch immer angezeigt. Hier die gewünschten LOGs: ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b00b8f0b1e8bc14bae4d71f613fd52d4
# engine=15177
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-18 04:59:03
# local_time=2013-09-18 06:59:03 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 5354 255895 0 0
# compatibility_mode=5893 16776574 100 94 410464 131153393 0 0
# scanned=240013
# found=0
# cleaned=0
# scan_time=4691
Code:
ATTFilter Results of screen317's Security Check version 0.99.73 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 25 Adobe Flash Player 11.8.800.168 Adobe Reader 10.1.7 Adobe Reader out of Date! Mozilla Firefox (23.0.1) ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 03
Ran by CyrusMaster (administrator) on CYWARE on 18-09-2013 20:36:33
Running from C:\Users\CyrusMaster\Downloads\Security\trojaner-board.de\Scanner
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) c:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Creative Technology Ltd) C:\Windows\sysWow64\CtHdaSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(LogMeIn Inc.) C:\Program Files (x86)\Hamachi\hamachi-2.exe
(Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Tobias Erichsen) C:\Program Files (x86)\Tobias Erichsen\rtpMIDI\rtpMIDISvc.exe
(LogMeIn Inc.) C:\Program Files (x86)\Hamachi\hamachi-2-ui.exe
(SoftThinks SAS) C:\Program Files (x86)\AlienRespawn\sftservice.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(SoftThinks - Dell) C:\Program Files (x86)\AlienRespawn\TOASTER.EXE
() C:\Program Files (x86)\AlienRespawn\COMPONENTS\SCHEDULER\STSERVICE.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
() C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Creative Technology Ltd) C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Users\CyrusMaster\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2890000 2012-03-16] (Synaptics Incorporated)
HKLM\...\Run: [IntelPROSet] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4756240 2012-02-26] (Intel(R) Corporation)
HKLM\...\Run: [BLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [177936 2012-02-17] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [] - [x]
HKLM\...\Run: [Command Center Controllers] - C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12656 2012-06-15] (Alienware)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [7468784 2013-02-28] (Logitech Inc.)
HKCU\...\Run: [Google Update] - C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-19] (Google Inc.)
HKCU\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3551576 2013-09-17] (Electronic Arts)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
MountPoints2: {32acd219-bae5-11e2-885c-606c6623e582} - G:\HTC_Sync_Manager_PC.exe
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-17] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation)
HKLM-x32\...\Run: [AlienwareOn-ScreenDisplay] - C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe [1636208 2011-12-02] ()
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Sound Blaster Recon3Di Control Panel] - c:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe [880640 2011-12-22] (Creative Technology Ltd)
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [76872 2012-06-26] (cyberlink)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Integrated Webcam Live! Central] - C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe [577536 2013-01-08] (Creative Technology Ltd)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-15] (Avira Operations GmbH & Co. KG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.alienwarearena.com/welcome-ch-g
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.alienwarearena.com/welcome-ch-g
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\CyrusMaster\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\CyrusMaster\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\536c2ac1-a17c-4de1-a3f2-1b869a3be96c@2f6608a0-8c65-4bfe-8e2f-c65b5cc757cb.com
FF Extension: Bitdefender QuickScan - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-15] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-15] (Avira Operations GmbH & Co. KG)
S2 CLKMSVC10_9EC60124; C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [242448 2012-06-26] (CyberLink)
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [122880 2012-03-28] (Creative Technology Ltd)
R2 Hamachi2Svc; C:\Program Files (x86)\Hamachi\hamachi-2.exe [2470736 2013-06-28] (LogMeIn Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-02] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-25] ()
R2 rtpMIDIService; C:\Program Files (x86)\Tobias Erichsen\rtpMIDI\rtpMIDISvc.exe [1142272 2012-08-24] (Tobias Erichsen)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)
S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-15] (Avira Operations GmbH & Co. KG)
R3 cthda; C:\Windows\System32\drivers\cthda.sys [1052760 2012-03-28] (Creative Technology Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-11] (DT Soft Ltd)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28216 2012-11-20] (Intel Corporation)
S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.)
