mail gehackt - ebay-Konto missbraucht, Scans erhärten den Verdacht - System befallen!

SirEav · 30.12.2013, 14:42

Hallo Forum, ich benötige bitte Eure Hilfe!

Ich habe gestern (zufällig) entdeckt, dass Jemand über meinen ebay-Account ein hochpreisiges Produkt in meinem Namen angeboten hat.
Habe dann sofort alle relevanten Passwörter von Paypal, ebay, web.de usw. (mithilfe eines anderen, mobilen und hoffentlich sauberen Endgeräts) geändert, das ebay-Fakeangebot gestoppt/beendet und mich dann telefonisch an ebay gewandt. Ich habe den Account vorerst sperren lassen und bin mit einer sehr netten Mitarbeiterin der "Sicherheitsabteilung" auf Ursachenforschung gegangen. Es hat nun den Anschein, dass Jemand irgendwie Zugriff auf meine mails und meinen ebay-Account hat oder zumindest hatte (sonst hätte ich ja in den mails gesehen, dass ich (respektive der Täter) erfolgreich einen neuen Artikel zum Verkauf eingestellt haben).
Während ich also telefonierte, habe ich dann sogar im Outlook live verfolgen können, wie die ebay-System-mail "Sie haben Ihr Passwort geändert" kurz auftauchte und gleich darauf wieder verschwand

Erst nach dem Ändern aller Passwörter (also auch des MailAccounts) und dem "Ausklammern" von Outlook 2010 habe ich wieder die Standard-Systemmails von ebay erhalten.
Habe übrigens nur die Mail-Passwörter auf den mobilen Endgeräten aktualisiert - dem Outlook meines PCs gestatte ich vorerst keinen Zugriff mehr aufs Mail-Postfach.

So, nun habe ich auf Verdacht mit Avast gescannt und tatsächlich etwas gefunden. Reparieren und löschen mit Avast brachte keinen Erfolg. Dann habe ich mit diesem Forum auseinander gesetzt und bin nach Eurer Anleitung vorgegangen und habe folgende Scans erstellt:

FRST.txt
Addition.txt
Gmer.zip
MBAM-Log.txt

(Leider sagt mir das System, dass ich insgesamt zu viele Wörter posten will, daher uploade ich die Textdateien als Anlagen - ich hoffe es ist so genehm)

Am System habe ich ansonsten nichts auffälliges bemerkt - alles geht wie immer.
Könnt ihr mir bei der Bereinigung helfen?

Bestimmt habt ihr noch 1000 Fragen, die ich noch nicht beantwortet habe. Dies hole ich jedoch sehr gern nach, so ihr sie denn auch stellt.

Gruß
Ralf

Achso, sollte ich auch Anzeige erstatten? Macht das Sinn bzw. habt ihr Erfahrungen damit?

schrauber · 30.12.2013, 17:20

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

SirEav · 30.12.2013, 21:52

Okay, here we go...

FRST.txt

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-12-2013 01
Ran by Ralf (administrator) on LENOVOW701 on 30-12-2013 02:52:28
Running from C:\Users\Ralf\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\DISPUTIL\tplcdclr.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\DigitizerMonitor\DigiMon.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(3Dconnexion, INC) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe
(Dropbox, Inc.) C:\Users\Ralf\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(3Dconnexion) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3DxNumpad.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_11_9_900_170_ActiveX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Lenovo Group Limited) C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AcWin7Hlpr] - C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe [60920 2013-05-29] (Lenovo Group Limited)
HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [384296 2013-08-21] (Lenovo.)
HKLM\...\Run: [ThinkPadDisplayUtility] - C:\Program Files\Lenovo\DISPUTIL\tplcdclr.exe [86376 2009-10-28] (Lenovo Group Limited)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-15] ()
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [Digimon] - C:\Program Files\Lenovo\DigitizerMonitor\DigiMon.exe [17256 2009-10-28] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-09-26] (Synaptics Incorporated)
HKLM-x32\...\Run: [PWMTRV] - C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL [6619432 2013-09-03] (Lenovo Group Limited)
HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111928 2013-05-03] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [69632 2004-04-13] (InstallShield Software Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-30] (AVAST Software)
Winlogon\Notify\LBTWlgn: C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKCU\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKCU\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKCU\...\Run: [ISUSPM Startup] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-05-26] (Google Inc.)
HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\Administrator\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\Administrator\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\Administrator\...\Run: [ISUSPM Startup] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKU\Administrator\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-05-26] (Google Inc.)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll ACGina
Startup: C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Ralf\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKCU - {647A34C2-6D48-41CB-A17F-3922643A51EB} URL = 
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\..\Interfaces\{06D60E06-9F95-47D0-95EF-C4F625AB7591}: [NameServer]192.168.0.1

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-30] (AVAST Software)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2013-09-03] (Lenovo.)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
R2 MSSQL$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [43028328 2011-09-22] (Microsoft Corporation)
R2 NVWMI; C:\Windows\system32\nvwmi64.exe [2273568 2013-10-23] (NVIDIA Corporation)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\RpcAgentSrv.exe [71832 2008-10-02] (SiSoftware)
S4 SQLAgent$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [370024 2011-09-22] (Microsoft Corporation)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22888 2013-09-17] ()
R2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1028096 2009-09-25] (Lenovo Group Limited)
S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1475896 2010-07-06] (Lenovo Group Limited)
S4 ServiceControl_RTE23_3S_GmbH; "C:\Program Files (x86)\3S Software\CoDeSys SP RTE\ServiceControl_RTE23.exe" [x]
S2 TabletServicePen; C:\Program Files\Tablet\Pen\Pen_Tablet.exe [x]
S2 TouchServicePen; C:\Program Files\Tablet\Pen\Pen_TouchService.exe [x]

