Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows 7: Bit Coin Miner "Befall"

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 27.12.2013, 18:17   #1
IMrIMike
 
Windows 7: Bit Coin Miner "Befall" - Standard

Windows 7: Bit Coin Miner "Befall"



Guten Abend,

heute morgen ist mir beim Starten eines Spiels aufgefallen,dass dieses ungewöhnlich ruckelte.

Mein System:

-Intel Core i5 4670
-Asus H87 Plus
-Asus GTX 760
-8 Gb Ram

Ich ging zurück auf den Desktop und bemerkte,dass auch u.a das Verschieben der Windows Fenster sehr ruckelig verlief.Nun war klar,dass es irgendetwas mit der Grafikkarte zu tun haben muss.Ich beobachtete die Auslastung: 70-99 % auf dem Desktop,ohne weitere geöffneten Anwendungen.Nach kurzem Googlen war klar,dass es sich um einen "BitCoin Miner" handeln muss,denn nach dem Trennen der I-Net Verbindung sank die Auslastung auf 0%.Allerdings erkannte ich keine aufälligen Prozesse im Task-Manager.Nun bin ich hier gelandet,in der Hoffnung den Mist vom Rechner zu schaffen,denn eindeutige DIY Tools/Anleitungen habe ich nicht gefunden.


Mit freundlichen Grüßen

Mike

Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-27 17:59:51
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006a ATA_____ rev.A5CA 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\test\AppData\Local\Temp\kxldypow.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                0000000070cb1a22 2 bytes [CB, 70]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                0000000070cb1ad0 2 bytes [CB, 70]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                0000000070cb1b08 2 bytes [CB, 70]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                0000000070cb1bba 2 bytes [CB, 70]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                0000000070cb1bda 2 bytes [CB, 70]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                         0000000076231465 2 bytes [23, 76]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                        00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                      0000000076231465 2 bytes [23, 76]
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                     00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000076231465 2 bytes [23, 76]
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                         0000000076231465 2 bytes [23, 76]
.text   C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                        00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3440] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69            0000000076231465 2 bytes [23, 76]
.text   C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3440] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155           00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[4824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076231465 2 bytes [23, 76]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[4824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2

---- Threads - GMER 2.1 ----

Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [4792:3924]                                                                                         000007fefb9a2a7c
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [4792:252]                                                                                          000007feef954830

---- EOF - GMER 2.1 ----
         

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-12-2013
Ran by test (administrator) on MIKE-PC on 27-12-2013 16:18:39
Running from C:\Users\test\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe
() C:\Windows\SysWOW64\ASGT.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe
(ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation)
HKLM-x32\...\Run: [GamingKeyboard] - C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [HP Officejet 6600 (NET)] - C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.)
HKCU\...\Run: [OscarEditor] - C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe [3333632 2012-08-16] ()
HKCU\...\RunOnce: [Temp] - C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\system.vbs [2149 2013-12-27] ()
MountPoints2: {27be5a93-ee35-11e2-b16b-806e6f6e6963} - D:\Bin\ASSETUP.exe
Startup: C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=hp&installDate=03/10/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFE6EA923CC82CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: WOT - {9E571C81-21E7-496B-9E6B-127E60263022} - C:\Users\test\AppData\LocalLow\WOT\IE\WOT.dll (WOT Services Oy)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default
FF NewTab: about:blank
FF Homepage: google.de
FF Keyword.URL: hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&installDate={installDate}&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=1.6.0_45 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\wotstats@mywot.com
FF Extension: Adblock Plus - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [927232 2012-10-29] ()
R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] ()
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-01-23] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-09-30] ()
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.)
S2 WOTUpdater; C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] ()

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-29] (Disc Soft Ltd)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S3 FanatecWheelFilterUsb; C:\Windows\System32\DRIVERS\FWFilterUsb.sys [64688 2013-02-15] (Windows (R) Codename Longhorn DDK provider)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation)
R4 IOMap; C:\Windows\system32\drivers\IOMap64.sys [24824 2013-02-19] (ASUSTeK Computer Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
R3 PorscheWheelFilterUsb; C:\Windows\System32\DRIVERS\PWFilterUsb.sys [58448 2010-12-15] (Windows (R) Codename Longhorn DDK provider)
S3 vhidmini; C:\Windows\System32\DRIVERS\vjoy.sys [15104 2012-10-15] (Headsoft)
S3 WinRing0_1_2_0; \??\C:\Users\test\AppData\Local\Temp\tmp7712.tmp [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-27 16:17 - 2013-12-27 16:18 - 00030667 _____ C:\Users\test\Desktop\Addition.txt
2013-12-27 16:15 - 2013-12-27 16:18 - 00016265 _____ C:\Users\test\Desktop\FRST.txt
2013-12-27 16:15 - 2013-12-27 16:15 - 00000000 ____D C:\FRST
2013-12-27 16:14 - 2013-12-27 16:14 - 01930574 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:12 - 2013-12-27 16:12 - 00000168 _____ C:\Users\test\defogger_reenable
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\sh4ldr
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2012-06-22 11:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-12-27 16:06 - 2013-12-27 16:07 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:39 - 2013-02-19 18:02 - 00024824 _____ (ASUSTeK Computer Inc.) C:\Windows\system32\Drivers\IOMap64.sys
2013-12-27 15:27 - 2013-12-27 15:27 - 00000000 ____D C:\Windows\LastGood
2013-12-27 15:26 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-27 15:26 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-27 15:07 - 2013-12-27 15:08 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:48 - 2013-12-27 14:50 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-27 11:15 - 2013-12-27 14:03 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:32 - 2013-12-26 22:48 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:51 - 2013-12-25 22:50 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:56 - 2013-12-24 21:56 - 01049728 _____ C:\Users\test\Downloads\pantsoff.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-23 22:40 - 2013-12-26 12:07 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-23 14:55 - 2013-12-23 14:59 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:05 - 2013-12-21 21:06 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:33 - 2013-12-21 14:34 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:32 - 2013-12-21 14:33 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 13:59 - 2013-12-21 14:00 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:37 - 2013-12-20 22:38 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 11:01 - 2013-12-15 14:46 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-12 16:40 - 2013-12-12 16:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-11 22:14 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-11 22:14 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 22:13 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 22:13 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-11 22:13 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 22:13 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-11 22:13 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-11 22:13 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 22:13 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-11 22:13 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-11 22:13 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-11 22:13 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-11 22:13 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 22:13 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 22:13 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-11 22:13 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 11:52 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 11:52 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 11:52 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 11:52 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 11:52 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 11:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 11:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 11:50 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 11:50 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 11:50 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 11:50 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 11:50 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 11:50 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 11:50 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent
2013-12-09 13:45 - 2013-12-19 19:48 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-11-30 23:52 - 2013-09-25 11:42 - 00033720 _____ C:\Users\test\Documents\turbo_int.ogg
2013-11-29 18:36 - 2013-12-15 00:05 - 00000000 ____D C:\Users\test\Documents\SimCity 4
2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat
2013-11-29 18:31 - 2013-11-29 18:32 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite
2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-11-29 18:30 - 2013-11-29 18:32 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite

==================== One Month Modified Files and Folders =======

2013-12-27 16:18 - 2013-12-27 16:17 - 00030667 _____ C:\Users\test\Desktop\Addition.txt
2013-12-27 16:18 - 2013-12-27 16:15 - 00016265 _____ C:\Users\test\Desktop\FRST.txt
2013-12-27 16:18 - 2013-07-17 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-27 16:15 - 2013-12-27 16:15 - 00000000 ____D C:\FRST
2013-12-27 16:14 - 2013-12-27 16:14 - 01930574 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:12 - 2013-12-27 16:12 - 00000168 _____ C:\Users\test\defogger_reenable
2013-12-27 16:12 - 2013-07-16 17:37 - 00000000 ____D C:\Users\test
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:10 - 2013-07-16 17:37 - 01933935 _____ C:\Windows\WindowsUpdate.log
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\sh4ldr
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2013-12-27 16:06 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:43 - 2013-07-17 15:05 - 00000000 ____D C:\Games
2013-12-27 15:31 - 2013-07-17 15:05 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA
2013-12-27 15:30 - 2013-11-13 23:33 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA Corporation
2013-12-27 15:30 - 2013-07-17 14:53 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-27 15:30 - 2013-07-17 14:52 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-27 15:28 - 2009-07-14 05:51 - 00092802 _____ C:\Windows\setupact.log
2013-12-27 15:27 - 2013-12-27 15:27 - 00000000 ____D C:\Windows\LastGood
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-12-27 15:07 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:08 - 2013-12-27 14:50 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:50 - 2013-12-27 14:48 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 14:46 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-27 14:46 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-27 14:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-27 14:33 - 2013-07-16 17:37 - 00000000 ___RD C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 14:33 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-27 14:32 - 2013-10-29 14:17 - 00000022 _____ C:\Windows\GPU-Z.INI
2013-12-27 14:03 - 2013-12-27 11:15 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-27 13:16 - 2013-10-04 11:23 - 00544909 _____ C:\NPClient.log
2013-12-27 13:16 - 2013-07-17 15:06 - 00000000 ____D C:\Users\test\Documents\Euro Truck Simulator 2
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-27 13:05 - 2013-11-09 11:45 - 00000000 ____D C:\Users\test\AppData\Roaming\vlc
2013-12-27 12:57 - 2013-07-17 14:49 - 00000000 ____D C:\Program Files (x86)\Origin
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:48 - 2013-12-26 22:32 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-26 12:12 - 2013-11-06 23:13 - 00000000 ____D C:\Users\test\.gimp-2.8
2013-12-26 12:07 - 2013-12-23 22:40 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:50 - 2013-12-25 22:51 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 22:58 - 2011-04-12 08:43 - 00697658 _____ C:\Windows\system32\perfh007.dat
2013-12-24 22:58 - 2011-04-12 08:43 - 00148452 _____ C:\Windows\system32\perfc007.dat
2013-12-24 22:58 - 2009-07-14 06:13 - 01615906 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:56 - 2013-12-24 21:56 - 01049728 _____ C:\Users\test\Downloads\pantsoff.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-24 00:30 - 2013-07-17 16:57 - 00000000 ____D C:\Users\test\AppData\Roaming\uTorrent
2013-12-23 23:41 - 2013-07-18 16:57 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-12-23 23:41 - 2013-07-18 14:39 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-12-23 23:41 - 2013-07-18 14:39 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-12-23 22:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-23 14:59 - 2013-12-23 14:55 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-23 11:21 - 2013-07-17 14:51 - 00000000 ____D C:\Users\test\AppData\Roaming\Origin
2013-12-23 11:21 - 2013-07-17 14:49 - 00000000 ____D C:\ProgramData\Origin
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:06 - 2013-12-21 21:05 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:58 - 2013-11-10 10:54 - 00000000 ____D C:\Users\test\AppData\Local\CrashDumps
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:19 - 2013-11-09 11:56 - 00000000 ____D C:\Users\test\AppData\Roaming\Audacity
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:34 - 2013-12-21 14:33 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:33 - 2013-12-21 14:32 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 14:00 - 2013-12-21 13:59 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:38 - 2013-12-20 22:37 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 20:01 - 2013-07-17 09:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-19 19:48 - 2013-12-09 13:45 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-12-17 14:33 - 2013-11-20 19:39 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 14:46 - 2013-12-15 11:01 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-15 14:42 - 2013-10-06 16:13 - 00024064 ___SH C:\Users\test\Documents\Thumbs.db
2013-12-15 14:01 - 2013-11-06 23:25 - 00000000 ____D C:\Users\test\AppData\Local\gtk-2.0
2013-12-15 00:54 - 2013-08-19 21:23 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 00:53 - 2013-07-26 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 00:05 - 2013-11-29 18:36 - 00000000 ____D C:\Users\test\Documents\SimCity 4
2013-12-13 20:08 - 2013-07-21 16:02 - 00000000 ____D C:\Users\test\AppData\Roaming\TS3Client
2013-12-13 11:51 - 2013-08-19 09:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-12 19:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-12 16:41 - 2013-12-12 16:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-12 15:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-12 15:47 - 2009-07-14 05:45 - 00274712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-11 16:18 - 2013-07-17 14:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 16:18 - 2013-07-17 14:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 16:18 - 2013-07-17 14:35 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-10 03:13 - 2013-10-29 11:49 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2013-12-10 03:13 - 2013-10-29 11:49 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent
2013-12-08 14:58 - 2013-11-09 19:16 - 00000000 ____D C:\Users\test\Documents\Assetto Corsa
2013-12-06 18:40 - 2013-07-22 22:03 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-05 09:42 - 2013-12-27 15:26 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-05 09:42 - 2013-12-27 15:26 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-05 09:42 - 2013-07-31 10:53 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-12-02 14:51 - 2013-07-17 23:27 - 00000000 ____D C:\Windows\Minidump
2013-12-02 14:50 - 2013-07-17 23:26 - 632873085 _____ C:\Windows\MEMORY.DMP
2013-11-30 13:15 - 2010-11-21 04:47 - 00114556 _____ C:\Windows\PFRO.log
2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat
2013-11-29 18:32 - 2013-11-29 18:31 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite
2013-11-29 18:32 - 2013-11-29 18:30 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-11-28 15:23 - 2013-07-18 16:56 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins