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_ACCEL.sys [67184 2012-01-03] (STMicroelectronics)
R3 teVirtualMIDI64; C:\Windows\System32\DRIVERS\teVirtualMIDI64.sys [30208 2012-08-15] (Tobias Erichsen)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-18 18:13 - 2013-09-18 17:35 - 00891144 _____ C:\Users\CyrusMaster\Desktop\SecurityCheck.exe
2013-09-18 17:37 - 2013-09-18 17:37 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-17 22:52 - 2013-09-17 22:52 - 00002362 _____ C:\Users\CyrusMaster\Desktop\JRT.txt
2013-09-17 22:46 - 2013-09-17 22:46 - 00000000 ____D C:\Windows\ERUNT
2013-09-17 22:40 - 2013-09-17 22:41 - 00000000 ____D C:\AdwCleaner
2013-09-17 20:57 - 2013-09-17 20:57 - 00000000 ____D C:\FRST
2013-09-16 20:19 - 2013-09-16 21:49 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-09-16 20:19 - 2013-09-16 20:19 - 00003378 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-09-15 20:02 - 2013-09-15 20:02 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-15 20:02 - 2013-09-15 20:02 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Avira
2013-09-15 19:58 - 2013-09-15 19:58 - 00002064 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\ProgramData\Avira
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-15 19:57 - 2013-09-15 19:56 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-15 19:57 - 2013-09-15 19:56 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-15 19:57 - 2013-09-15 19:56 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-15 12:51 - 2013-09-15 12:51 - 00000000 ____D C:\Users\CyrusMaster\Documents\Meine empfangenen Dateien
2013-09-15 11:27 - 2013-09-15 11:27 - 00002035 _____ C:\Users\Public\Desktop\rtpMIDI.lnk
2013-09-15 11:27 - 2013-09-15 11:27 - 00000000 ____D C:\Program Files (x86)\Tobias Erichsen
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\ProgramData\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-09-14 01:05 - 2013-09-14 01:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Malwarebytes
2013-09-14 01:04 - 2013-09-17 20:54 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Security
2013-09-14 01:04 - 2013-09-14 01:04 - 00001107 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-14 01:04 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-13 19:45 - 2013-09-13 19:45 - 00003138 _____ C:\Windows\System32\Tasks\{EA9E473C-7A36-491D-88C7-8E479C24D828}
2013-09-13 17:41 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 17:41 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 17:41 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-13 17:41 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 17:41 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 17:41 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-13 17:41 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 17:41 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-13 17:41 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 17:41 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 17:41 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-13 17:41 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-13 16:50 - 2013-09-13 17:17 - 00000000 ____D C:\Users\CyrusMaster\Documents\Steuerfälle
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Information Factory
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Information Factory
2013-09-13 16:47 - 2013-09-13 16:47 - 00000000 ____D C:\Program Files (x86)\Steuer SGnP2012
2013-09-13 16:44 - 2013-09-13 16:46 - 31052352 _____ (Information Factory AG) C:\Users\CyrusMaster\Downloads\SGnP2012_installieren_windows.exe
2013-09-13 16:35 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-13 16:35 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-13 16:35 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-13 16:35 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-13 16:35 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-13 16:35 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-13 16:35 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-13 16:35 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-13 16:35 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-13 16:35 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-13 16:35 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-13 16:35 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-13 16:35 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-13 16:35 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-13 16:35 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-13 16:35 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 18:53 - 2009-10-11 21:58 - 01177600 _____ (AD) C:\Windows\SysWOW64\SYNSOEMU.DLL