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-30] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-30] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-30] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-30] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-30] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R0 Digimon; C:\Windows\System32\Drivers\Digimon.sys [18472 2009-02-20] (Lenovo Group Limited)
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37456 2011-02-18] (Paragon Software Group)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-02] (Intel Corporation)
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2013-09-26] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [53840 2011-02-18] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [528464 2011-02-18] (Paragon)
S3 wacommousefilter; system32\DRIVERS\wacommousefilter.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-30 02:52 - 2013-12-30 02:52 - 00017729 _____ C:\Users\Ralf\Desktop\FRST.txt
2013-12-30 02:52 - 2013-12-30 02:52 - 00000000 ____D C:\FRST
2013-12-30 02:51 - 2013-12-30 02:51 - 01931302 _____ (Farbar) C:\Users\Ralf\Desktop\FRST64.exe
2013-12-30 02:47 - 2013-12-30 02:47 - 00003122 _____ C:\Windows\System32\Tasks\{2217FBD7-B8CE-4751-B209-43640EB0A3C5}
2013-12-30 02:41 - 2013-12-30 02:41 - 00003124 _____ C:\Windows\System32\Tasks\{358FB7F3-846B-4EEB-ABF6-C4A048164B6E}
2013-12-30 02:32 - 2013-12-30 02:45 - 00016516 _____ C:\Users\Ralf\Desktop\hijackthis.log
2013-12-30 02:30 - 2013-12-30 02:30 - 00388608 _____ (Trend Micro Inc.) C:\Users\Ralf\Desktop\YES WE CAN.com
2013-12-30 00:16 - 2013-12-30 00:16 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\AVAST Software
2013-12-30 00:15 - 2013-12-30 00:16 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2013-12-30 00:15 - 2013-12-30 00:16 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-12-30 00:15 - 2013-12-30 00:15 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-30 00:15 - 2013-12-30 00:15 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-30 00:15 - 2013-12-30 00:15 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-29 23:05 - 2013-12-29 23:05 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\QuickScan
2013-12-26 23:59 - 2013-12-26 23:59 - 00000000 ____D C:\Users\Ralf\Documents\ANNO 2070
2013-12-26 23:11 - 2013-12-26 23:30 - 00000000 ____D C:\Users\Ralf\AppData\Local\Ubisoft Game Launcher
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Ubisoft
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\ProgramData\Solidshield
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-12-26 23:10 - 2013-12-26 23:10 - 00017475 _____ C:\Windows\DirectX.log
2013-12-26 22:52 - 2013-12-26 22:52 - 00000263 _____ C:\Windows\system32\TeamViewer9_Hooks.log
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iTunes
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iPod
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-18 01:14 - 2013-12-18 01:14 - 00000000 ____D C:\Users\Ralf\Documents\Paradox Interactive
2013-12-18 00:45 - 2013-12-18 00:48 - 00000000 ____D C:\Users\Ralf\Documents\CarrierCommandDemo
2013-12-17 22:47 - 2013-12-17 22:47 - 00002222 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-12-17 22:45 - 2013-12-17 22:45 - 00003276 _____ C:\Windows\System32\Tasks\{4E791C89-B08C-4509-9F96-F278849D5D69}
2013-12-15 03:00 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-15 03:00 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-15 03:00 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-15 03:00 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-15 03:00 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-15 03:00 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-15 03:00 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-15 03:00 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-15 03:00 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-15 03:00 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-15 03:00 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-15 03:00 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-15 03:00 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-15 03:00 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-15 03:00 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-15 03:00 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-15 03:00 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-15 03:00 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-15 03:00 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-15 03:00 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-15 03:00 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-15 03:00 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-15 03:00 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-15 03:00 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-15 03:00 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-15 03:00 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-15 03:00 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-15 03:00 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-15 03:00 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-15 03:00 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-15 03:00 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-14 03:06 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-12-14 03:02 - 2013-12-14 03:07 - 00009916 _____ C:\Windows\IE11_main.log
2013-12-14 03:02 - 2013-12-14 03:02 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-12 12:41 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 12:41 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 12:41 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 12:41 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-12 09:36 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 09:36 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 09:36 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-12 09:36 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-12 09:36 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 09:36 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 09:36 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 09:36 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 09:36 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 09:36 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 09:36 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 09:36 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-12 09:36 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 09:36 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-12 09:36 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 09:36 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-12 09:36 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-12 09:36 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-12 09:36 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-04 21:19 - 2013-12-04 21:49 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-12-04 21:19 - 2013-12-04 21:19 - 00003364 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-12-01 12:01 - 2013-12-01 12:01 - 00001330 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\Users\Ralf\Documents\Freemake
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\ProgramData\Freemake
2013-12-01 12:00 - 2013-12-01 12:01 - 00000000 ____D C:\Program Files (x86)\Freemake