Files to move or delete:
====================
C:\Users\test\Game.dll


Some content of TEMP:
====================
C:\Users\test\AppData\Local\Temp\AutoRun.exe
C:\Users\test\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\test\AppData\Local\Temp\avgnt.exe
C:\Users\test\AppData\Local\Temp\bdfilters.dll
C:\Users\test\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih.exe
C:\Users\test\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\test\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\test\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\test\AppData\Local\Temp\nvStInst.exe
C:\Users\test\AppData\Local\Temp\setup.exe
C:\Users\test\AppData\Local\Temp\SHSetup.exe
C:\Users\test\AppData\Local\Temp\sonarinst.exe
C:\Users\test\AppData\Local\Temp\SRLDetectionLibrary5003431084714088478.dll
C:\Users\test\AppData\Local\Temp\_is7D5A.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-21 10:47

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-12-2013
Ran by test at 2013-12-27 16:19:00
Running from C:\Users\test\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

«Max Payne 3»  1.0.0.57 (x32 Version: 1.0.0.57)
µTorrent (HKCU Version: 3.3.2.30303)
Adobe Acrobat 5.0 (x32 Version: 5.0)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
ARMA 3 (x32 Version: 1)
Assetto Corsa - Technology Preview Version 0.9.6 (x32 Version: 0.9.6)
Asterisk Key 10.0 (x32)
ASUS GPU Tweak (x32 Version: 2.4.2.4)
ASUS Product Register Program (x32 Version: 1.0.022)
Audacity 2.0.5 (x32 Version: 2.0.5)
Avira Free Antivirus (x32 Version: 14.0.2.286)
Bandicam (x32 Version: 1.9.1.419)
Bandisoft MPEG-1 Decoder (x32)
Battlefield 1942™ (x32 Version: 1.6.20.0)
Battlefield 3™ (x32 Version: 1.6.0.0)
Battlefield 4™ Beta (x32 Version: 1.0.0.0)
Battlelog Web Plugins (x32 Version: 2.3.2)
Camtasia Studio 8 (x32 Version: 8.1.2.1327)
Cheat Engine 6.3 (x32)
City Car Driving 1.2.2 (x32)
CL-Eye Driver (x32 Version: 5.3.0.0341)
CPUID HWMonitor 1.23
CTDP Formula One 2006 V1.1 (x32 Version: 0.95)
DAEMON Tools Lite (x32 Version: 4.48.1.0347)
DiRT 3 (x32 Version: 1.0.0000.130)
DiRT2 (x32 Version: 1.0.0002.133)
DiRT2 (x32 Version: 1.00.0000)
DTM Experience Demo (x32)
Enable Viacam 1.7.0 (x32 Version: 1.7.0)
Endurance Series by EnduRacers - rF1 FULL (HKCU)
Endurance Series by EnduRacers - Service Pack 2.1 (HKCU)
ESN Sonar (x32 Version: 0.70.4)
Euro Truck Simulator 2 (x32 Version: 1.0.2)
Euro Truck Simulator 2 (x32)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
F1 1976 LE v1.1 (HKCU)
F1 2010 (x32 Version: 1.0.0000.132)
F1 2013 Update 2 (x32 Version: 1)
FaceTrackingAPI_NC 3.2 (x32 Version: 3.2.0)
FaceTrackNoIR version 1.7 (x32 Version: 1.7)
Fiat Abarth 500 esseesse - Street & Cup 1.01 (x32)
Formula Truck 2013 version 1.10 (x32 Version: 1.10)
Fraps (x32)
GeForce Experience NvStream Client Components (Version: 1.6.28)
GIMP 2.8.8 (Version: 2.8.8)
Grand Theft Auto IV (x32 Version: 1.00.0000)
HP Officejet 6600 - Grundlegende Software für das Gerät (Version: 25.0.619.0)
ImgBurn (x32 Version: 2.5.8.0)
Intel(R) IPP Run-Time Installer 5.3 Update 4 for Windows* on IA-32 (x32 Version: 5.3.4.087)
Intel(R) Management Engine Components (x32 Version: 9.0.0.1310)
Intel(R) Rapid Storage Technology (Version: 12.0.0.1083)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 2.0.0.100)
Intel® Trusted Connect Service Client (Version: 1.27.757.1)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 34 (64-bit) (Version: 6.0.340)
Java(TM) 6 Update 34 (x32 Version: 6.0.340)
Java(TM) 6 Update 45 (64-bit) (Version: 6.0.450)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Flight Simulator X (x32 Version: 10.0.60905)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.67.0)
Microsoft Office Word Viewer 2003 (x32 Version: 11.0.8173.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.50727.42 False (x32 Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.51011 False (x32 Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.56336 False (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.58299 False (x32 Version: 8.0.58299)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.59193 False (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.61001 (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 False (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.0 False (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 False (x32 Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 False (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 False (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 False (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 False (x32 Version: 9.0.30729.4048)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 False (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.5570 False (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.30319 False (x32 Version: 10.0.30319)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 False (x32 Version: 11.0.50727.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 False (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 False (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 False (x32 Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 False (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 False (x32 Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610)
MMG F1 2007 V3.0.1 (x32)
Mouse Editor (x32 Version: 12.08.0006)
MOUSE Editor (x32 Version: 12.08.0006)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0)
Mozilla Maintenance Service (x32 Version: 26.0)
MSI Afterburner 2.3.1 (x32 Version: 2.3.1)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser und SDK (x32 Version: 4.20.9818.0)
NASCAR The Game 2013 (x32 Version: 1.0.0.1)
NASCAR® Racing 2003 Season (x32)
Need For Speed The Run (x32)
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82)
NVIDIA 3D Vision Treiber 331.82 (Version: 331.82)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1)
NVIDIA Grafiktreiber 331.82 (Version: 331.82)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4)
NVIDIA Install Application (Version: 2.1002.142.992)
NVIDIA LED Visualizer 1.0 (Version: 1.0)
NVIDIA Network Service (Version: 1.0)
NVIDIA PhysX (x32 Version: 9.13.0725)
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182)
NVIDIA Systemsteuerung 331.82 (Version: 331.82)
NVIDIA Update 10.11.15 (Version: 10.11.15)
NVIDIA Update Core (Version: 10.11.15)
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19)
OMSI - Der Omnibussimulator (x32 Version: 1.06)
OMSI - Hamburg (x32 Version: 1.00)
OMSI Addon Manager Version 1.2.4 (x32 Version: 1.2.4)
OpenAL (x32)
Origin (x32 Version: 9.2.1.4399)
PantsOff 2.0 (x32 Version: 2.0)
Porsche Wheel (Version: 8.10.6)
PunkBuster Services (x32 Version: 0.993)
Race On (x32)
Rapture3D 2.4.8 Game (x32)
Realtek Ethernet Controller Driver (x32 Version: 7.67.1226.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6782)
rFactor2 (x32)
Rockstar Games Social Club (x32 Version: 1.0.9.7)
Rockstar Games Social Club (x32 Version: 1.00.0000)
SHARKOON Skiller (x32 Version: 1.00.0000)
SHIELD Streaming (Version: 1.6.85)
SimCity 4 Deluxe (x32)
Skype™ 6.6 (x32 Version: 6.6.106)
Spa Francorchamps 2009 (x32 Version: 1.0)
SpinTires Tech Demo (June 060613) (x32 Version: 1.3)
Splinter Cell - Blacklist (x32)
SpyHunter (Version: 4.16.5.4290)
Steam (x32 Version: 1.0.0.0)
System Requirements Lab CYRI (x32 Version: 6.0.3.0)
TeamSpeak 3 Client (HKCU Version: 3.0.13.1)
Thrustmaster Calibration Tool (x32 Version: 1.03.0000)
Thrustmaster FFB Wheel driver (x32 Version: 2.FFJ.2007)
Tombraider (x32)
TV-Total Emulator v1.4.1.1 (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
VLC media player 2.1.0 (Version: 2.1.0)
VLN 2005 for rFactor v1.0 (x32)
War Thunder Launcher 1.0.1.269 (x32)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)
World of Warplanes (x32)

==================== Restore Points  =========================

21-12-2013 13:03:09 Microsoft Office Word Viewer 2003 wird installiert
22-12-2013 23:01:20 Windows Update
27-12-2013 14:30:05 DirectX wurde installiert
27-12-2013 15:06:41 Installed SpyHunter

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {39A65BF6-9DA3-4F81-B929-A1AD11A329C3} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe [2013-10-18] (Enigma Software Group USA, LLC.)
Task: {6F5EAFA4-F909-48A1-A7D7-171F15B73B33} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {7611F656-F4A5-480F-8075-FC0FF5F69F3C} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2013-06-21] (ASUSTek Computer Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-07-17 14:52 - 2013-11-11 16:02 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-11-20 19:39 - 2013-10-31 19:25 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-07-17 09:13 - 2013-12-27 14:38 - 00025088 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.01\PEbiosinterface32.dll
2013-07-17 09:13 - 2012-05-08 08:04 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.01\ATKEX.dll
2010-12-02 10:56 - 2010-12-02 10:56 - 00815104 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\OSD_Text\OSD_Text.dll
2011-01-09 13:45 - 2011-01-09 13:45 - 00088064 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_MouseDeviceManager.dll
2012-06-14 08:59 - 2012-06-14 08:59 - 02414080 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\ScreenCapture\ScreenCapture.dll
2012-05-17 04:17 - 2012-05-17 04:17 - 01000448 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\TrayIconWebAdvertisement\TrayIconWebAdvertisement.dll
2010-09-20 07:18 - 2010-09-20 07:18 - 00085504 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ZoomControl.dll
2010-09-20 07:18 - 2010-09-20 07:18 - 00054272 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ScrollbarControl.dll
2011-04-12 08:14 - 2011-04-12 08:14 - 00063488 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInRight.dll
2010-11-01 13:16 - 2010-11-01 13:16 - 00062976 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInOne.dll
2012-04-27 04:40 - 2012-04-27 04:40 - 00118272 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_Wheel4D.dll
2013-12-12 16:40 - 2013-12-12 16:41 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-07-17 09:47 - 2013-01-23 08:57 - 01199576 ____R () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2013-12-27 12:56 - 2012-09-25 23:46 - 00445800 _____ () C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\cudart32_50_35.dll
2013-12-27 12:56 - 2012-05-27 01:36 - 00054272 _____ () C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\pthreadVC2.dll
2013-06-20 11:01 - 2013-06-20 11:01 - 00258048 _____ () C:\Program Files (x86)\ASUS\GPU Tweak\Vender.dll
2013-05-14 15:11 - 2013-05-14 15:11 - 00049152 _____ () C:\Program Files (x86)\ASUS\GPU Tweak\Exeio.dll
2013-11-20 19:39 - 2013-10-31 19:25 - 00394808 _____ () c:\program files (x86)\avira\antivir desktop\sqlite3.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:D73C9AB3
AlternateDataStreams: C:\ProgramData\TEMP:F1A5FE8B

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/27/2013 02:40:31 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/27/2013 02:15:18 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/27/2013 01:37:03 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/27/2013 01:37:02 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/27/2013 11:03:04 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 08:08:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/26/2013 08:08:55 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/26/2013 06:21:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 05:01:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 03:44:38 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (12/27/2013 03:06:47 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Diagnosesystemhost" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sitzungs-Manager für Desktopfenster-Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Überwachung verteilter Verknüpfungen (Client)" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Superfetch" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Programmkompatibilitäts-Assistent-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerkverbindungen" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PnP-X-IP-Busenumerator" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (12/27/2013 02:40:31 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/27/2013 02:15:18 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/27/2013 01:37:03 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Support\Tools\MAS2.exe

Error: (12/27/2013 01:37:02 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Core\ModMgr.exe

Error: (12/27/2013 11:03:04 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 08:08:56 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Support\Tools\MAS2.exe

Error: (12/26/2013 08:08:55 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Core\ModMgr.exe

Error: (12/26/2013 06:21:46 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 05:01:45 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 03:44:38 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2013-07-21 16:53:02.592
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-21 16:53:02.576
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-21 16:53:02.184
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-21 16:53:02.169
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-17 23:00:22.126
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-17 23:00:22.116
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-17 23:00:21.732
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-17 23:00:21.722
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 8131.85 MB
Available physical RAM: 4604.38 MB
Total Pagefile: 16261.88 MB
Available Pagefile: 11714.9 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:47.14 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 0FB3C24D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Code:
ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.27.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
test :: MIKE-PC [limitiert]

27.12.2013 15:20:52
MBAM-log-2013-12-27 (17-39-15).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 657601
Laufzeit: 2 Stunde(n), 5 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0R0DtO0U1C1S1U1StR0J1Q2P1J1K1I2R -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 5
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=hp&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Bar (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|SearchAssistant (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 6
C:\Users\test\AppData\Local\Temp\58hzMFNi.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt.
C:\Users\test\AppData\Local\Temp\AgBF3Zr1.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt.
C:\Users\test\AppData\Local\Temp\DHIPdIaj.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt.
C:\Users\test\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih.exe (Trojan.Repacked) -> Keine Aktion durchgeführt.
C:\Users\test\AppData\Local\Temp\qWurm_Tk.exe.part (PUP.Optional.InstalleRex) -> Keine Aktion durchgeführt.
C:\Users\test\Downloads\pantsoff.exe (PUP.PSWTool.Finder) -> Keine Aktion durchgeführt.