2013-09-11 18:51 - 2013-09-11 18:51 - 00000000 ____D C:\ProgramData\VST3 Presets
2013-09-11 18:10 - 2013-09-11 18:10 - 00002140 _____ C:\Users\CyrusMaster\Desktop\Cubase 5.lnk
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg HALionOne
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\ProgramData\Steinberg
2013-09-11 18:09 - 2013-09-11 19:37 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Steinberg
2013-09-11 18:09 - 2013-09-11 18:52 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg Cubase 5
2013-09-11 18:09 - 2013-09-11 18:10 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-09-11 18:03 - 2013-09-11 18:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DAEMON Tools Lite
2013-09-11 18:03 - 2013-09-11 18:03 - 00283200 _____ (DT Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-09-11 18:03 - 2013-09-11 18:03 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-09-11 18:02 - 2013-09-11 18:05 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-09-10 22:43 - 2013-09-12 23:36 - 00000000 ____D C:\Users\CyrusMaster\Documents\UseNeXT
2013-09-10 22:43 - 2013-09-12 22:27 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\UseNeXT
2013-09-10 22:43 - 2013-09-10 22:43 - 00000000 ____D C:\Program Files (x86)\UseNeXT
2013-09-10 22:42 - 2013-09-10 22:43 - 05739736 _____ (Tangysoft Ltd. ) C:\Users\CyrusMaster\Downloads\UseNeXTSetup_5.53.exe
2013-09-08 15:24 - 2013-09-08 15:31 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2013-09-01 11:12 - 2013-09-01 11:20 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoft
2013-09-01 11:12 - 2013-09-01 11:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-09-01 00:28 - 2013-09-01 02:05 - 1479655542 _____ C:\Users\CyrusMaster\Downloads\The.Conjuring.WEBRip.MD.German.XviD-PsO.avi
2013-08-28 23:12 - 2013-09-15 23:20 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\vlc
2013-08-28 23:12 - 2013-08-28 23:12 - 23003252 _____ C:\Users\CyrusMaster\Downloads\vlc-2.0.8-win32.exe
2013-08-28 23:12 - 2013-08-28 23:12 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-08-28 23:07 - 2013-08-28 23:08 - 40064601 _____ C:\Users\CyrusMaster\Downloads\videorepair.zip
2013-08-28 23:00 - 2013-08-28 23:01 - 01319328 _____ (File Repair ) C:\Users\CyrusMaster\Downloads\file-repair-setup.exe
2013-08-25 16:00 - 2013-08-25 16:00 - 03820480 _____ C:\Users\CyrusMaster\Downloads\battlelog-web-plugins_2.1.7_115.exe
2013-08-23 21:26 - 2013-08-23 21:26 - 00000080 _____ C:\Users\CyrusMaster\Downloads\KeiNett_Launch.properties
2013-08-23 21:25 - 2013-08-23 21:25 - 00000000 ____D C:\Users\CyrusMaster\minecraft
2013-08-23 16:36 - 2013-08-23 16:36 - 02855296 _____ (MAGIX AG) C:\Users\CyrusMaster\Downloads\vita_solo_instruments_2_dlm.exe
==================== One Month Modified Files and Folders =======
2013-09-18 20:05 - 2013-06-19 19:18 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-18 19:37 - 2013-03-19 16:16 - 00001144 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001UA.job
2013-09-18 18:40 - 2013-03-13 09:13 - 01660770 _____ C:\Windows\WindowsUpdate.log
2013-09-18 17:52 - 2013-03-19 16:14 - 00000394 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-09-18 17:51 - 2013-03-23 14:00 - 00003460 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-09-18 17:51 - 2013-03-19 16:14 - 00003428 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-09-18 17:37 - 2013-09-18 17:37 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-18 17:37 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-18 17:37 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-18 17:35 - 2013-09-18 18:13 - 00891144 _____ C:\Users\CyrusMaster\Desktop\SecurityCheck.exe
2013-09-18 17:31 - 2013-05-19 01:19 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\LogMeIn Hamachi
2013-09-18 17:31 - 2013-03-19 17:26 - 00000000 ____D C:\Program Files (x86)\Origin
2013-09-18 17:29 - 2013-03-13 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-09-18 17:29 - 2013-03-13 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-09-18 17:29 - 2013-03-13 15:48 - 00000000 ____D C:\Program Files (x86)\AlienRespawn
2013-09-18 17:29 - 2009-07-14 06:51 - 00060890 _____ C:\Windows\setupact.log
2013-09-18 17:28 - 2013-03-13 15:44 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-18 17:28 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-17 22:52 - 2013-09-17 22:52 - 00002362 _____ C:\Users\CyrusMaster\Desktop\JRT.txt