==================== One Month Modified Files and Folders =======

2013-12-30 02:52 - 2013-12-30 02:52 - 00017729 _____ C:\Users\Ralf\Desktop\FRST.txt
2013-12-30 02:52 - 2013-12-30 02:52 - 00000000 ____D C:\FRST
2013-12-30 02:52 - 2012-05-23 20:02 - 00000466 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-12-30 02:52 - 2009-07-14 18:58 - 00768542 _____ C:\Windows\system32\perfh007.dat
2013-12-30 02:52 - 2009-07-14 18:58 - 00175240 _____ C:\Windows\system32\perfc007.dat
2013-12-30 02:52 - 2009-07-14 06:13 - 01812778 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-30 02:52 - 2009-07-14 05:45 - 00015632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-30 02:52 - 2009-07-14 05:45 - 00015632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-30 02:51 - 2013-12-30 02:51 - 01931302 _____ (Farbar) C:\Users\Ralf\Desktop\FRST64.exe
2013-12-30 02:48 - 2012-05-23 19:45 - 01087908 _____ C:\Windows\WindowsUpdate.log
2013-12-30 02:47 - 2013-12-30 02:47 - 00003122 _____ C:\Windows\System32\Tasks\{2217FBD7-B8CE-4751-B209-43640EB0A3C5}
2013-12-30 02:46 - 2012-05-26 01:26 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-30 02:45 - 2013-12-30 02:32 - 00016516 _____ C:\Users\Ralf\Desktop\hijackthis.log
2013-12-30 02:45 - 2013-11-07 21:22 - 00004379 _____ C:\Windows\setupact.log
2013-12-30 02:45 - 2013-10-30 23:17 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Dropbox
2013-12-30 02:45 - 2012-05-26 01:26 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-30 02:45 - 2012-05-23 22:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-30 02:45 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-30 02:41 - 2013-12-30 02:41 - 00003124 _____ C:\Windows\System32\Tasks\{358FB7F3-846B-4EEB-ABF6-C4A048164B6E}
2013-12-30 02:41 - 2012-05-24 13:15 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-30 02:30 - 2013-12-30 02:30 - 00388608 _____ (Trend Micro Inc.) C:\Users\Ralf\Desktop\YES WE CAN.com
2013-12-30 02:03 - 2013-11-09 17:26 - 00903514 _____ C:\Windows\PFRO.log
2013-12-30 00:16 - 2013-12-30 00:16 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\AVAST Software
2013-12-30 00:16 - 2013-12-30 00:15 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2013-12-30 00:16 - 2013-12-30 00:15 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-12-30 00:15 - 2013-12-30 00:15 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-30 00:15 - 2013-12-30 00:15 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-30 00:15 - 2013-12-30 00:15 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-30 00:14 - 2012-06-01 12:26 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-29 23:51 - 2013-09-05 14:10 - 00001912 _____ C:\Windows\epplauncher.mif
2013-12-29 23:28 - 2012-05-28 16:05 - 00000000 ____D C:\Users\Ralf\AppData\Local\837516E7-1B0C-4816-BE63-04306B16DBFD.aplzod
2013-12-29 23:28 - 2012-02-19 12:50 - 00000000 ____D C:\Users\Ralf\Documents\Outlook-Dateien
2013-12-29 23:05 - 2013-12-29 23:05 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\QuickScan
2013-12-29 20:09 - 2012-05-23 20:02 - 00003448 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-12-26 23:59 - 2013-12-26 23:59 - 00000000 ____D C:\Users\Ralf\Documents\ANNO 2070
2013-12-26 23:30 - 2013-12-26 23:11 - 00000000 ____D C:\Users\Ralf\AppData\Local\Ubisoft Game Launcher
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Ubisoft
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\ProgramData\Solidshield
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-12-26 23:11 - 2012-05-23 19:59 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-26 23:10 - 2013-12-26 23:10 - 00017475 _____ C:\Windows\DirectX.log
2013-12-26 23:08 - 2012-05-23 20:03 - 00119216 _____ C:\Users\Ralf\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-26 22:54 - 2009-07-14 05:45 - 00435688 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-26 22:52 - 2013-12-26 22:52 - 00000263 _____ C:\Windows\system32\TeamViewer9_Hooks.log
2013-12-26 22:52 - 2012-05-24 13:25 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2013-12-22 14:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-20 23:16 - 2013-10-30 23:17 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-20 23:16 - 2012-05-23 19:45 - 00000000 ___RD C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iTunes
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iPod
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-18 01:14 - 2013-12-18 01:14 - 00000000 ____D C:\Users\Ralf\Documents\Paradox Interactive
2013-12-18 00:48 - 2013-12-18 00:45 - 00000000 ____D C:\Users\Ralf\Documents\CarrierCommandDemo
2013-12-17 22:47 - 2013-12-17 22:47 - 00002222 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-12-17 22:47 - 2012-05-26 01:26 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-17 22:45 - 2013-12-17 22:45 - 00003276 _____ C:\Windows\System32\Tasks\{4E791C89-B08C-4509-9F96-F278849D5D69}
2013-12-15 03:29 - 2012-05-24 18:25 - 01787058 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-12-14 23:32 - 2012-05-27 19:57 - 00000000 ____D C:\Users\Ralf\Documents\My Games
2013-12-14 23:29 - 2012-05-23 19:46 - 00001431 _____ C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-14 03:22 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-14 03:07 - 2013-12-14 03:02 - 00009916 _____ C:\Windows\IE11_main.log
2013-12-14 03:02 - 2013-12-14 03:02 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-14 03:01 - 2013-08-18 12:16 - 00000000 ____D C:\Windows\system32\MRT
2013-12-14 03:00 - 2012-05-24 14:56 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-12 12:40 - 2012-05-24 17:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-11 23:41 - 2012-05-24 13:15 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 23:41 - 2012-05-24 13:15 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 23:41 - 2012-05-24 13:15 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-11 01:41 - 2012-05-26 01:26 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-11 01:41 - 2012-05-26 01:26 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-05 23:29 - 2012-05-23 20:02 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-12-04 21:49 - 2013-12-04 21:19 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-12-04 21:19 - 2013-12-04 21:19 - 00003364 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-12-04 21:19 - 2012-05-23 20:02 - 00004232 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-12-01 12:01 - 2013-12-01 12:01 - 00001330 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\Users\Ralf\Documents\Freemake
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\ProgramData\Freemake
2013-12-01 12:01 - 2013-12-01 12:00 - 00000000 ____D C:\Program Files (x86)\Freemake

Some content of TEMP:
====================
C:\Users\Ralf\AppData\Local\Temp\FreemakeVideoConverter_4.1.1.4.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-22 14:09

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-12-2013 01
Ran by Ralf at 2013-12-30 02:52:52
Running from C:\Users\Ralf\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================