(Ende)
         
--- --- ---
Angehängte Dateien
Dateityp: log Gmer.log (4,9 KB, 117x aufgerufen)
Dateityp: txt Addition.txt (30,1 KB, 126x aufgerufen)
Dateityp: txt FRST.txt (45,0 KB, 158x aufgerufen)
Dateityp: txt MBAM-log-2013-12-27 (17-39-15).txt (6,9 KB, 112x aufgerufen)

Alt 28.12.2013, 01:29   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Bit Coin Miner "Befall" - Standard

Windows 7: Bit Coin Miner "Befall"



Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.


So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________

Alt 28.12.2013, 11:28   #3
IMrIMike
 
Windows 7: Bit Coin Miner "Befall" - Standard

Windows 7: Bit Coin Miner "Befall"



Hallo schrauber,

ich verstehe nicht ganz worum es geht.Ich habe doch die 4 Logs als Code eingefügt?Kanns ja nochmal machen,aber wie gesagt,ich seh bei mir im Post die eingebetteten Abschnitte...

FRST


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-12-2013
Ran by test (administrator) on MIKE-PC on 27-12-2013 16:18:39
Running from C:\Users\test\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe
() C:\Windows\SysWOW64\ASGT.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe
(ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation)
HKLM-x32\...\Run: [GamingKeyboard] - C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [HP Officejet 6600 (NET)] - C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.)
HKCU\...\Run: [OscarEditor] - C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe [3333632 2012-08-16] ()
HKCU\...\RunOnce: [Temp] - C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\system.vbs [2149 2013-12-27] ()
MountPoints2: {27be5a93-ee35-11e2-b16b-806e6f6e6963} - D:\Bin\ASSETUP.exe
Startup: C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=hp&installDate=03/10/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFE6EA923CC82CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: WOT - {9E571C81-21E7-496B-9E6B-127E60263022} - C:\Users\test\AppData\LocalLow\WOT\IE\WOT.dll (WOT Services Oy)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default
FF NewTab: about:blank
FF Homepage: google.de
FF Keyword.URL: hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&installDate={installDate}&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=1.6.0_45 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\wotstats@mywot.com
FF Extension: Adblock Plus - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [927232 2012-10-29] ()
R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] ()
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-01-23] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-09-30] ()
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.)
S2 WOTUpdater; C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] ()

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-29] (Disc Soft Ltd)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S3 FanatecWheelFilterUsb; C:\Windows\System32\DRIVERS\FWFilterUsb.sys [64688 2013-02-15] (Windows (R) Codename Longhorn DDK provider)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation)
R4 IOMap; C:\Windows\system32\drivers\IOMap64.sys [24824 2013-02-19] (ASUSTeK Computer Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
R3 PorscheWheelFilterUsb; C:\Windows\System32\DRIVERS\PWFilterUsb.sys [58448 2010-12-15] (Windows (R) Codename Longhorn DDK provider)
S3 vhidmini; C:\Windows\System32\DRIVERS\vjoy.sys [15104 2012-10-15] (Headsoft)
S3 WinRing0_1_2_0; \??\C:\Users\test\AppData\Local\Temp\tmp7712.tmp [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-27 16:17 - 2013-12-27 16:18 - 00030667 _____ C:\Users\test\Desktop\Addition.txt
2013-12-27 16:15 - 2013-12-27 16:18 - 00016265 _____ C:\Users\test\Desktop\FRST.txt
2013-12-27 16:15 - 2013-12-27 16:15 - 00000000 ____D C:\FRST
2013-12-27 16:14 - 2013-12-27 16:14 - 01930574 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:12 - 2013-12-27 16:12 - 00000168 _____ C:\Users\test\defogger_reenable
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\sh4ldr
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2012-06-22 11:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-12-27 16:06 - 2013-12-27 16:07 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:39 - 2013-02-19 18:02 - 00024824 _____ (ASUSTeK Computer Inc.) C:\Windows\system32\Drivers\IOMap64.sys
2013-12-27 15:27 - 2013-12-27 15:27 - 00000000 ____D C:\Windows\LastGood
2013-12-27 15:26 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-27 15:26 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-27 15:07 - 2013-12-27 15:08 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:48 - 2013-12-27 14:50 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-27 11:15 - 2013-12-27 14:03 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:32 - 2013-12-26 22:48 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:51 - 2013-12-25 22:50 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:56 - 2013-12-24 21:56 - 01049728 _____ C:\Users\test\Downloads\pantsoff.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-23 22:40 - 2013-12-26 12:07 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-23 14:55 - 2013-12-23 14:59 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:05 - 2013-12-21 21:06 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:33 - 2013-12-21 14:34 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:32 - 2013-12-21 14:33 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 13:59 - 2013-12-21 14:00 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:37 - 2013-12-20 22:38 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 11:01 - 2013-12-15 14:46 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-12 16:40 - 2013-12-12 16:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-11 22:14 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-11 22:14 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 22:13 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 22:13 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-11 22:13 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 22:13 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-11 22:13 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-11 22:13 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 22:13 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-11 22:13 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-11 22:13 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-11 22:13 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-11 22:13 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 22:13 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 22:13 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-11 22:13 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 11:52 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 11:52 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 11:52 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 11:52 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 11:52 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 11:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 11:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 11:50 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 11:50 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 11:50 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 11:50 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 11:50 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 11:50 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 11:50 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent
2013-12-09 13:45 - 2013-12-19 19:48 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-11-30 23:52 - 2013-09-25 11:42 - 00033720 _____ C:\Users\test\Documents\turbo_int.ogg
2013-11-29 18:36 - 2013-12-15 00:05 - 00000000 ____D C:\Users\test\Documents\SimCity 4
2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat
2013-11-29 18:31 - 2013-11-29 18:32 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite
2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-11-29 18:30 - 2013-11-29 18:32 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite

==================== One Month Modified Files and Folders =======

2013-12-27 16:18 - 2013-12-27 16:17 - 00030667 _____ C:\Users\test\Desktop\Addition.txt
2013-12-27 16:18 - 2013-12-27 16:15 - 00016265 _____ C:\Users\test\Desktop\FRST.txt
2013-12-27 16:18 - 2013-07-17 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-27 16:15 - 2013-12-27 16:15 - 00000000 ____D C:\FRST
2013-12-27 16:14 - 2013-12-27 16:14 - 01930574 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:12 - 2013-12-27 16:12 - 00000168 _____ C:\Users\test\defogger_reenable
2013-12-27 16:12 - 2013-07-16 17:37 - 00000000 ____D C:\Users\test
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:10 - 2013-07-16 17:37 - 01933935 _____ C:\Windows\WindowsUpdate.log
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\sh4ldr
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2013-12-27 16:06 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:43 - 2013-07-17 15:05 - 00000000 ____D C:\Games
2013-12-27 15:31 - 2013-07-17 15:05 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA
2013-12-27 15:30 - 2013-11-13 23:33 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA Corporation
2013-12-27 15:30 - 2013-07-17 14:53 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-27 15:30 - 2013-07-17 14:52 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-27 15:28 - 2009-07-14 05:51 - 00092802 _____ C:\Windows\setupact.log
2013-12-27 15:27 - 2013-12-27 15:27 - 00000000 ____D C:\Windows\LastGood
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-12-27 15:07 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:08 - 2013-12-27 14:50 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:50 - 2013-12-27 14:48 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 14:46 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-27 14:46 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-27 14:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-27 14:33 - 2013-07-16 17:37 - 00000000 ___RD C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 14:33 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-27 14:32 - 2013-10-29 14:17 - 00000022 _____ C:\Windows\GPU-Z.INI
2013-12-27 14:03 - 2013-12-27 11:15 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-27 13:16 - 2013-10-04 11:23 - 00544909 _____ C:\NPClient.log
2013-12-27 13:16 - 2013-07-17 15:06 - 00000000 ____D C:\Users\test\Documents\Euro Truck Simulator 2
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-27 13:05 - 2013-11-09 11:45 - 00000000 ____D C:\Users\test\AppData\Roaming\vlc
2013-12-27 12:57 - 2013-07-17 14:49 - 00000000 ____D C:\Program Files (x86)\Origin
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:48 - 2013-12-26 22:32 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-26 12:12 - 2013-11-06 23:13 - 00000000 ____D C:\Users\test\.gimp-2.8
2013-12-26 12:07 - 2013-12-23 22:40 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:50 - 2013-12-25 22:51 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 22:58 - 2011-04-12 08:43 - 00697658 _____ C:\Windows\system32\perfh007.dat
2013-12-24 22:58 - 2011-04-12 08:43 - 00148452 _____ C:\Windows\system32\perfc007.dat
2013-12-24 22:58 - 2009-07-14 06:13 - 01615906 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:56 - 2013-12-24 21:56 - 01049728 _____ C:\Users\test\Downloads\pantsoff.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-24 00:30 - 2013-07-17 16:57 - 00000000 ____D C:\Users\test\AppData\Roaming\uTorrent
2013-12-23 23:41 - 2013-07-18 16:57 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-12-23 23:41 - 2013-07-18 14:39 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-12-23 23:41 - 2013-07-18 14:39 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-12-23 22:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-23 14:59 - 2013-12-23 14:55 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-23 11:21 - 2013-07-17 14:51 - 00000000 ____D C:\Users\test\AppData\Roaming\Origin
2013-12-23 11:21 - 2013-07-17 14:49 - 00000000 ____D C:\ProgramData\Origin
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:06 - 2013-12-21 21:05 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:58 - 2013-11-10 10:54 - 00000000 ____D C:\Users\test\AppData\Local\CrashDumps
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:19 - 2013-11-09 11:56 - 00000000 ____D C:\Users\test\AppData\Roaming\Audacity
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:34 - 2013-12-21 14:33 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:33 - 2013-12-21 14:32 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 14:00 - 2013-12-21 13:59 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:38 - 2013-12-20 22:37 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 20:01 - 2013-07-17 09:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-19 19:48 - 2013-12-09 13:45 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-12-17 14:33 - 2013-11-20 19:39 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 14:46 - 2013-12-15 11:01 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-15 14:42 - 2013-10-06 16:13 - 00024064 ___SH C:\Users\test\Documents\Thumbs.db
2013-12-15 14:01 - 2013-11-06 23:25 - 00000000 ____D C:\Users\test\AppData\Local\gtk-2.0
2013-12-15 00:54 - 2013-08-19 21:23 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 00:53 - 2013-07-26 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 00:05 - 2013-11-29 18:36 - 00000000 ____D C:\Users\test\Documents\SimCity 4
2013-12-13 20:08 - 2013-07-21 16:02 - 00000000 ____D C:\Users\test\AppData\Roaming\TS3Client
2013-12-13 11:51 - 2013-08-19 09:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-12 19:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-12 16:41 - 2013-12-12 16:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-12 15:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-12 15:47 - 2009-07-14 05:45 - 00274712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-11 16:18 - 2013-07-17 14:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 16:18 - 2013-07-17 14:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 16:18 - 2013-07-17 14:35 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-10 03:13 - 2013-10-29 11:49 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2013-12-10 03:13 - 2013-10-29 11:49 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent
2013-12-08 14:58 - 2013-11-09 19:16 - 00000000 ____D C:\Users\test\Documents\Assetto Corsa
2013-12-06 18:40 - 2013-07-22 22:03 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-05 09:42 - 2013-12-27 15:26 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-05 09:42 - 2013-12-27 15:26 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-05 09:42 - 2013-07-31 10:53 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-12-02 14:51 - 2013-07-17 23:27 - 00000000 ____D C:\Windows\Minidump
2013-12-02 14:50 - 2013-07-17 23:26 - 632873085 _____ C:\Windows\MEMORY.DMP
2013-11-30 13:15 - 2010-11-21 04:47 - 00114556 _____ C:\Windows\PFRO.log
2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat
2013-11-29 18:32 - 2013-11-29 18:31 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite
2013-11-29 18:32 - 2013-11-29 18:30 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-11-28 15:23 - 2013-07-18 16:56 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins

Files to move or delete:
====================
C:\Users\test\Game.dll


Some content of TEMP:
====================
C:\Users\test\AppData\Local\Temp\AutoRun.exe
C:\Users\test\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\test\AppData\Local\Temp\avgnt.exe
C:\Users\test\AppData\Local\Temp\bdfilters.dll
C:\Users\test\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih.exe
C:\Users\test\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\test\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\test\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\test\AppData\Local\Temp\nvStInst.exe
C:\Users\test\AppData\Local\Temp\setup.exe
C:\Users\test\AppData\Local\Temp\SHSetup.exe
C:\Users\test\AppData\Local\Temp\sonarinst.exe
C:\Users\test\AppData\Local\Temp\SRLDetectionLibrary5003431084714088478.dll
C:\Users\test\AppData\Local\Temp\_is7D5A.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-21 10:47

==================== End Of Log ============================
         
--- --- ---







Gmer

Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-27 17:59:51
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006a ATA_____ rev.A5CA 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\test\AppData\Local\Temp\kxldypow.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                0000000070cb1a22 2 bytes [CB, 70]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                0000000070cb1ad0 2 bytes [CB, 70]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                0000000070cb1b08 2 bytes [CB, 70]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                0000000070cb1bba 2 bytes [CB, 70]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                0000000070cb1bda 2 bytes [CB, 70]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                         0000000076231465 2 bytes [23, 76]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                        00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                      0000000076231465 2 bytes [23, 76]
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                     00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000076231465 2 bytes [23, 76]
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                         0000000076231465 2 bytes [23, 76]
.text   C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                        00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3440] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69            0000000076231465 2 bytes [23, 76]
.text   C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3440] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155           00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[4824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076231465 2 bytes [23, 76]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[4824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000762314bb 2 bytes [23, 76]
.text   ...                                                                                                                                                    * 2

---- Threads - GMER 2.1 ----

Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [4792:3924]                                                                                         000007fefb9a2a7c
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [4792:252]                                                                                          000007feef954830

---- EOF - GMER 2.1 ----
         
Addition

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-12-2013
Ran by test at 2013-12-27 16:19:00
Running from C:\Users\test\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

«Max Payne 3»  1.0.0.57 (x32 Version: 1.0.0.57)
µTorrent (HKCU Version: 3.3.2.30303)
Adobe Acrobat 5.0 (x32 Version: 5.0)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
ARMA 3 (x32 Version: 1)
Assetto Corsa - Technology Preview Version 0.9.6 (x32 Version: 0.9.6)
Asterisk Key 10.0 (x32)
ASUS GPU Tweak (x32 Version: 2.4.2.4)
ASUS Product Register Program (x32 Version: 1.0.022)
Audacity 2.0.5 (x32 Version: 2.0.5)
Avira Free Antivirus (x32 Version: 14.0.2.286)
Bandicam (x32 Version: 1.9.1.419)
Bandisoft MPEG-1 Decoder (x32)
Battlefield 1942™ (x32 Version: 1.6.20.0)
Battlefield 3™ (x32 Version: 1.6.0.0)
Battlefield 4™ Beta (x32 Version: 1.0.0.0)
Battlelog Web Plugins (x32 Version: 2.3.2)
Camtasia Studio 8 (x32 Version: 8.1.2.1327)
Cheat Engine 6.3 (x32)
City Car Driving 1.2.2 (x32)
CL-Eye Driver (x32 Version: 5.3.0.0341)
CPUID HWMonitor 1.23
CTDP Formula One 2006 V1.1 (x32 Version: 0.95)
DAEMON Tools Lite (x32 Version: 4.48.1.0347)
DiRT 3 (x32 Version: 1.0.0000.130)
DiRT2 (x32 Version: 1.0.0002.133)
DiRT2 (x32 Version: 1.00.0000)
DTM Experience Demo (x32)
Enable Viacam 1.7.0 (x32 Version: 1.7.0)
Endurance Series by EnduRacers - rF1 FULL (HKCU)
Endurance Series by EnduRacers - Service Pack 2.1 (HKCU)
ESN Sonar (x32 Version: 0.70.4)
Euro Truck Simulator 2 (x32 Version: 1.0.2)
Euro Truck Simulator 2 (x32)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
F1 1976 LE v1.1 (HKCU)
F1 2010 (x32 Version: 1.0.0000.132)
F1 2013 Update 2 (x32 Version: 1)
FaceTrackingAPI_NC 3.2 (x32 Version: 3.2.0)
FaceTrackNoIR version 1.7 (x32 Version: 1.7)
Fiat Abarth 500 esseesse - Street & Cup 1.01 (x32)
Formula Truck 2013 version 1.10 (x32 Version: 1.10)
Fraps (x32)
GeForce Experience NvStream Client Components (Version: 1.6.28)
GIMP 2.8.8 (Version: 2.8.8)
Grand Theft Auto IV (x32 Version: 1.00.0000)
HP Officejet 6600 - Grundlegende Software für das Gerät (Version: 25.0.619.0)
ImgBurn (x32 Version: 2.5.8.0)
Intel(R) IPP Run-Time Installer 5.3 Update 4 for Windows* on IA-32 (x32 Version: 5.3.4.087)
Intel(R) Management Engine Components (x32 Version: 9.0.0.1310)
Intel(R) Rapid Storage Technology (Version: 12.0.0.1083)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 2.0.0.100)
Intel® Trusted Connect Service Client (Version: 1.27.757.1)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 34 (64-bit) (Version: 6.0.340)
Java(TM) 6 Update 34 (x32 Version: 6.0.340)
Java(TM) 6 Update 45 (64-bit) (Version: 6.0.450)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Flight Simulator X (x32 Version: 10.0.60905)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.67.0)
Microsoft Office Word Viewer 2003 (x32 Version: 11.0.8173.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.50727.42 False (x32 Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.51011 False (x32 Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.56336 False (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.58299 False (x32 Version: 8.0.58299)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.59193 False (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable - x86 8.0.61001 (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 False (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.0 False (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 False (x32 Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 False (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 False (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 False (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 False (x32 Version: 9.0.30729.4048)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 False (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.5570 False (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.30319 False (x32 Version: 10.0.30319)
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 False (x32 Version: 11.0.50727.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 False (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 False (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 False (x32 Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 False (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 False (x32 Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610)
MMG F1 2007 V3.0.1 (x32)
Mouse Editor (x32 Version: 12.08.0006)
MOUSE Editor (x32 Version: 12.08.0006)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0)
Mozilla Maintenance Service (x32 Version: 26.0)
MSI Afterburner 2.3.1 (x32 Version: 2.3.1)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser und SDK (x32 Version: 4.20.9818.0)
NASCAR The Game 2013 (x32 Version: 1.0.0.1)
NASCAR® Racing 2003 Season (x32)
Need For Speed The Run (x32)
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82)
NVIDIA 3D Vision Treiber 331.82 (Version: 331.82)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1)
NVIDIA Grafiktreiber 331.82 (Version: 331.82)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4)
NVIDIA Install Application (Version: 2.1002.142.992)
NVIDIA LED Visualizer 1.0 (Version: 1.0)
NVIDIA Network Service (Version: 1.0)
NVIDIA PhysX (x32 Version: 9.13.0725)
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182)
NVIDIA Systemsteuerung 331.82 (Version: 331.82)
NVIDIA Update 10.11.15 (Version: 10.11.15)
NVIDIA Update Core (Version: 10.11.15)
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19)
OMSI - Der Omnibussimulator (x32 Version: 1.06)
OMSI - Hamburg (x32 Version: 1.00)
OMSI Addon Manager Version 1.2.4 (x32 Version: 1.2.4)
OpenAL (x32)
Origin (x32 Version: 9.2.1.4399)
PantsOff 2.0 (x32 Version: 2.0)
Porsche Wheel (Version: 8.10.6)
PunkBuster Services (x32 Version: 0.993)
Race On (x32)
Rapture3D 2.4.8 Game (x32)
Realtek Ethernet Controller Driver (x32 Version: 7.67.1226.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6782)
rFactor2 (x32)
Rockstar Games Social Club (x32 Version: 1.0.9.7)
Rockstar Games Social Club (x32 Version: 1.00.0000)
SHARKOON Skiller (x32 Version: 1.00.0000)
SHIELD Streaming (Version: 1.6.85)
SimCity 4 Deluxe (x32)
Skype™ 6.6 (x32 Version: 6.6.106)
Spa Francorchamps 2009 (x32 Version: 1.0)
SpinTires Tech Demo (June 060613) (x32 Version: 1.3)
Splinter Cell - Blacklist (x32)
SpyHunter (Version: 4.16.5.4290)
Steam (x32 Version: 1.0.0.0)
System Requirements Lab CYRI (x32 Version: 6.0.3.0)
TeamSpeak 3 Client (HKCU Version: 3.0.13.1)
Thrustmaster Calibration Tool (x32 Version: 1.03.0000)
Thrustmaster FFB Wheel driver (x32 Version: 2.FFJ.2007)
Tombraider (x32)
TV-Total Emulator v1.4.1.1 (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
VLC media player 2.1.0 (Version: 2.1.0)
VLN 2005 for rFactor v1.0 (x32)
War Thunder Launcher 1.0.1.269 (x32)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)
World of Warplanes (x32)

==================== Restore Points  =========================

21-12-2013 13:03:09 Microsoft Office Word Viewer 2003 wird installiert
22-12-2013 23:01:20 Windows Update
27-12-2013 14:30:05 DirectX wurde installiert
27-12-2013 15:06:41 Installed SpyHunter

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {39A65BF6-9DA3-4F81-B929-A1AD11A329C3} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe [2013-10-18] (Enigma Software Group USA, LLC.)
Task: {6F5EAFA4-F909-48A1-A7D7-171F15B73B33} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {7611F656-F4A5-480F-8075-FC0FF5F69F3C} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2013-06-21] (ASUSTek Computer Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-07-17 14:52 - 2013-11-11 16:02 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-11-20 19:39 - 2013-10-31 19:25 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-07-17 09:13 - 2013-12-27 14:38 - 00025088 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.01\PEbiosinterface32.dll
2013-07-17 09:13 - 2012-05-08 08:04 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.01\ATKEX.dll
2010-12-02 10:56 - 2010-12-02 10:56 - 00815104 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\OSD_Text\OSD_Text.dll
2011-01-09 13:45 - 2011-01-09 13:45 - 00088064 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_MouseDeviceManager.dll
2012-06-14 08:59 - 2012-06-14 08:59 - 02414080 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\ScreenCapture\ScreenCapture.dll
2012-05-17 04:17 - 2012-05-17 04:17 - 01000448 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\TrayIconWebAdvertisement\TrayIconWebAdvertisement.dll
2010-09-20 07:18 - 2010-09-20 07:18 - 00085504 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ZoomControl.dll
2010-09-20 07:18 - 2010-09-20 07:18 - 00054272 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ScrollbarControl.dll
2011-04-12 08:14 - 2011-04-12 08:14 - 00063488 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInRight.dll
2010-11-01 13:16 - 2010-11-01 13:16 - 00062976 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInOne.dll
2012-04-27 04:40 - 2012-04-27 04:40 - 00118272 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_Wheel4D.dll
2013-12-12 16:40 - 2013-12-12 16:41 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-07-17 09:47 - 2013-01-23 08:57 - 01199576 ____R () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2013-12-27 12:56 - 2012-09-25 23:46 - 00445800 _____ () C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\cudart32_50_35.dll
2013-12-27 12:56 - 2012-05-27 01:36 - 00054272 _____ () C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\pthreadVC2.dll
2013-06-20 11:01 - 2013-06-20 11:01 - 00258048 _____ () C:\Program Files (x86)\ASUS\GPU Tweak\Vender.dll
2013-05-14 15:11 - 2013-05-14 15:11 - 00049152 _____ () C:\Program Files (x86)\ASUS\GPU Tweak\Exeio.dll
2013-11-20 19:39 - 2013-10-31 19:25 - 00394808 _____ () c:\program files (x86)\avira\antivir desktop\sqlite3.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:D73C9AB3
AlternateDataStreams: C:\ProgramData\TEMP:F1A5FE8B

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/27/2013 02:40:31 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/27/2013 02:15:18 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/27/2013 01:37:03 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/27/2013 01:37:02 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/27/2013 11:03:04 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 08:08:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/26/2013 08:08:55 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/26/2013 06:21:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 05:01:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 03:44:38 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (12/27/2013 03:06:47 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Diagnosesystemhost" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sitzungs-Manager für Desktopfenster-Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Überwachung verteilter Verknüpfungen (Client)" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Superfetch" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Programmkompatibilitäts-Assistent-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerkverbindungen" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PnP-X-IP-Busenumerator" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/27/2013 03:04:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (12/27/2013 02:40:31 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/27/2013 02:15:18 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/27/2013 01:37:03 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Support\Tools\MAS2.exe

Error: (12/27/2013 01:37:02 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Core\ModMgr.exe

Error: (12/27/2013 11:03:04 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 08:08:56 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Support\Tools\MAS2.exe

Error: (12/26/2013 08:08:55 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Games\rFactor2\Core\ModMgr.exe

Error: (12/26/2013 06:21:46 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 05:01:45 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/26/2013 03:44:38 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2013-07-21 16:53:02.592
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-21 16:53:02.576
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-21 16:53:02.184
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-21 16:53:02.169
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-17 23:00:22.126
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-17 23:00:22.116
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\test\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-17 23:00:21.732
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-17 23:00:21.722
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 8131.85 MB
Available physical RAM: 4604.38 MB
Total Pagefile: 16261.88 MB
Available Pagefile: 11714.9 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:47.14 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 0FB3C24D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
MBAM-Scan

Code:
ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.27.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
test :: MIKE-PC [limitiert]

27.12.2013 15:20:52
MBAM-log-2013-12-27 (17-39-15).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 657601
Laufzeit: 2 Stunde(n), 5 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0R0DtO0U1C1S1U1StR0J1Q2P1J1K1I2R -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 5
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=hp&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Bar (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|SearchAssistant (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&q={searchTerms}&installDate=03/10/2013) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 6
C:\Users\test\AppData\Local\Temp\58hzMFNi.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt.
C:\Users\test\AppData\Local\Temp\AgBF3Zr1.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt.
C:\Users\test\AppData\Local\Temp\DHIPdIaj.exe.part (PUP.Optional.Installex) -> Keine Aktion durchgeführt.
C:\Users\test\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih.exe (Trojan.Repacked) -> Keine Aktion durchgeführt.
C:\Users\test\AppData\Local\Temp\qWurm_Tk.exe.part (PUP.Optional.InstalleRex) -> Keine Aktion durchgeführt.
C:\Users\test\Downloads\pantsoff.exe (PUP.PSWTool.Finder) -> Keine Aktion durchgeführt.