2013-09-17 22:46 - 2013-09-17 22:46 - 00000000 ____D C:\Windows\ERUNT
2013-09-17 22:41 - 2013-09-17 22:40 - 00000000 ____D C:\AdwCleaner
2013-09-17 22:28 - 2013-03-19 16:37 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\TS3Client
2013-09-17 21:21 - 2013-03-19 15:10 - 00000000 ____D C:\Users\CyrusMaster
2013-09-17 20:57 - 2013-09-17 20:57 - 00000000 ____D C:\FRST
2013-09-17 20:54 - 2013-09-14 01:04 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Security
2013-09-17 20:31 - 2013-03-19 16:14 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-09-16 21:49 - 2013-09-16 20:19 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-09-16 20:19 - 2013-09-16 20:19 - 00003378 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-09-16 20:19 - 2013-03-19 16:14 - 00004248 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-09-16 19:56 - 2010-11-21 05:47 - 00036772 _____ C:\Windows\PFRO.log
2013-09-15 23:20 - 2013-08-28 23:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\vlc
2013-09-15 20:02 - 2013-09-15 20:02 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-15 20:02 - 2013-09-15 20:02 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Avira
2013-09-15 19:58 - 2013-09-15 19:58 - 00002064 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\ProgramData\Avira
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-15 19:56 - 2013-09-15 19:57 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-15 19:56 - 2013-09-15 19:57 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-15 19:56 - 2013-09-15 19:57 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-15 12:51 - 2013-09-15 12:51 - 00000000 ____D C:\Users\CyrusMaster\Documents\Meine empfangenen Dateien
2013-09-15 11:27 - 2013-09-15 11:27 - 00002035 _____ C:\Users\Public\Desktop\rtpMIDI.lnk
2013-09-15 11:27 - 2013-09-15 11:27 - 00000000 ____D C:\Program Files (x86)\Tobias Erichsen
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\ProgramData\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-09-15 11:23 - 2013-05-19 01:47 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Tools
2013-09-14 09:17 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-14 08:51 - 2010-11-21 08:50 - 00723330 _____ C:\Windows\system32\perfh007.dat
2013-09-14 08:51 - 2010-11-21 08:50 - 00158332 _____ C:\Windows\system32\perfc007.dat
2013-09-14 08:51 - 2009-07-14 07:13 - 01674486 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-14 01:05 - 2013-09-14 01:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00001107 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-14 00:56 - 2013-05-19 01:11 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\QuickScan
2013-09-13 23:05 - 2013-06-19 19:18 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-13 23:05 - 2013-03-13 15:19 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-13 23:05 - 2013-03-13 15:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 20:02 - 2013-03-13 15:51 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-13 20:01 - 2013-03-30 11:58 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-09-13 19:45 - 2013-09-13 19:45 - 00003138 _____ C:\Windows\System32\Tasks\{EA9E473C-7A36-491D-88C7-8E479C24D828}
2013-09-13 19:40 - 2013-03-19 22:21 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-09-13 17:46 - 2013-03-19 16:14 - 00000000 ___RD C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 17:46 - 2013-03-19 16:14 - 00000000 ___RD C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 17:45 - 2009-07-14 06:45 - 00353112 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 17:41 - 2013-08-15 23:40 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 17:39 - 2013-04-06 12:49 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-13 17:17 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\Documents\Steuerfälle
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Information Factory
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Information Factory
2013-09-13 16:47 - 2013-09-13 16:47 - 00000000 ____D C:\Program Files (x86)\Steuer SGnP2012
2013-09-13 16:46 - 2013-09-13 16:44 - 31052352 _____ (Information Factory AG) C:\Users\CyrusMaster\Downloads\SGnP2012_installieren_windows.exe
2013-09-12 23:36 - 2013-09-10 22:43 - 00000000 ____D C:\Users\CyrusMaster\Documents\UseNeXT
2013-09-12 22:27 - 2013-09-10 22:43 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\UseNeXT
2013-09-11 20:22 - 2013-03-19 16:35 - 00000000 ____D C:\Program Files (x86)\TeamSpeak 3 Client