==================== Installed Programs ======================

3Dconnexion 3DxSoftware (x64 Edition) (x32 Version: 3.17.7 - 3Dconnexion)
3Dconnexion 3DxWare (x64) (Version: 6.17.0007 - 3Dconnexion)
3Dconnexion Add-In for AutoCAD 2007 - 2010 (Version: 4.5.1 - 3Dconnexion)
3Dconnexion Add-In for Inventor 11 - 2014 (Version: 1.12.4 - 3Dconnexion)
3Dconnexion Add-In for Solid Edge V18 - ST6 (Version: 2.23.2 - 3Dconnexion)
3Dconnexion Add-In for SolidWorks 2005 - 2014 (Version: 2.24.3 - 3Dconnexion)
3Dconnexion Add-On for XSI v5.0 - 2014 (Version: 2.11.5 - 3Dconnexion)
3Dconnexion Collage (x32 Version: 1.3.0 - 3Dconnexion)
3Dconnexion Extension for SketchUp (x32 Version: 3.3.0 - 3Dconnexion)
3Dconnexion Plug-In for 3ds Max v9 - 2014 (Version: 5.6.5 - 3Dconnexion)
3Dconnexion Plug-in for Acrobat 3D (x32 Version: 1.3.0 - 3Dconnexion)
3Dconnexion Plug-In for Maya v8.5 - 2014 (Version: 4.3.7 - 3Dconnexion)
3Dconnexion Plug-In for NX v4.0 - v9.0 (Version: 2.14.1 - 3Dconnexion)
3Dconnexion Plug-In for Photoshop CS3 - CS6 and CC (Version: 2.4.0 - 3Dconnexion)
3Dconnexion Plug-In for Pro/ENGINEER Wildfire 3.0 - Creo 2.0 (Version: 1.13.7 - 3Dconnexion)
3Dconnexion Trainer (x32 Version: 3.2.2 - 3Dconnexion)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Access Help (x32 Version: 3.00 - Lenovo)
Adobe AIR (x32 Version: 3.9.0.1380 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
Anno 2070 (x32 Version:  - BlueByte)
Anzeige am Bildschirm (Version: 6.70.00 - )
Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Arduino (x32 Version: 1.0.5 - Arduino LLC)
avast! Free Antivirus (x32 Version: 9.0.2011 - Avast Software)
Bilder-CD Fachkunde Metall, 57. Aufl. - Einzellizenz (x32 Version:  - Verlag Europa-Lehrmittel)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
CCleaner (Version: 4.06 - Piriform)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.)
Cisco Systems VPN Client 5.0.07.0440 (Version: 5.0.7 - Cisco Systems, Inc.)
Company of Heroes (New Steam Version) (x32 Version:  - )
Company of Heroes 2 – OPEN BETA (x32 Version:  - Relic Entertainment)
Company of Heroes: Tales of Valor (x32 Version:  - Relic)
Conexant 20585 SmartAudio HD (Version: 4.95.48.50 - Conexant)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version:  - Microsoft)
Deutsche Post E-Porto (Version: 2.3.0 - Deutsche Post AG)
Deutsche Post E-Porto (x32 Version: 2.3.0 - Deutsche Post AG)
Dienstprogramm "ThinkPad UltraNav" (x32 Version: 2.13.0 - Lenovo)
Dropbox (HKCU Version: 2.4.10 - Dropbox, Inc.)
Energie-Manager (x32 Version: 6.63.1 - Lenovo Group Limited)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.)
Farming Simulator 2013 (x32 Version:  - Giants Software)
Fingerprint Software Patch (Version: 5.9.7.7261 - Authentec Inc.)
Freemake Video Converter Version 4.1.1 (x32 Version: 4.1.1 - Ellora Assets Corporation)
Google Earth (x32 Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.)
Hewlett-Packard ACLM.NET v1.1.0.0 (x32 Version: 1.00.0000 - Hewlett-Packard)
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Officejet Pro 8500 A910 Hilfe (x32 Version: 140.0.2.2 - Hewlett Packard)
HP Update (x32 Version: 5.003.001.001 - Hewlett-Packard)
I.R.I.S. OCR (x32 Version: 12.3.4.0 - HP)
iCloud (Version: 3.1.0.40 - Apple Inc.)
Integrated Camera Driver Installer Package Ver.1.1.0.48 (x32 Version: 1.1.0.48 - RICOH)
Intel(R) Control Center (x32 Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 6.2.50.1050 - Intel Corporation)
Intel(R) Network Connections Drivers (Version: 16.8 - Intel)
IrfanView (remove only) (x32 Version: 4.36 - Irfan Skiljan)
iTunes (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 45 (64-bit) (Version: 7.0.450 - Oracle)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.)
Lenovo Auto Scroll Utility (Version: 1.11 - )
Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited)
Lenovo Power Management Driver (Version: 1.67.04.04 - )
Lenovo System Interface Driver (Version: 1.05 - )
Lenovo System Update (x32 Version: 5.03.0005 - Lenovo)
Lenovo ThinkVantage Toolbox (Version: 6.0.5849.23 - PC-Doctor, Inc.)
Logitech SetPoint 6.32 (Version: 6.32.20 - Logitech)
Logitech Unifying-Software 2.10 (Version: 2.10.37 - Logitech)
Men of War: Assault Squad (x32 Version:  - Digitalmindsoft)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2008 (x32 Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 Browser (x32 Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Common Files (x32 Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Database Engine Services (x32 Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Database Engine Shared (x32 Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Native Client (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 RsFx Driver (x32 Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.19.0 - NEC Electronics Corporation)
NVIDIA 3D Vision Treiber 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.133.889 - NVIDIA Corporation)
NVIDIA PhysX (x32 Version: 9.09.0814 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3165 - NVIDIA Corporation)
NVIDIA Systemsteuerung 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA WMI 2.15.0 (Version: 2.15.0 - NVIDIA Corporation)
Paragon Festplatten Manager™ 2011 Suite (x32 Version: 90.00.0003 - Paragon Software)
QuickTime (x32 Version: 7.74.80.86 - Apple Inc.)
Rescue and Recovery (x32 Version: 4.30.0027.00 - Lenovo Group Limited)
RICOH R5U230 Media Driver ver.2.06.02.02 (x32 Version: 2.06.02.02 - RICOH)
scilab-5.4.1 (64-bit) (Version:  - Scilab Enterprises)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft)
Service Pack 3 für SQL Server 2008 (KB2546951) (x32 Version: 10.3.5500.0 - Microsoft Corporation)
SiSoftware Sandra Lite 2013.SP6 (Version: 19.66.2013.10 - SiSoftware)
Solid Edge ST5 (Version: 105.00.00102 - Siemens)
Sql Server Customer Experience Improvement Program (x32 Version: 10.3.5500.0 - Microsoft Corporation)
System Migration Assistant (x32 Version: 6.00.0009 - Lenovo Group Limited.)
TeamViewer 9 (x32 Version: 9.0.24951 - TeamViewer)
The Elder Scrolls V: Skyrim (x32 Version:  - Bethesda Game Studios)
ThinkPad Bluetooth with Enhanced Data Rate Software (Version: 6.2.1.3200 - Broadcom Corporation)
ThinkPad Digitizer Activity Monitor (x32 Version: 1.02.0000 - Lenovo)
ThinkPad Display Utility (Version: 1.00.02 - )
ThinkPad FullScreen Magnifier (Version: 2.40 - )
ThinkPad Modem Adapter (Version: 7.80.5.0 - Conexant Systems)
ThinkPad UltraNav Driver (Version: 16.2.19.13 - )
ThinkPad Wireless LAN Adapter Software (x32 Version: 1.00.0029.8 - REALTEK Semiconductor Corp.)
ThinkVantage Access Connections (x32 Version: 5.97 - Lenovo)
ThinkVantage Communications Utility (Version: 2.11.0.0 - Lenovo)
ThinkVantage Fingerprint Software (Version: 5.9.8.7264 - Authentec Inc.)
ThinkVantage System für aktiven Festplattenschutz (Version: 1.78.0.09 - Lenovo)
Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (x32 Version: 10.3.5500.0 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version:  - Microsoft)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (04/08/2010 6.3.5.430) (Version: 04/08/2010 6.3.5.430 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Driver Package - FTDI CDM Driver Package - Bus/D2XX Driver (07/12/2013 2.08.30) (Version: 07/12/2013 2.08.30 - FTDI)
Windows Driver Package - FTDI CDM Driver Package - VCP Driver (07/12/2013 2.08.30) (Version: 07/12/2013 2.08.30 - FTDI)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0 - Microsoft Corporation)
XAMPP 1.7.7 (x32 Version:  - )
XCOM: Enemy Unknown (x32 Version:  - )