(Ende)
         
Hoffe es klappt jetzt.




Mit freundlichen Grüßen

Mike
__________________

Alt 29.12.2013, 11:25   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Bit Coin Miner "Befall" - Standard

Windows 7: Bit Coin Miner "Befall"



MBAM die Funde auch löschen lassen.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 29.12.2013, 11:53   #5
IMrIMike
 
Windows 7: Bit Coin Miner "Befall" - Standard

Windows 7: Bit Coin Miner "Befall"



MBAM Quarantäne gesäubert.

Code:
ATTFilter
# AdwCleaner v3.016 - Bericht erstellt am 29/12/2013 um 11:38:03
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : test - MIKE-PC
# Gestartet von : C:\Users\test\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\test\AppData\Local\Temp\OCS
Datei Gelöscht : C:\Windows\System32\Tasks\SpyHunter4Startup

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{50F7F0BE-31BA-4145-BD8B-6B0DECFED804}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\Softonic

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\prefs.js ]

Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?publisher=TightropeYB&dpid=TightropeYB&co=DE&userid=75d8dcdb-b9a2-d72b-686b-2e1121e35015&searchtype=ds&installDate={installDate}&q=");

*************************

AdwCleaner[R0].txt - [2895 octets] - [29/12/2013 11:37:14]
AdwCleaner[S0].txt - [2222 octets] - [29/12/2013 11:38:03]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2282 octets] ##########
         
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by test on 29.12.2013 at 11:42:10,88
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\test\AppData\Roaming\mozilla\firefox\profiles\bnbt9bpx.default\minidumps [128 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.12.2013 at 11:45:27,27
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-12-2013
Ran by test (administrator) on MIKE-PC on 29-12-2013 11:46:42
Running from C:\Users\test\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe
() C:\Windows\SysWOW64\ASGT.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
() C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe
(ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ASUS) C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
() C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\dllhost.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation)
HKLM-x32\...\Run: [GamingKeyboard] - C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [HP Officejet 6600 (NET)] - C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.)
HKCU\...\Run: [OscarEditor] - C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe [3333632 2012-08-16] ()
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKCU\...\RunOnce: [Temp] - C:\Users\test\AppData\Roaming\Microsoft\Windows\Temp\system.vbs [2149 2013-12-27] ()
MountPoints2: {27be5a93-ee35-11e2-b16b-806e6f6e6963} - D:\Bin\ASSETUP.exe
Startup: C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFE6EA923CC82CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: WOT - {9E571C81-21E7-496B-9E6B-127E60263022} - C:\Users\test\AppData\LocalLow\WOT\IE\WOT.dll (WOT Services Oy)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default
FF NewTab: about:blank
FF Homepage: google.de
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*'))%20%7B%20return%20'PROXY%20nq-us10.personalitycores.com%3A8000%3B%20PROXY%20nq-us12.personalitycores.com%3A8000%3B%20PROXY%20nq-us08.personalitycores.com%3A8000%3B%20PROXY%20nq-us11.personalitycores.com%3A8000%3B%20PROXY%20nq-us09.personalitycores.com%3A8000%3B%20PROXY%20nq-us07.personalitycores.com%3A8000%3B%20PROXY%20nq-us04.personalitycores.com%3A8000%3B%20PROXY%20nq-us05.personalitycores.com%3A8000%3B%20PROXY%20nq-us06.personalitycores.com%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=1.6.0_45 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxMate - Proxy on steroids! - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi
FF Extension: Adblock Plus - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [927232 2012-10-29] ()
R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] ()
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-01-23] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-09-30] ()
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.)
S3 SystemExplorerHelpService; C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe [821720 2012-11-25] (Mister Group)
R2 WOTUpdater; C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] ()

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-29] (Disc Soft Ltd)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S3 FanatecWheelFilterUsb; C:\Windows\System32\DRIVERS\FWFilterUsb.sys [64688 2013-02-15] (Windows (R) Codename Longhorn DDK provider)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation)
R3 IOMap; C:\Windows\system32\drivers\IOMap64.sys [24824 2013-02-19] (ASUSTeK Computer Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
S3 PorscheWheelFilterUsb; C:\Windows\System32\DRIVERS\PWFilterUsb.sys [58448 2010-12-15] (Windows (R) Codename Longhorn DDK provider)
S3 vhidmini; C:\Windows\System32\DRIVERS\vjoy.sys [15104 2012-10-15] (Headsoft)
S3 WinRing0_1_2_0; \??\C:\Users\test\AppData\Local\Temp\tmp7712.tmp [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-29 11:46 - 2013-12-29 11:46 - 00017123 _____ C:\Users\test\Desktop\FRST.txt
2013-12-29 11:46 - 2013-12-29 11:46 - 00000000 ____D C:\Users\test\Desktop\FRST-OlderVersion
2013-12-29 11:45 - 2013-12-29 11:45 - 00000756 _____ C:\Users\test\Desktop\JRT.txt
2013-12-29 11:42 - 2013-12-29 11:42 - 00000000 ____D C:\Windows\ERUNT
2013-12-29 11:39 - 2013-02-19 18:02 - 00024824 _____ (ASUSTeK Computer Inc.) C:\Windows\system32\Drivers\IOMap64.sys
2013-12-29 11:38 - 2013-12-29 11:38 - 00002370 _____ C:\Users\test\Desktop\AdwCleaner[S0].txt
2013-12-29 11:37 - 2013-12-29 11:40 - 00000000 ____D C:\AdwCleaner
2013-12-29 11:34 - 2013-12-29 11:35 - 01034531 _____ (Thisisu) C:\Users\test\Desktop\JRT.exe
2013-12-29 11:33 - 2013-12-29 11:33 - 01233962 _____ C:\Users\test\Desktop\adwcleaner.exe
2013-12-29 11:26 - 2013-12-29 11:35 - 25267933 _____ C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man.rar
2013-12-27 20:28 - 2013-12-27 20:28 - 00000342 _____ C:\Users\test\Downloads\defogger_enable.log
2013-12-27 16:50 - 2013-12-27 16:54 - 00000000 ____D C:\ProgramData\SystemExplorer
2013-12-27 16:50 - 2013-12-27 16:50 - 00000000 ____D C:\Program Files (x86)\System Explorer
2013-12-27 16:49 - 2013-12-27 16:50 - 01978640 _____ (Mister Group                                                ) C:\Users\test\Downloads\SystemExplorerSetup_450.exe
2013-12-27 16:20 - 2013-12-27 16:20 - 00377856 _____ C:\Users\test\Desktop\gmer_2.1.19163.exe
2013-12-27 16:15 - 2013-12-29 11:46 - 00000000 ____D C:\FRST
2013-12-27 16:14 - 2013-12-29 11:46 - 01931262 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2012-06-22 11:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-12-27 16:06 - 2013-12-27 16:07 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:26 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-27 15:26 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-27 15:07 - 2013-12-27 15:08 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:48 - 2013-12-27 14:50 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-27 11:15 - 2013-12-27 14:03 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:32 - 2013-12-26 22:48 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:51 - 2013-12-25 22:50 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-23 22:40 - 2013-12-26 12:07 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-23 14:55 - 2013-12-23 14:59 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:05 - 2013-12-21 21:06 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:33 - 2013-12-21 14:34 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:32 - 2013-12-21 14:33 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 13:59 - 2013-12-21 14:00 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:37 - 2013-12-20 22:38 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 11:01 - 2013-12-15 14:46 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-12 16:40 - 2013-12-12 16:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-11 22:14 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-11 22:14 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 22:13 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 22:13 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-11 22:13 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 22:13 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-11 22:13 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-11 22:13 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 22:13 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-11 22:13 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-11 22:13 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-11 22:13 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-11 22:13 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 22:13 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 22:13 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-11 22:13 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 11:52 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 11:52 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 11:52 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 11:52 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 11:52 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 11:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 11:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 11:50 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 11:50 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 11:50 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 11:50 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 11:50 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 11:50 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 11:50 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 
2013-12-09 13:45 - 2013-12-19 19:48 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-11-30 23:52 - 2013-09-25 11:42 - 00033720 _____ C:\Users\test\Documents\turbo_int.ogg
2013-11-29 18:36 - 2013-12-15 00:05 - 00000000 ____D C:\Users\test\Documents\SimCity 4
2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat
2013-11-29 18:31 - 2013-11-29 18:32 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite
2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-11-29 18:30 - 2013-11-29 18:32 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite

==================== One Month Modified Files and Folders =======

2013-12-29 11:46 - 2013-12-29 11:46 - 00017123 _____ C:\Users\test\Desktop\FRST.txt
2013-12-29 11:46 - 2013-12-29 11:46 - 00000000 ____D C:\Users\test\Desktop\FRST-OlderVersion
2013-12-29 11:46 - 2013-12-27 16:15 - 00000000 ____D C:\FRST
2013-12-29 11:46 - 2013-12-27 16:14 - 01931262 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-29 11:45 - 2013-12-29 11:45 - 00000756 _____ C:\Users\test\Desktop\JRT.txt
2013-12-29 11:42 - 2013-12-29 11:42 - 00000000 ____D C:\Windows\ERUNT
2013-12-29 11:42 - 2013-07-16 17:37 - 02032431 _____ C:\Windows\WindowsUpdate.log
2013-12-29 11:40 - 2013-12-29 11:37 - 00000000 ____D C:\AdwCleaner
2013-12-29 11:39 - 2009-07-14 05:51 - 00094034 _____ C:\Windows\setupact.log
2013-12-29 11:38 - 2013-12-29 11:38 - 00002370 _____ C:\Users\test\Desktop\AdwCleaner[S0].txt
2013-12-29 11:38 - 2013-07-17 14:53 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-29 11:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-29 11:35 - 2013-12-29 11:34 - 01034531 _____ (Thisisu) C:\Users\test\Desktop\JRT.exe
2013-12-29 11:35 - 2013-12-29 11:26 - 25267933 _____ C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man.rar
2013-12-29 11:33 - 2013-12-29 11:33 - 01233962 _____ C:\Users\test\Desktop\adwcleaner.exe
2013-12-29 11:21 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-29 11:21 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-29 11:18 - 2013-07-17 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-29 00:42 - 2013-10-04 11:23 - 00549188 _____ C:\NPClient.log
2013-12-27 20:28 - 2013-12-27 20:28 - 00000342 _____ C:\Users\test\Downloads\defogger_enable.log
2013-12-27 20:28 - 2013-07-16 17:37 - 00000000 ____D C:\Users\test
2013-12-27 19:49 - 2013-10-19 10:55 - 00000000 ____D C:\Program Files (x86)\MSI Afterburner
2013-12-27 17:41 - 2010-11-21 04:47 - 00116168 _____ C:\Windows\PFRO.log
2013-12-27 16:54 - 2013-12-27 16:50 - 00000000 ____D C:\ProgramData\SystemExplorer
2013-12-27 16:50 - 2013-12-27 16:50 - 00000000 ____D C:\Program Files (x86)\System Explorer
2013-12-27 16:50 - 2013-12-27 16:49 - 01978640 _____ (Mister Group                                                ) C:\Users\test\Downloads\SystemExplorerSetup_450.exe
2013-12-27 16:20 - 2013-12-27 16:20 - 00377856 _____ C:\Users\test\Desktop\gmer_2.1.19163.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2013-12-27 16:06 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:43 - 2013-07-17 15:05 - 00000000 ____D C:\Games
2013-12-27 15:31 - 2013-07-17 15:05 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA
2013-12-27 15:30 - 2013-11-13 23:33 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA Corporation
2013-12-27 15:30 - 2013-07-17 14:52 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-12-27 15:07 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:08 - 2013-12-27 14:50 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:50 - 2013-12-27 14:48 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 14:33 - 2013-07-16 17:37 - 00000000 ___RD C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 14:33 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-27 14:32 - 2013-10-29 14:17 - 00000022 _____ C:\Windows\GPU-Z.INI
2013-12-27 14:03 - 2013-12-27 11:15 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-27 13:16 - 2013-07-17 15:06 - 00000000 ____D C:\Users\test\Documents\Euro Truck Simulator 2
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-27 13:05 - 2013-11-09 11:45 - 00000000 ____D C:\Users\test\AppData\Roaming\vlc
2013-12-27 12:57 - 2013-07-17 14:49 - 00000000 ____D C:\Program Files (x86)\Origin
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:48 - 2013-12-26 22:32 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-26 12:12 - 2013-11-06 23:13 - 00000000 ____D C:\Users\test\.gimp-2.8
2013-12-26 12:07 - 2013-12-23 22:40 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:50 - 2013-12-25 22:51 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 22:58 - 2011-04-12 08:43 - 00697658 _____ C:\Windows\system32\perfh007.dat
2013-12-24 22:58 - 2011-04-12 08:43 - 00148452 _____ C:\Windows\system32\perfc007.dat
2013-12-24 22:58 - 2009-07-14 06:13 - 01615906 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-24 00:30 - 2013-07-17 16:57 - 00000000 ____D C:\Users\test\AppData\Roaming\uTorrent
2013-12-23 23:41 - 2013-07-18 16:57 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-12-23 23:41 - 2013-07-18 14:39 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-12-23 23:41 - 2013-07-18 14:39 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-12-23 22:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00115436 _____ C:\Users\test\Desktop\MAN TGX SUNSHIELD TEST.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:59 - 2013-12-23 14:59 - 00002729 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-23 14:59 - 2013-12-23 14:55 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-23 11:21 - 2013-07-17 14:51 - 00000000 ____D C:\Users\test\AppData\Roaming\Origin
2013-12-23 11:21 - 2013-07-17 14:49 - 00000000 ____D C:\ProgramData\Origin
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:06 - 2013-12-21 21:05 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:58 - 2013-11-10 10:54 - 00000000 ____D C:\Users\test\AppData\Local\CrashDumps
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:19 - 2013-11-09 11:56 - 00000000 ____D C:\Users\test\AppData\Roaming\Audacity
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:34 - 2013-12-21 14:33 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:33 - 2013-12-21 14:32 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 14:00 - 2013-12-21 13:59 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:38 - 2013-12-20 22:37 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 20:01 - 2013-07-17 09:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-19 19:48 - 2013-12-09 13:45 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-12-17 14:33 - 2013-11-20 19:39 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 14:46 - 2013-12-15 11:01 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-15 14:42 - 2013-10-06 16:13 - 00024064 ___SH C:\Users\test\Documents\Thumbs.db
2013-12-15 14:01 - 2013-11-06 23:25 - 00000000 ____D C:\Users\test\AppData\Local\gtk-2.0
2013-12-15 00:54 - 2013-08-19 21:23 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 00:53 - 2013-07-26 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 00:05 - 2013-11-29 18:36 - 00000000 ____D C:\Users\test\Documents\SimCity 4
2013-12-13 20:08 - 2013-07-21 16:02 - 00000000 ____D C:\Users\test\AppData\Roaming\TS3Client
2013-12-13 11:51 - 2013-08-19 09:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-12 19:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-12 16:41 - 2013-12-12 16:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-12 15:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-12 15:47 - 2009-07-14 05:45 - 00274712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-11 16:18 - 2013-07-17 14:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 16:18 - 2013-07-17 14:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 16:18 - 2013-07-17 14:35 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-10 03:13 - 2013-10-29 11:49 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2013-12-10 03:13 - 2013-10-29 11:49 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 
2013-12-08 14:58 - 2013-11-09 19:16 - 00000000 ____D C:\Users\test\Documents\Assetto Corsa
2013-12-06 18:40 - 2013-07-22 22:03 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-05 09:42 - 2013-12-27 15:26 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-05 09:42 - 2013-12-27 15:26 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-05 09:42 - 2013-07-31 10:53 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-12-02 14:51 - 2013-07-17 23:27 - 00000000 ____D C:\Windows\Minidump
2013-12-02 14:50 - 2013-07-17 23:26 - 632873085 _____ C:\Windows\MEMORY.DMP
2013-11-29 18:34 - 2013-11-29 18:34 - 00000533 _____ C:\Windows\eReg.dat
2013-11-29 18:32 - 2013-11-29 18:31 - 00000000 ____D C:\Users\test\AppData\Roaming\DAEMON Tools Lite
2013-11-29 18:32 - 2013-11-29 18:30 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-11-29 18:31 - 2013-11-29 18:31 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-11-29 18:31 - 2013-11-29 18:31 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite

Files to move or delete:
====================
C:\Users\test\Game.dll


Some content of TEMP:
====================
C:\Users\test\AppData\Local\Temp\AutoRun.exe
C:\Users\test\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\test\AppData\Local\Temp\avgnt.exe
C:\Users\test\AppData\Local\Temp\bdfilters.dll
C:\Users\test\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\test\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\test\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\test\AppData\Local\Temp\nvStInst.exe
C:\Users\test\AppData\Local\Temp\Quarantine.exe
C:\Users\test\AppData\Local\Temp\setup.exe
C:\Users\test\AppData\Local\Temp\SHSetup.exe
C:\Users\test\AppData\Local\Temp\sonarinst.exe
C:\Users\test\AppData\Local\Temp\SRLDetectionLibrary5003431084714088478.dll
C:\Users\test\AppData\Local\Temp\_is7D5A.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-21 10:47

==================== End Of Log ============================
         
--- --- ---


Alt 30.12.2013, 10:36   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Bit Coin Miner "Befall" - Standard

Windows 7: Bit Coin Miner "Befall"




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
--> Windows 7: Bit Coin Miner "Befall"

Alt 30.12.2013, 15:54   #7
IMrIMike
 
Windows 7: Bit Coin Miner "Befall" - Standard

Windows 7: Bit Coin Miner "Befall"



Um ehrlich zu sein,habe ich mir gestern einige Posts zum selben Thema durchgelesen,und aufgrund einiger Lösungsvorschläge mal selbst Hand anzulegen.Bei mir wars in der Tat einer von zwei dllhost´s,die nicht im Windows32 Ordner lag,sondern im Temp.Den fälschlichen Dienst habe ich gestoppt,und den kompletten Inhalt aus dem Temp Ordner gelöscht.Und siehe da,selbst nach Neustarts bleibt die Auslastung der Graka so wie sie sein sollte.Hab ich nun den Virus komplett entfernt oder sind da noch Reste wie Registryeinträge o.ä.?
Für alle Fälle:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=607d8f7097ce614e83aae8351f9ac2be
# engine=16442
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-30 11:36:57
# local_time=2013-12-30 12:36:57 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 10569 5163099 3355 0
# compatibility_mode=5893 16776574 100 94 3531378 140033267 0 0
# scanned=476177
# found=0
# cleaned=0
# scan_time=6094
         
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.77  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java(TM) 6 Update 34  
 Java 7 Update 45  
 Adobe Flash Player 11.9.900.170  
 Adobe Reader XI  
 Mozilla Firefox (26.0) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-12-2013 01
Ran by test (administrator) on MIKE-PC on 30-12-2013 13:29:53
Running from C:\Users\test\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe
() C:\Windows\SysWOW64\ASGT.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicator.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps64.dat
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation)
HKLM-x32\...\Run: [GamingKeyboard] - C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [HP Officejet 6600 (NET)] - C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.)
HKCU\...\Run: [OscarEditor] - C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe [3333632 2012-08-16] ()
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
MountPoints2: {27be5a93-ee35-11e2-b16b-806e6f6e6963} - D:\Bin\ASSETUP.exe
Startup: C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFE6EA923CC82CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: WOT - {9E571C81-21E7-496B-9E6B-127E60263022} - C:\Users\test\AppData\LocalLow\WOT\IE\WOT.dll (WOT Services Oy)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default
FF NewTab: about:blank
FF Homepage: google.de
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*'))%20%7B%20return%20'PROXY%20nq-us07.personalitycores.com%3A8000%3B%20PROXY%20nq-us11.personalitycores.com%3A8000%3B%20PROXY%20nq-us04.personalitycores.com%3A8000%3B%20PROXY%20nq-us08.personalitycores.com%3A8000%3B%20PROXY%20nq-us09.personalitycores.com%3A8000%3B%20PROXY%20nq-us10.personalitycores.com%3A8000%3B%20PROXY%20nq-us05.personalitycores.com%3A8000%3B%20PROXY%20nq-us12.personalitycores.com%3A8000%3B%20PROXY%20nq-us06.personalitycores.com%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "ftp", "81.201.57.65"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "81.201.57.65"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "81.201.57.65"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "81.201.57.65"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=1.6.0_45 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxMate - Proxy on steroids! - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi
FF Extension: Stealthy - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\stealthyextension@gmail.com.xpi
FF Extension: Adblock Plus - C:\Users\test\AppData\Roaming\Mozilla\Firefox\Profiles\bnbt9bpx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [927232 2012-10-29] ()
R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] ()
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-01-23] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-09-30] ()
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.)
S3 SystemExplorerHelpService; C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe [821720 2012-11-25] (Mister Group)
R2 WOTUpdater; C:\Users\test\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] ()

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-29] (Disc Soft Ltd)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S3 FanatecWheelFilterUsb; C:\Windows\System32\DRIVERS\FWFilterUsb.sys [64688 2013-02-15] (Windows (R) Codename Longhorn DDK provider)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
R3 PorscheWheelFilterUsb; C:\Windows\System32\DRIVERS\PWFilterUsb.sys [58448 2010-12-15] (Windows (R) Codename Longhorn DDK provider)
S3 vhidmini; C:\Windows\System32\DRIVERS\vjoy.sys [15104 2012-10-15] (Headsoft)
R4 IOMap; \??\C:\Windows\system32\drivers\IOMap64.sys [x]
S3 WinRing0_1_2_0; \??\C:\Users\test\AppData\Local\Temp\tmp7712.tmp [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-30 13:29 - 2013-12-30 13:29 - 00017639 _____ C:\Users\test\Desktop\FRST.txt
2013-12-30 13:29 - 2013-12-30 13:29 - 00000000 ____D C:\Users\test\Desktop\FRST-OlderVersion
2013-12-30 12:50 - 2013-12-30 12:50 - 00000863 _____ C:\Users\test\Desktop\checkup.txt
2013-12-30 12:50 - 2013-12-30 12:45 - 00002588 _____ C:\Users\test\Desktop\config.cfg
2013-12-30 10:53 - 2013-12-30 10:53 - 00891200 _____ C:\Users\test\Desktop\SecurityCheck.exe
2013-12-30 10:50 - 2013-12-30 10:50 - 02347384 _____ (ESET) C:\Users\test\Downloads\esetsmartinstaller_enu.exe
2013-12-29 22:34 - 2013-12-29 22:34 - 00000000 ____D C:\Users\test\Downloads\HUNGARY_MAP_by_FRANK007_v0.9_2-ets2downloads.com
2013-12-29 22:31 - 2013-12-29 22:31 - 163243289 _____ C:\Users\test\Downloads\HUNGARY_MAP_by_FRANK007_v0.9_2-ets2downloads.com.rar
2013-12-29 19:20 - 2013-12-29 19:20 - 00000000 ____D C:\Users\test\Downloads\MAN_TGA
2013-12-29 18:50 - 2013-12-29 18:57 - 50659460 _____ C:\Users\test\Downloads\MAN_TGA.rar
2013-12-29 17:25 - 2013-12-29 17:25 - 00003992 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-29 17:17 - 2013-12-29 17:17 - 00000000 _____ C:\Users\test\Downloads\map.txt
2013-12-29 17:16 - 2013-12-29 17:16 - 00001657 _____ C:\Users\test\Downloads\001.pmd
2013-12-29 17:16 - 2013-12-29 17:16 - 00000843 _____ C:\Users\test\Downloads\001.txt
2013-12-29 17:16 - 2013-03-29 15:59 - 00004804 _____ C:\Users\test\Desktop\truck.pmc
2013-12-29 17:16 - 2013-03-29 15:59 - 00001657 _____ C:\Users\test\Desktop\truck.pmd
2013-12-29 17:15 - 2013-12-29 17:15 - 00807424 _____ C:\Users\test\Downloads\etsedit.exe
2013-12-29 17:15 - 2013-03-29 15:59 - 09671020 _____ C:\Users\test\Desktop\truck.pmg
2013-12-29 15:14 - 2013-12-29 15:14 - 00000673 _____ C:\Users\test\Mike - Verknüpfung.lnk
2013-12-29 11:55 - 2013-12-29 11:55 - 05216475 _____ C:\Users\test\Desktop\Man open pipe sound Kriechbaum.scs
2013-12-29 11:54 - 2013-12-29 12:30 - 00000000 ____D C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man
2013-12-29 11:42 - 2013-12-29 11:42 - 00000000 ____D C:\Windows\ERUNT
2013-12-29 11:37 - 2013-12-29 11:40 - 00000000 ____D C:\AdwCleaner
2013-12-29 11:34 - 2013-12-29 11:35 - 01034531 _____ (Thisisu) C:\Users\test\Desktop\JRT.exe
2013-12-29 11:33 - 2013-12-29 11:33 - 01233962 _____ C:\Users\test\Desktop\adwcleaner.exe
2013-12-29 11:26 - 2013-12-29 11:35 - 25267933 _____ C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man.rar
2013-12-27 20:28 - 2013-12-27 20:28 - 00000342 _____ C:\Users\test\Downloads\defogger_enable.log
2013-12-27 16:50 - 2013-12-27 16:54 - 00000000 ____D C:\ProgramData\SystemExplorer
2013-12-27 16:50 - 2013-12-27 16:50 - 00000000 ____D C:\Program Files (x86)\System Explorer
2013-12-27 16:49 - 2013-12-27 16:50 - 01978640 _____ (Mister Group                                                ) C:\Users\test\Downloads\SystemExplorerSetup_450.exe
2013-12-27 16:20 - 2013-12-27 16:20 - 00377856 _____ C:\Users\test\Desktop\gmer_2.1.19163.exe
2013-12-27 16:15 - 2013-12-30 13:29 - 00000000 ____D C:\FRST
2013-12-27 16:14 - 2013-12-30 13:29 - 01931302 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2012-06-22 11:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-12-27 16:06 - 2013-12-27 16:07 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:26 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-27 15:26 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-27 15:07 - 2013-12-27 15:08 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:48 - 2013-12-27 14:50 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-27 11:15 - 2013-12-27 14:03 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:32 - 2013-12-26 22:48 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:51 - 2013-12-25 22:50 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-23 22:40 - 2013-12-26 12:07 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-29 17:26 - 00176297 _____ C:\Users\test\Desktop\MAN TGX Sunshield test.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:55 - 2013-12-23 14:59 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:05 - 2013-12-21 21:06 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:33 - 2013-12-21 14:34 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:32 - 2013-12-21 14:33 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 13:59 - 2013-12-21 14:00 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:37 - 2013-12-20 22:38 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 11:01 - 2013-12-15 14:46 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-12 16:40 - 2013-12-12 16:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-11 22:14 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-11 22:14 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-11 22:14 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 22:13 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 22:13 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-11 22:13 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 22:13 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-11 22:13 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-11 22:13 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 22:13 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-11 22:13 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-11 22:13 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-11 22:13 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-11 22:13 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-11 22:13 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 22:13 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 22:13 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-11 22:13 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-11 22:13 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-11 22:13 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 22:13 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-11 22:13 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 22:13 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-11 22:13 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 22:13 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 11:52 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 11:52 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 11:52 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 11:52 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 11:52 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 11:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 11:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 11:50 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 11:50 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 11:50 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 11:50 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 11:50 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 11:50 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 11:50 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 11:50 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 11:50 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent
2013-12-09 13:45 - 2013-12-19 19:48 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-11-30 23:52 - 2013-09-25 11:42 - 00033720 _____ C:\Users\test\Documents\turbo_int.ogg