2013-09-11 19:37 - 2013-09-11 18:09 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Steinberg
2013-09-11 18:52 - 2013-09-11 18:09 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg Cubase 5
2013-09-11 18:51 - 2013-09-11 18:51 - 00000000 ____D C:\ProgramData\VST3 Presets
2013-09-11 18:10 - 2013-09-11 18:10 - 00002140 _____ C:\Users\CyrusMaster\Desktop\Cubase 5.lnk
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg HALionOne
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\ProgramData\Steinberg
2013-09-11 18:10 - 2013-09-11 18:09 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-09-11 18:05 - 2013-09-11 18:03 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DAEMON Tools Lite
2013-09-11 18:05 - 2013-09-11 18:02 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-09-11 18:03 - 2013-09-11 18:03 - 00283200 _____ (DT Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-09-11 18:03 - 2013-09-11 18:03 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-09-11 17:49 - 2013-03-19 16:16 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001Core.job
2013-09-10 22:43 - 2013-09-10 22:43 - 00000000 ____D C:\Program Files (x86)\UseNeXT
2013-09-10 22:43 - 2013-09-10 22:42 - 05739736 _____ (Tangysoft Ltd. ) C:\Users\CyrusMaster\Downloads\UseNeXTSetup_5.53.exe
2013-09-08 15:31 - 2013-09-08 15:24 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2013-09-02 22:48 - 2013-05-19 01:17 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\.minecraft
2013-09-01 21:47 - 2013-05-19 01:49 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Games
2013-09-01 21:27 - 2013-05-19 01:52 - 00000000 ____D C:\Games
2013-09-01 11:20 - 2013-09-01 11:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoft
2013-09-01 11:20 - 2013-09-01 11:12 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-09-01 02:05 - 2013-09-01 00:28 - 1479655542 _____ C:\Users\CyrusMaster\Downloads\The.Conjuring.WEBRip.MD.German.XviD-PsO.avi
2013-08-28 23:12 - 2013-08-28 23:12 - 23003252 _____ C:\Users\CyrusMaster\Downloads\vlc-2.0.8-win32.exe
2013-08-28 23:12 - 2013-08-28 23:12 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-08-28 23:08 - 2013-08-28 23:07 - 40064601 _____ C:\Users\CyrusMaster\Downloads\videorepair.zip
2013-08-28 23:01 - 2013-08-28 23:00 - 01319328 _____ (File Repair ) C:\Users\CyrusMaster\Downloads\file-repair-setup.exe
2013-08-28 22:35 - 2013-05-12 21:56 - 00005120 _____ C:\Users\CyrusMaster\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-25 23:23 - 2013-06-24 20:11 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Skype
2013-08-25 16:12 - 2013-03-19 22:23 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-08-25 16:12 - 2013-03-19 20:01 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-08-25 16:12 - 2013-03-19 20:01 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-25 16:08 - 2013-03-19 20:01 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-08-25 16:00 - 2013-08-25 16:00 - 03820480 _____ C:\Users\CyrusMaster\Downloads\battlelog-web-plugins_2.1.7_115.exe
2013-08-23 21:26 - 2013-08-23 21:26 - 00000080 _____ C:\Users\CyrusMaster\Downloads\KeiNett_Launch.properties
2013-08-23 21:25 - 2013-08-23 21:25 - 00000000 ____D C:\Users\CyrusMaster\minecraft
2013-08-23 16:36 - 2013-08-23 16:36 - 02855296 _____ (MAGIX AG) C:\Users\CyrusMaster\Downloads\vita_solo_instruments_2_dlm.exe
2013-08-20 12:43 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-19 19:15 - 2013-03-30 14:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
Some content of TEMP:
====================
C:\Users\CyrusMaster\AppData\Local\Temp\bitool.dll
C:\Users\CyrusMaster\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\CyrusMaster\AppData\Local\Temp\i4jdel0.exe
C:\Users\CyrusMaster\AppData\Local\Temp\install_flashplayer11x32au_mssd_aih.exe
C:\Users\CyrusMaster\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\CyrusMaster\AppData\Local\Temp\Quarantine.exe
C:\Users\CyrusMaster\AppData\Local\Temp\rdp2wm0h.dll
C:\Users\CyrusMaster\AppData\Local\Temp\SkypeSetup.exe
C:\Users\CyrusMaster\AppData\Local\Temp\sonarinst.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-13 20:21
==================== End Of Log ============================
--- --- --- --- --- --- Sehe grad, dass ich den Reader noch Updaten muss.. werd ich gleich erledigen. Gruss und Danke Sandro |
|
19.09.2013, 09:41
| #6 |
| /// the machine /// TB-Ausbilder | Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net In welchem Browser?