==================== Restore Points  =========================

26-12-2013 22:11:09 Installed Ubisoft Game Launcher
29-12-2013 22:45:11 avast! antivirus system restore point
29-12-2013 23:13:23 Windows Update
29-12-2013 23:15:27 avast! antivirus system restore point

==================== Hosts content: ==========================

2009-07-14 03:34 - 2013-02-05 19:13 - 00000853 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0001E1D8-111E-438F-A9A6-A5E15A6B2256} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {189ABE16-D502-4C9D-A027-AAC9EE6D38FF} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {23855B94-81BB-4A8A-B376-AA37FC63BC27} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {2A440F01-B7EF-419E-88D6-006721919D14} - System32\Tasks\TVT\ChangePWD => %RR%\rrcmd.exe
Task: {506EEC69-29FA-42A0-8F47-51C7B39CC3F8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {55CB360B-AA2E-4E49-92BD-E94788F2DAB6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-12-30] (AVAST Software)
Task: {5CF647AD-893E-49F3-97BF-2579B9FA3E4F} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {5FE59FDB-5241-4DF8-AF2A-675F77982EFC} - System32\Tasks\TVT\LaunchRnR => C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrcmd.exe [2009-09-25] (Lenovo Limited Group Corporation)
Task: {69186DCE-771D-471A-B4E7-A91608E0FB58} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {7BFEA4CA-D824-43EF-B101-82F177FE0DEF} - System32\Tasks\PCDoctorBackgroundMonitorTask-Delay => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {86FE5439-D2BA-4456-9346-07E661C4386A} - System32\Tasks\TVT\UpdateRnR => %TVTCOMMON%\Scheduler\tvtsetsched.exe
Task: {918289EB-423F-4421-9B47-8B6F0568DBE5} - System32\Tasks\3DconnexionCreateProcess_3DxSRV.EXE => C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe [2013-09-30] (3Dconnexion, INC)
Task: {92C68B05-3F98-4C08-B8BF-EEBEFC62CD50} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2013-09-17] ()
Task: {AC5CFE0C-CB59-4418-9038-024CB7A8D1F6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-26] (Google Inc.)
Task: {C0372F65-6312-4283-A816-AC0CA9110062} - System32\Tasks\Paragon Archive name SSDs vollständig => C:\Program Files (x86)\Paragon Software\Festplatten Manager 2011 Suite\program\scripts.exe [2011-02-18] (Paragon Software Group)
Task: {DCC08D97-F948-47FB-B26A-CE75CCCFBCAE} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd)
Task: {E6DCC426-BD3A-497D-862F-AD6D2EB4DD5B} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {F07C3666-3CE8-41F6-BA6E-3644EFB76E7A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-26] (Google Inc.)
Task: {FB53BA33-6AB9-43A2-994A-DEFE410D31E2} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Paragon Archive name SSDs vollständig.job => C:\Program Files (x86)\Paragon Software\Festplatten Manager 2011 Suite\program\scripts.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe

==================== Loaded Modules (whitelisted) =============

2013-05-30 21:48 - 2013-09-03 06:03 - 00117248 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2011-10-07 10:39 - 2011-10-07 10:39 - 01304856 _____ () C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
2013-09-30 16:32 - 2013-09-30 16:32 - 00058368 _____ () C:\Windows\system32\SPWINI.dll
2013-12-30 00:17 - 2013-12-29 13:54 - 02153984 _____ () C:\Program Files\AVAST Software\Avast\defs\13122900\algo.dll
2012-02-20 20:29 - 2012-02-20 20:29 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-02-20 20:28 - 2012-02-20 20:28 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-03-04 11:49 - 2011-03-04 11:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2012-09-06 19:18 - 2012-09-06 19:18 - 00086016 _____ () C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
2013-09-14 00:51 - 2013-09-14 00:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 00:50 - 2013-09-14 00:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Ralf\AppData\Roaming\Dropbox\bin\libcef.dll
2013-12-30 00:15 - 2013-12-30 00:15 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/30/2013 02:47:10 AM) (Source: SecurityCenter) (User: )
Description: Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der WMI herstellen, um Antiviren, AntiSpyware- und Firewallprogramme von Drittanbietern zu überwachen.

Error: (12/30/2013 02:05:34 AM) (Source: SecurityCenter) (User: )
Description: Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der WMI herstellen, um Antiviren, AntiSpyware- und Firewallprogramme von Drittanbietern zu überwachen.

Error: (12/30/2013 00:15:27 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary jaltjnmp.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (12/30/2013 00:03:00 AM) (Source: PC-Doctor) (User: )
Description: (1608) Asapi: (00:03:00:6580)(1608) libTonopahClient.DownloadManager - Error -- 135 HttpException : Http send request failed: getSystemErrormsg: FormatMessage(12007) failed with error: 317

Error: (12/30/2013 00:03:00 AM) (Source: PC-Doctor) (User: )
Description: (1608) Asapi: (00:03:00:6270)(1608) libTonopahClient.DownloadManager - Error -- 135 HttpException : Http send request failed: getSystemErrormsg: FormatMessage(12007) failed with error: 317

Error: (12/29/2013 11:50:01 PM) (Source: PC-Doctor) (User: )
Description: (2624) Asapi: (23:50:01:0170)(2624) libTonopahClient.DownloadManager - Error -- 135 HttpException : Http send request failed: getSystemErrormsg: FormatMessage(12007) failed with error: 317

Error: (12/29/2013 11:50:00 PM) (Source: PC-Doctor) (User: )
Description: (2624) Asapi: (23:50:00:9860)(2624) libTonopahClient.DownloadManager - Error -- 135 HttpException : Http send request failed: getSystemErrormsg: FormatMessage(12007) failed with error: 317

Error: (12/29/2013 11:49:57 PM) (Source: SecurityCenter) (User: )
Description: Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der WMI herstellen, um Antiviren, AntiSpyware- und Firewallprogramme von Drittanbietern zu überwachen.

Error: (12/29/2013 11:11:19 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1ddc

Startzeit: 01cf04e1b6d0d1c2

Endzeit: 0

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID:

Error: (12/29/2013 10:58:01 PM) (Source: PC-Doctor) (User: )
Description: (5400) Asapi: (22:58:01:2950)(5400) libTonopahClient.DownloadManager - Error -- 135 HttpException : Http send request failed: getSystemErrormsg: FormatMessage(12007) failed with error: 317


System errors:
=============
Error: (12/30/2013 02:45:32 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004002

Error: (12/30/2013 02:45:06 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "TabletServicePen" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (12/30/2013 02:45:04 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Wacom Consumer Touch Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (12/30/2013 02:15:18 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004002

Error: (12/30/2013 02:15:16 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004002

Error: (12/30/2013 02:15:12 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004002

Error: (12/30/2013 02:03:31 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "TabletServicePen" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (12/30/2013 02:03:28 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Wacom Consumer Touch Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (12/30/2013 00:13:13 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004002

Error: (12/30/2013 00:13:10 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004002


Microsoft Office Sessions:
=========================
Error: (12/30/2013 02:47:10 AM) (Source: SecurityCenter)(User: )
Description: 

Error: (12/30/2013 02:05:34 AM) (Source: SecurityCenter)(User: )
Description: 

Error: (12/30/2013 00:15:27 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary jaltjnmp.

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (12/30/2013 00:03:00 AM) (Source: PC-Doctor)(User: )
Description: (1608) Asapi: (00:03:00:6580)(1608) libTonopahClient.DownloadManager - Error -- 135 HttpException : Http send request failed: getSystemErrormsg: FormatMessage(12007) failed with error: 317

Error: (12/30/2013 00:03:00 AM) (Source: PC-Doctor)(User: )
Description: (1608) Asapi: (00:03:00:6270)(1608) libTonopahClient.DownloadManager - Error -- 135 HttpException : Http send request failed: getSystemErrormsg: FormatMessage(12007) failed with error: 317

Error: (12/29/2013 11:50:01 PM) (Source: PC-Doctor)(User: )
Description: (2624) Asapi: (23:50:01:0170)(2624) libTonopahClient.DownloadManager - Error -- 135 HttpException : Http send request failed: getSystemErrormsg: FormatMessage(12007) failed with error: 317

Error: (12/29/2013 11:50:00 PM) (Source: PC-Doctor)(User: )
Description: (2624) Asapi: (23:50:00:9860)(2624) libTonopahClient.DownloadManager - Error -- 135 HttpException : Http send request failed: getSystemErrormsg: FormatMessage(12007) failed with error: 317

Error: (12/29/2013 11:49:57 PM) (Source: SecurityCenter)(User: )
Description: 

Error: (12/29/2013 11:11:19 PM) (Source: Application Hang)(User: )
Description: iexplore.exe11.0.9600.164281ddc01cf04e1b6d0d1c20C:\Program Files\Internet Explorer\iexplore.exe