==================== One Month Modified Files and Folders =======

2013-12-30 13:30 - 2013-12-30 13:29 - 00017639 _____ C:\Users\test\Desktop\FRST.txt
2013-12-30 13:29 - 2013-12-30 13:29 - 00000000 ____D C:\Users\test\Desktop\FRST-OlderVersion
2013-12-30 13:29 - 2013-12-27 16:15 - 00000000 ____D C:\FRST
2013-12-30 13:29 - 2013-12-27 16:14 - 01931302 _____ (Farbar) C:\Users\test\Desktop\FRST64.exe
2013-12-30 13:18 - 2013-07-17 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-30 13:06 - 2013-10-04 11:23 - 00571011 _____ C:\NPClient.log
2013-12-30 13:06 - 2013-07-17 15:06 - 00000000 ____D C:\Users\test\Documents\Euro Truck Simulator 2
2013-12-30 12:50 - 2013-12-30 12:50 - 00000863 _____ C:\Users\test\Desktop\checkup.txt
2013-12-30 12:45 - 2013-12-30 12:50 - 00002588 _____ C:\Users\test\Desktop\config.cfg
2013-12-30 12:33 - 2013-07-16 17:37 - 02079079 _____ C:\Windows\WindowsUpdate.log
2013-12-30 11:35 - 2013-11-10 10:54 - 00000000 ____D C:\Users\test\AppData\Local\CrashDumps
2013-12-30 10:53 - 2013-12-30 10:53 - 00891200 _____ C:\Users\test\Desktop\SecurityCheck.exe
2013-12-30 10:50 - 2013-12-30 10:50 - 02347384 _____ (ESET) C:\Users\test\Downloads\esetsmartinstaller_enu.exe
2013-12-30 10:43 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-30 10:43 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-30 10:35 - 2013-07-17 14:53 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-30 10:35 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-30 10:35 - 2009-07-14 05:51 - 00094706 _____ C:\Windows\setupact.log
2013-12-29 22:34 - 2013-12-29 22:34 - 00000000 ____D C:\Users\test\Downloads\HUNGARY_MAP_by_FRANK007_v0.9_2-ets2downloads.com
2013-12-29 22:31 - 2013-12-29 22:31 - 163243289 _____ C:\Users\test\Downloads\HUNGARY_MAP_by_FRANK007_v0.9_2-ets2downloads.com.rar
2013-12-29 22:19 - 2013-07-17 16:57 - 00000000 ____D C:\Users\test\AppData\Roaming\uTorrent
2013-12-29 19:20 - 2013-12-29 19:20 - 00000000 ____D C:\Users\test\Downloads\MAN_TGA
2013-12-29 18:57 - 2013-12-29 18:50 - 50659460 _____ C:\Users\test\Downloads\MAN_TGA.rar
2013-12-29 18:48 - 2013-12-29 15:06 - 00000000 ____D C:\Users\test\Downloads\NASCAR.The.Game.2013.Update.2-SKIDROW
2013-12-29 17:26 - 2013-12-23 15:02 - 00176297 _____ C:\Users\test\Desktop\MAN TGX Sunshield test.scs
2013-12-29 17:25 - 2013-12-29 17:25 - 00003992 _____ C:\Users\test\AppData\Local\recently-used.xbel
2013-12-29 17:25 - 2013-11-06 23:13 - 00000000 ____D C:\Users\test\.gimp-2.8
2013-12-29 17:24 - 2013-11-06 23:25 - 00000000 ____D C:\Users\test\AppData\Local\gtk-2.0
2013-12-29 17:17 - 2013-12-29 17:17 - 00000000 _____ C:\Users\test\Downloads\map.txt
2013-12-29 17:16 - 2013-12-29 17:16 - 00001657 _____ C:\Users\test\Downloads\001.pmd
2013-12-29 17:16 - 2013-12-29 17:16 - 00000843 _____ C:\Users\test\Downloads\001.txt
2013-12-29 17:15 - 2013-12-29 17:15 - 00807424 _____ C:\Users\test\Downloads\etsedit.exe
2013-12-29 15:34 - 2013-07-18 16:57 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-12-29 15:34 - 2013-07-18 14:39 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-12-29 15:33 - 2013-07-18 14:39 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-12-29 15:30 - 2013-07-17 14:49 - 00000000 ____D C:\Program Files (x86)\Origin
2013-12-29 15:19 - 2013-07-19 18:55 - 00007610 _____ C:\Users\test\AppData\Local\Resmon.ResmonCfg
2013-12-29 15:14 - 2013-12-29 15:14 - 00000673 _____ C:\Users\test\Mike - Verknüpfung.lnk
2013-12-29 15:14 - 2013-07-16 17:37 - 00000000 ____D C:\Users\test
2013-12-29 12:30 - 2013-12-29 11:54 - 00000000 ____D C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man
2013-12-29 11:56 - 2013-11-09 11:45 - 00000000 ____D C:\Users\test\AppData\Roaming\vlc
2013-12-29 11:55 - 2013-12-29 11:55 - 05216475 _____ C:\Users\test\Desktop\Man open pipe sound Kriechbaum.scs
2013-12-29 11:42 - 2013-12-29 11:42 - 00000000 ____D C:\Windows\ERUNT
2013-12-29 11:40 - 2013-12-29 11:37 - 00000000 ____D C:\AdwCleaner
2013-12-29 11:35 - 2013-12-29 11:34 - 01034531 _____ (Thisisu) C:\Users\test\Desktop\JRT.exe
2013-12-29 11:35 - 2013-12-29 11:26 - 25267933 _____ C:\Users\test\Downloads\6 in line open pipe sound for Volvo, Scania, Renault & Man.rar
2013-12-29 11:33 - 2013-12-29 11:33 - 01233962 _____ C:\Users\test\Desktop\adwcleaner.exe
2013-12-27 20:28 - 2013-12-27 20:28 - 00000342 _____ C:\Users\test\Downloads\defogger_enable.log
2013-12-27 19:49 - 2013-10-19 10:55 - 00000000 ____D C:\Program Files (x86)\MSI Afterburner
2013-12-27 17:41 - 2010-11-21 04:47 - 00116168 _____ C:\Windows\PFRO.log
2013-12-27 16:54 - 2013-12-27 16:50 - 00000000 ____D C:\ProgramData\SystemExplorer
2013-12-27 16:50 - 2013-12-27 16:50 - 00000000 ____D C:\Program Files (x86)\System Explorer
2013-12-27 16:50 - 2013-12-27 16:49 - 01978640 _____ (Mister Group                                                ) C:\Users\test\Downloads\SystemExplorerSetup_450.exe
2013-12-27 16:20 - 2013-12-27 16:20 - 00377856 _____ C:\Users\test\Desktop\gmer_2.1.19163.exe
2013-12-27 16:12 - 2013-12-27 16:12 - 00000540 _____ C:\Users\test\Downloads\defogger_disable.log
2013-12-27 16:11 - 2013-12-27 16:11 - 00050477 _____ C:\Users\test\Downloads\Defogger.exe
2013-12-27 16:08 - 2013-12-27 16:08 - 00000000 _____ C:\autoexec.bat
2013-12-27 16:07 - 2013-12-27 16:07 - 00002256 _____ C:\Users\test\Desktop\SpyHunter.lnk
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-12-27 16:07 - 2013-12-27 16:07 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-12-27 16:07 - 2013-12-27 16:06 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-12-27 16:03 - 2013-12-27 16:03 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer(1).exe
2013-12-27 15:43 - 2013-07-17 15:05 - 00000000 ____D C:\Games
2013-12-27 15:31 - 2013-07-17 15:05 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA
2013-12-27 15:30 - 2013-11-13 23:33 - 00000000 ____D C:\Users\test\AppData\Local\NVIDIA Corporation
2013-12-27 15:30 - 2013-07-17 14:52 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-27 15:27 - 2013-07-17 11:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Users\test\AppData\Roaming\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-27 15:08 - 2013-12-27 15:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-27 15:08 - 2013-12-27 15:07 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\test\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-27 15:08 - 2013-12-27 14:50 - 00000000 ____D C:\Users\test\Desktop\RK_Quarantine
2013-12-27 15:00 - 2013-12-27 15:00 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\test\Downloads\SpyHunter-Installer.exe
2013-12-27 14:50 - 2013-12-27 14:50 - 04406784 _____ C:\Users\test\Downloads\RogueKillerX64.exe
2013-12-27 14:50 - 2013-12-27 14:48 - 09365736 _____ C:\Users\test\Downloads\yet_another_cleaner.exe
2013-12-27 14:33 - 2013-07-16 17:37 - 00000000 ___RD C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 14:33 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-27 14:32 - 2013-10-29 14:17 - 00000022 _____ C:\Windows\GPU-Z.INI
2013-12-27 14:03 - 2013-12-27 11:15 - 516062598 _____ C:\Users\test\Downloads\TSM_Map_4_5_2.7z
2013-12-27 13:09 - 2013-12-27 13:09 - 03051882 _____ C:\Users\test\Desktop\MAN TGX Sound.scs
2013-12-27 13:08 - 2013-12-27 13:08 - 00000000 ____D C:\Users\test\Desktop\base
2013-12-26 22:48 - 2013-12-26 22:48 - 00000000 ____D C:\Users\test\Downloads\Adelaide_F1_1988_C4
2013-12-26 22:48 - 2013-12-26 22:32 - 37825508 _____ C:\Users\test\Downloads\Adelaide_F1_1988_C4.rar
2013-12-26 12:07 - 2013-12-23 22:40 - 00000000 ____D C:\Users\test\Downloads\ETS2_TelemetryServer_Windows
2013-12-25 22:51 - 2013-12-25 22:51 - 00000000 ____D C:\Users\test\Downloads\rfDisplay_1.04
2013-12-25 22:50 - 2013-12-25 22:51 - 04099871 ____N C:\Users\test\Downloads\rfDisplay_1.04.zip
2013-12-25 22:48 - 2013-12-25 22:48 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-24 22:58 - 2011-04-12 08:43 - 00697658 _____ C:\Windows\system32\perfh007.dat
2013-12-24 22:58 - 2011-04-12 08:43 - 00148452 _____ C:\Windows\system32\perfc007.dat
2013-12-24 22:58 - 2009-07-14 06:13 - 01615906 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PantsOff
2013-12-24 21:57 - 2013-12-24 21:57 - 00000000 ____D C:\Program Files (x86)\PantsOff
2013-12-24 21:52 - 2013-12-24 21:52 - 00463842 _____ C:\Users\test\Downloads\ariskkey.exe
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
2013-12-24 21:52 - 2013-12-24 21:52 - 00000000 ____D C:\Program Files (x86)\Passware
2013-12-23 22:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-12-23 22:40 - 2013-12-23 22:40 - 00028718 _____ C:\Users\test\Downloads\ETS2_TelemetryServer_Windows.zip
2013-12-23 15:11 - 2013-12-23 15:11 - 00011323 _____ C:\Users\test\Downloads\zzzzzzzzzzzzzzzzz_mapzoom.scs
2013-12-23 15:02 - 2013-12-23 15:02 - 00000000 ____D C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30
2013-12-23 15:00 - 2013-12-23 15:00 - 00000000 ____D C:\Users\test\Desktop\vehicle
2013-12-23 14:59 - 2013-12-23 14:55 - 53367288 _____ C:\Users\test\Downloads\TSM_Map_4_03_2013-08-30.7z
2013-12-23 11:21 - 2013-07-17 14:51 - 00000000 ____D C:\Users\test\AppData\Roaming\Origin
2013-12-23 11:21 - 2013-07-17 14:49 - 00000000 ____D C:\ProgramData\Origin
2013-12-22 13:11 - 2013-12-22 13:11 - 00194885 _____ C:\Users\test\Downloads\hjsplit3.zip
2013-12-22 13:11 - 2013-12-22 13:11 - 00000000 ____D C:\Users\test\Downloads\hjsplit3
2013-12-21 21:06 - 2013-12-21 21:06 - 00000000 ____D C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1
2013-12-21 21:06 - 2013-12-21 21:05 - 28741943 _____ C:\Users\test\Downloads\Scania-Concept-R1000-v4.1.1.rar
2013-12-21 20:19 - 2013-12-21 20:19 - 00009853 _____ C:\Users\test\Desktop\base.scs
2013-12-21 20:19 - 2013-11-09 11:56 - 00000000 ____D C:\Users\test\AppData\Roaming\Audacity
2013-12-21 20:10 - 2013-12-21 20:10 - 00671987 _____ C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK).rar
2013-12-21 20:10 - 2013-12-21 20:10 - 00000000 ____D C:\Users\test\Downloads\Realistic Physics Mod v8.0.1 (by KacaK)
2013-12-21 15:27 - 2013-12-21 15:27 - 00001681 _____ C:\Users\test\Downloads\HDR_Fix.scs
2013-12-21 15:27 - 2013-12-21 15:27 - 00000000 ____D C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch
2013-12-21 14:34 - 2013-12-21 14:34 - 00000000 ____D C:\Users\test\Downloads\man_tgx
2013-12-21 14:34 - 2013-12-21 14:33 - 20913208 _____ C:\Users\test\Downloads\EuroTruckSimulator2_1_7_1_to_1_8_2_5_patch.zip
2013-12-21 14:33 - 2013-12-21 14:32 - 34455628 _____ C:\Users\test\Downloads\man_tgx.rar
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-12-21 14:03 - 2013-12-21 14:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-21 14:00 - 2013-12-21 13:59 - 25755856 _____ (Microsoft Corporation) C:\Users\test\Downloads\wordview_de-de.exe
2013-12-20 22:38 - 2013-12-20 22:37 - 07206127 _____ C:\Users\test\Downloads\FSONE_v1.8_Update_-__inprogress__.zip
2013-12-20 22:37 - 2013-12-20 22:37 - 00000000 ____D C:\Users\test\Downloads\F1 2006 FSONE V1.7
2013-12-20 22:30 - 2013-12-20 22:30 - 376558943 _____ C:\Users\test\Downloads\F1 2006 FSONE V1.7.rar
2013-12-19 20:01 - 2013-07-17 09:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-19 19:54 - 2013-12-19 19:54 - 00696453 _____ C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50.rar
2013-12-19 19:54 - 2013-12-19 19:54 - 00000000 ____D C:\Users\test\Downloads\TVstyle_F12011_DNSoft_v1.50
2013-12-19 19:52 - 2013-12-19 19:52 - 00000970 _____ C:\Users\test\Desktop\CTDP F1 2006 ControlCenter.lnk
2013-12-19 19:48 - 2013-12-09 13:45 - 00000000 ____D C:\Users\test\Downloads\LINDA Musik
2013-12-17 14:33 - 2013-11-20 19:39 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-17 14:33 - 2013-11-20 19:39 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-16 14:30 - 2013-12-16 14:30 - 00000000 ____D C:\Users\test\Downloads\SIMCo_MTE_2008_install
2013-12-15 14:46 - 2013-12-15 11:01 - 00000000 ____D C:\Users\test\Desktop\j
2013-12-15 14:42 - 2013-10-06 16:13 - 00024064 ___SH C:\Users\test\Documents\Thumbs.db
2013-12-15 00:54 - 2013-08-19 21:23 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 00:53 - 2013-07-26 15:50 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 00:05 - 2013-11-29 18:36 - 00000000 ____D C:\Users\test\Documents\SimCity 4
2013-12-13 20:08 - 2013-07-21 16:02 - 00000000 ____D C:\Users\test\AppData\Roaming\TS3Client
2013-12-13 11:51 - 2013-08-19 09:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-12 19:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-12 16:41 - 2013-12-12 16:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-12 15:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-12 15:47 - 2009-07-14 05:45 - 00274712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-11 16:18 - 2013-07-17 14:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 16:18 - 2013-07-17 14:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 16:18 - 2013-07-17 14:35 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-10 03:13 - 2013-10-29 11:49 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2013-12-10 03:13 - 2013-10-29 11:49 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2013-12-09 18:25 - 2013-12-09 18:25 - 00011703 _____ C:\Users\test\Downloads\Project CARS 1_1332773885.torrent
2013-12-08 14:58 - 2013-11-09 19:16 - 00000000 ____D C:\Users\test\Documents\Assetto Corsa
2013-12-06 18:40 - 2013-07-22 22:03 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-05 09:42 - 2013-12-27 15:26 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-05 09:42 - 2013-12-27 15:26 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-05 09:42 - 2013-07-31 10:53 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-12-02 14:51 - 2013-07-17 23:27 - 00000000 ____D C:\Windows\Minidump
2013-12-02 14:50 - 2013-07-17 23:26 - 632873085 _____ C:\Windows\MEMORY.DMP