__________________ --> Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net |
|
20.09.2013, 19:47
| #7 |
| | Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net Nabend Schrauber. FireFox Kurz und bündig. Gruss Sandro |
|
21.09.2013, 10:42
| #8 |
| /// the machine /// TB-Ausbilder | Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net Revo Uninstaller - Download - Filepony Damit Firefox komplett deinstallieren, keine Daten behalten, alle Reste entfernen lassen, Firefox neu installieren.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.09.2013, 00:06
| #9 |
| | Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net Danke Dir. Sieht momentan gut aus. Ich werde dies beobachten und mich ggf. in den nächsten Tagen nochmals melden. Aber noch etwas anderes.. Ich habe Avira Free installiert. Bei den Scan-Optionen habe ich nun einfach mal alles aktiviert. Sämtliche Archive scannen, Rootkit uvm. Meiner Meinung nach macht das Sinn. Was sagst Du dazu? Gäbe es etwas wichtiges zu beachten? ..Danach werde ich Dich in Ruhe lassen.  Vielen Dank und freundliche Grüsse Sandro |
|
22.09.2013, 13:17
| #10 |
| /// the machine /// TB-Ausbilder | Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net Lesestoff:Warum wir Avira nicht mehr empfehlen Avira liefert seit einiger Zeit mit der Standardinstallation die Ask Toolbar mit aus. Diese Toolbar ist Voraussetzung dafür, dass der Webguard zuverlässig funktioniert. Die Ask Toolbar ist dafür bekannt, dass sie das Surfverhalten des Benutzers ausspioniert, um damit in letzter Konsequenz Geld zu verdienen. Daher wird von uns auf diesem Board als "schädlich" eingestuft. Mehr Informationen. Eine Sicherheitsfirma, die dem Benutzer praktisch ungefragt schädliche Software "unterjubelt", scheidet für uns daher aus. Wir empfehlen daher allen Nutzern von Avira aufgrund dieser Geschäftspraktik, der teilweise äußerst schlechten Erkennungsrate und der überaus nervtötenden Werbung Avira zu deinstallieren und auf ein alternatives Produkt auszuweichen. Solltest du dich zu einem Wechsel entscheiden, empfehlen wir dir nach der Deinstallation mit dem Avira-Cleaner alle Reste zu entfernen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net |
| 4d36e972-e325-11ce-bfc1-08002be10318, adobe, alienware, bonjour, computer, converter, cubase, defender, desktop, device driver, dvdvideosoft ltd., farbar, farbar recovery scan tool, firefox, flash player, klassiker, launch, origin, plug-in, popups, präzise, pup.optional.adtool, pup.optional.crossrider.a, pup.optional.lyrics.a, pup.optional.opencandy, pup.optional.softonic, pup.optional.somoto.a, registry, security, services.exe, software, svchost.exe, system, teamspeak, tunnel, unterstrichen |
Linear-Darstellung