Error: (12/29/2013 10:58:01 PM) (Source: PC-Doctor)(User: )
Description: (5400) Asapi: (22:58:01:2950)(5400) libTonopahClient.DownloadManager - Error -- 135 HttpException : Http send request failed: getSystemErrormsg: FormatMessage(12007) failed with error: 317


==================== Memory info =========================== 

Percentage of memory in use: 18%
Total physical RAM: 12219.52 MB
Available physical RAM: 9907.05 MB
Total Pagefile: 24437.21 MB
Available Pagefile: 21783.48 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB

==================== Drives ================================

Drive c: (SSD-System) (Fixed) (Total:119.14 GB) (Free:15.3 GB) NTFS
Drive d: (SSD-Archiv) (Fixed) (Total:119.24 GB) (Free:45.48 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 119 GB) (Disk ID: EEA58562)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119 GB) (Disk ID: 8DAF13F2)
Partition 1: (Not Active) - (Size=119 GB) - (Type=07 NTFS)

==================== End Of Log ============================

weiter geht's mit...

Gmer.txt ist leider auch allein zu lang für das Forum. Es muss daher als Anhang bleiben (siehe Startpost), sry.

Es folgt noch Malwarebytes Anti-Malware -Log:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.29.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Ralf :: LENOVOW701 [Administrator]

Schutz: Aktiviert

30.12.2013 03:08:26
MBAM-log-2013-12-30 (03-38-38).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 528456
Laufzeit: 29 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 5
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Keine Aktion durchgeführt.
HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> Keine Aktion durchgeführt.
HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\Ralf\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt.

Infizierte Dateien: 2
C:\Users\Ralf\AppData\Local\Temp\FreemakeVideoConverter_4.1.1.4.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.
C:\Users\Ralf\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt.

(Ende)

So, das war es erst einmal von mir.

Herzlichen Dank für Deine Mühen!

schrauber · 31.12.2013, 15:39

Funde von MBAM löschen lassen.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

SirEav · 31.12.2013, 18:33

Hallo Schrauber,

vielen Dank für die schnelle Rückmeldung. Ich tat, wie Du mir aufgetragen hast:

Funde vom MBAM löschen lassen.
Download adwcleaner.exe, scannen und dann alles gelöscht, post der Log-Datei:

Code:

ATTFilter

# AdwCleaner v3.016 - Bericht erstellt am 31/12/2013 um 17:52:52
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Ralf - LENOVOW701
# Gestartet von : C:\Users\Ralf\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\iMesh Applications
Ordner Gelöscht : C:\Users\Ralf\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\Ralf\AppData\Roaming\software4u
Ordner Gelöscht : C:\Users\Administrator\AppData\LocalLow\AskToolbar

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKCU\Software\948a88e03bec41
Schlüssel Gelöscht : HKLM\SOFTWARE\948a88e03bec41
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\BI
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Delta

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


*************************

AdwCleaner[R0].txt - [2709 octets] - [31/12/2013 17:51:13]
AdwCleaner[S0].txt - [2369 octets] - [31/12/2013 17:52:52]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2429 octets] ##########

Ausschalten der Schutzsoftware
Download JRT, Scannen als Admin, Logdatei...

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Professional x64
Ran by Ralf on 31.12.2013 at 17:58:14,34
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 31.12.2013 at 18:08:29,94
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Neuer Scann mit FRST und LogFile...

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-12-2013 01
Ran by Ralf (administrator) on LENOVOW701 on 31-12-2013 18:14:11
Running from C:\Users\Ralf\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\DISPUTIL\tplcdclr.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\DigitizerMonitor\DigiMon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(3Dconnexion, INC) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Dropbox, Inc.) C:\Users\Ralf\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3DxNumpad.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AcWin7Hlpr] - C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe [60920 2013-05-29] (Lenovo Group Limited)
HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [384296 2013-08-21] (Lenovo.)
HKLM\...\Run: [ThinkPadDisplayUtility] - C:\Program Files\Lenovo\DISPUTIL\tplcdclr.exe [86376 2009-10-28] (Lenovo Group Limited)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-15] ()
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [Digimon] - C:\Program Files\Lenovo\DigitizerMonitor\DigiMon.exe [17256 2009-10-28] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-09-26] (Synaptics Incorporated)
HKLM-x32\...\Run: [PWMTRV] - C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL [6619432 2013-09-03] (Lenovo Group Limited)
HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111928 2013-05-03] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [69632 2004-04-13] (InstallShield Software Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-30] (AVAST Software)
Winlogon\Notify\LBTWlgn: C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKCU\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKCU\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKCU\...\Run: [ISUSPM Startup] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-05-26] (Google Inc.)
HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\Administrator\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\Administrator\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\Administrator\...\Run: [ISUSPM Startup] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKU\Administrator\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-05-26] (Google Inc.)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll ACGina
Startup: C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Ralf\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
SearchScopes: HKCU - {647A34C2-6D48-41CB-A17F-3922643A51EB} URL = 
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\..\Interfaces\{06D60E06-9F95-47D0-95EF-C4F625AB7591}: [NameServer]192.168.0.1

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-30] (AVAST Software)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2013-09-03] (Lenovo.)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSSQL$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [43028328 2011-09-22] (Microsoft Corporation)
R2 NVWMI; C:\Windows\system32\nvwmi64.exe [2273568 2013-10-23] (NVIDIA Corporation)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\RpcAgentSrv.exe [71832 2008-10-02] (SiSoftware)
S4 SQLAgent$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [370024 2011-09-22] (Microsoft Corporation)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22888 2013-09-17] ()
R2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1028096 2009-09-25] (Lenovo Group Limited)
S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1475896 2010-07-06] (Lenovo Group Limited)
S4 ServiceControl_RTE23_3S_GmbH; "C:\Program Files (x86)\3S Software\CoDeSys SP RTE\ServiceControl_RTE23.exe" [x]
S2 TabletServicePen; C:\Program Files\Tablet\Pen\Pen_Tablet.exe [x]
S2 TouchServicePen; C:\Program Files\Tablet\Pen\Pen_TouchService.exe [x]