Files to move or delete:
====================
C:\Users\test\Game.dll


Some content of TEMP:
====================
C:\Users\test\AppData\Local\Temp\AutoRun.exe
C:\Users\test\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\test\AppData\Local\Temp\avgnt.exe
C:\Users\test\AppData\Local\Temp\bdfilters.dll
C:\Users\test\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\test\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\test\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\test\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\test\AppData\Local\Temp\nvStInst.exe
C:\Users\test\AppData\Local\Temp\Quarantine.exe
C:\Users\test\AppData\Local\Temp\setup.exe
C:\Users\test\AppData\Local\Temp\SHSetup.exe
C:\Users\test\AppData\Local\Temp\sonarinst.exe
C:\Users\test\AppData\Local\Temp\SRLDetectionLibrary5003431084714088478.dll
C:\Users\test\AppData\Local\Temp\_is7D5A.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-30 13:24

==================== End Of Log ============================
         
--- --- ---

--- --- ---

Geändert von IMrIMike (30.12.2013 um 15:59 Uhr)

Alt 31.12.2013, 14:48   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Bit Coin Miner "Befall" - Standard

Windows 7: Bit Coin Miner "Befall"



Das Problem mit der dllhost in temp kenne ich, wäre der letzte Schritt gewesen. Aber zuerst wurde mal die offensichtliche Malware weg geputzt

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
C:\Program Files\Enigma Software Group
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Fertig

Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun


Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 31.12.2013, 15:22   #9
IMrIMike
 
Windows 7: Bit Coin Miner "Befall" - Standard

Windows 7: Bit Coin Miner "Befall"



Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-12-2013 01
Ran by test at 2013-12-31 15:17:06 Run:1
Running from C:\Users\test\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
C:\Program Files\Enigma Software Group
*****************

esgiguard => Service deleted successfully.
EsgScanner => Service deleted successfully.
C:\Program Files\Enigma Software Group => Moved successfully.

==== End of Fixlog ====
         
Danke vielmals und frohes neues ! =)

Alt 01.01.2014, 13:15   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Bit Coin Miner "Befall" - Standard

Windows 7: Bit Coin Miner "Befall"



Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Windows 7: Bit Coin Miner "Befall"
adblock, auslastung, beim starten, bitcoin, desktop, dllhost.exe, esgscanner.sys, grafikkarte, irgendetwas, launch, morgen, newtab, officejet, prozesse, pup.optional.installcore.a, pup.optional.installerex, pup.optional.installex, pup.optional.snapdo, pup.pswtool.finder, richtlinie, ruckel, system, trennen, trojan.repacked, verbindung, verschieben, windows, windows 7



Ähnliche Themen: Windows 7: Bit Coin Miner "Befall"


  1. Win 7: Sophos meldet "Troj/Miner-AB"
    Log-Analyse und Auswertung - 30.06.2015 (14)
  2. Diverse Malware ("CoolSaleCoupon", "ddownlloaditkeep", "omiga-plus", "SaveSense", "SaleItCoupon"); lahmer PC & viel Werbung!
    Plagegeister aller Art und deren Bekämpfung - 11.01.2015 (16)
  3. "Fehler: Server nicht gefunden" immer noch nach "WAJAM.A.1"-Befall
    Plagegeister aller Art und deren Bekämpfung - 05.11.2014 (15)
  4. Windows 8, "Speed Check" Malware-Befall
    Log-Analyse und Auswertung - 28.10.2014 (7)
  5. ~ 3 BitCoin Miner, Avira + Malwarebytes finden nichts. Beim Start startet sich Browser "unsichtbar"
    Plagegeister aller Art und deren Bekämpfung - 18.09.2014 (13)
  6. Trojaner MacroMedia.exe "Coin-Miner"
    Log-Analyse und Auswertung - 16.10.2013 (32)
  7. Hohe GPU Auslastung durch "miner.exe"
    Log-Analyse und Auswertung - 16.07.2013 (19)
  8. Coin-miner zieht alle ressourcen! Processor 100%
    Plagegeister aller Art und deren Bekämpfung - 19.06.2013 (24)
  9. Coin Miner,msdcsc entfernen
    Plagegeister aller Art und deren Bekämpfung - 11.06.2013 (42)
  10. "Bit Coin" Mining
    Plagegeister aller Art und deren Bekämpfung - 02.01.2013 (1)
  11. Alle Dateien versteckt - Befall mit "trojan.fasagent" und "PUM.Hijack.StartMenu"
    Log-Analyse und Auswertung - 09.07.2012 (29)
  12. "Alle Programme" leer in Windows 7 nach S.M.A.R.T Repair Trojaner Befall
    Plagegeister aller Art und deren Bekämpfung - 08.06.2012 (11)
  13. Trojaner-Befall: "Achtung - Ihr Windows wurde aus Sicherheitsgründen gesperrt.."
    Log-Analyse und Auswertung - 26.03.2012 (9)
  14. PC nach Befall durch "TR/Crypt.XPACK.Gen" und "TR/Crypt.ZPACK.Gen2" extrem langsam
    Plagegeister aller Art und deren Bekämpfung - 29.11.2011 (7)
  15. Coin Miner Virus
    Überwachung, Datenschutz und Spam - 15.10.2011 (1)
  16. "Windows Recovery" Befall - Widerherstellen des Desktops und OTL-Fix
    Log-Analyse und Auswertung - 20.05.2011 (22)
  17. Plötzlicher Trojaner-Befall "Windows Security alert"
    Plagegeister aller Art und deren Bekämpfung - 31.05.2010 (3)

Zum Thema Windows 7: Bit Coin Miner "Befall" - Guten Abend, heute morgen ist mir beim Starten eines Spiels aufgefallen,dass dieses ungewöhnlich ruckelte. Mein System: -Intel Core i5 4670 -Asus H87 Plus -Asus GTX 760 -8 Gb Ram Ich - Windows 7: Bit Coin Miner "Befall"...
Archiv
Du betrachtest: Windows 7: Bit Coin Miner "Befall" auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.