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-30] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-30] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-30] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-30] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-30] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R0 Digimon; C:\Windows\System32\Drivers\Digimon.sys [18472 2009-02-20] (Lenovo Group Limited)
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37456 2011-02-18] (Paragon Software Group)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-02] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2013-09-26] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [53840 2011-02-18] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [528464 2011-02-18] (Paragon)
S3 wacommousefilter; system32\DRIVERS\wacommousefilter.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-31 18:14 - 2013-12-31 18:14 - 00017733 _____ C:\Users\Ralf\Desktop\FRST.txt
2013-12-31 18:08 - 2013-12-31 18:08 - 00000624 _____ C:\Users\Ralf\Desktop\JRT01.txt
2013-12-31 17:58 - 2013-12-31 17:58 - 00000000 ____D C:\Windows\ERUNT
2013-12-31 17:57 - 2013-12-31 17:57 - 01034531 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe
2013-12-31 17:55 - 2013-12-31 17:55 - 00002509 _____ C:\Users\Ralf\Desktop\AdwCleaner[S0].txt
2013-12-31 17:51 - 2013-12-31 17:52 - 00000000 ____D C:\AdwCleaner
2013-12-31 17:09 - 2013-12-31 17:09 - 01233962 _____ C:\Users\Ralf\Desktop\adwcleaner.exe
2013-12-30 22:39 - 2013-12-30 22:40 - 00000270 _____ C:\Users\Ralf\Desktop\Trojaner-Board.de.url
2013-12-30 03:07 - 2013-12-30 03:07 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Malwarebytes
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-30 03:07 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-30 03:03 - 2013-12-30 03:03 - 00582248 _____ C:\Users\Ralf\Desktop\Gmer01.txt
2013-12-30 02:54 - 2013-12-30 02:54 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe
2013-12-30 02:52 - 2013-12-30 02:53 - 00054602 _____ C:\Users\Ralf\Desktop\FRST01.txt
2013-12-30 02:52 - 2013-12-30 02:53 - 00028535 _____ C:\Users\Ralf\Desktop\Addition01.txt
2013-12-30 02:52 - 2013-12-30 02:52 - 00000000 ____D C:\FRST
2013-12-30 02:51 - 2013-12-30 02:51 - 01931302 _____ (Farbar) C:\Users\Ralf\Desktop\FRST64.exe
2013-12-30 02:47 - 2013-12-30 02:47 - 00003122 _____ C:\Windows\System32\Tasks\{2217FBD7-B8CE-4751-B209-43640EB0A3C5}
2013-12-30 02:41 - 2013-12-30 02:41 - 00003124 _____ C:\Windows\System32\Tasks\{358FB7F3-846B-4EEB-ABF6-C4A048164B6E}
2013-12-30 02:32 - 2013-12-30 02:45 - 00016516 _____ C:\Users\Ralf\Desktop\hijackthis.log
2013-12-30 02:30 - 2013-12-30 02:30 - 00388608 _____ (Trend Micro Inc.) C:\Users\Ralf\Desktop\YES WE CAN.com
2013-12-30 00:16 - 2013-12-30 00:16 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\AVAST Software
2013-12-30 00:15 - 2013-12-30 21:38 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-12-30 00:15 - 2013-12-30 00:16 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-30 00:15 - 2013-12-30 00:15 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-30 00:15 - 2013-12-30 00:15 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-29 23:05 - 2013-12-29 23:05 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\QuickScan
2013-12-26 23:59 - 2013-12-26 23:59 - 00000000 ____D C:\Users\Ralf\Documents\ANNO 2070
2013-12-26 23:11 - 2013-12-26 23:30 - 00000000 ____D C:\Users\Ralf\AppData\Local\Ubisoft Game Launcher
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Ubisoft
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\ProgramData\Solidshield
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-12-26 23:10 - 2013-12-26 23:10 - 00017475 _____ C:\Windows\DirectX.log
2013-12-26 22:52 - 2013-12-26 22:52 - 00000263 _____ C:\Windows\system32\TeamViewer9_Hooks.log
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iTunes
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iPod
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-18 01:14 - 2013-12-18 01:14 - 00000000 ____D C:\Users\Ralf\Documents\Paradox Interactive
2013-12-18 00:45 - 2013-12-18 00:48 - 00000000 ____D C:\Users\Ralf\Documents\CarrierCommandDemo
2013-12-17 22:47 - 2013-12-17 22:47 - 00002222 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-12-17 22:45 - 2013-12-17 22:45 - 00003276 _____ C:\Windows\System32\Tasks\{4E791C89-B08C-4509-9F96-F278849D5D69}
2013-12-15 03:00 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-15 03:00 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-15 03:00 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-15 03:00 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-15 03:00 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-15 03:00 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-15 03:00 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-15 03:00 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-15 03:00 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-15 03:00 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-15 03:00 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-15 03:00 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-15 03:00 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-15 03:00 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-15 03:00 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-15 03:00 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-15 03:00 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-15 03:00 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-15 03:00 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-15 03:00 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-15 03:00 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-15 03:00 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-15 03:00 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-15 03:00 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-15 03:00 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-15 03:00 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-15 03:00 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-15 03:00 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-15 03:00 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-15 03:00 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-15 03:00 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-14 03:06 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-12-14 03:02 - 2013-12-14 03:07 - 00009916 _____ C:\Windows\IE11_main.log
2013-12-14 03:02 - 2013-12-14 03:02 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-12 12:41 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 12:41 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 12:41 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 12:41 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-12 09:36 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 09:36 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 09:36 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-12 09:36 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-12 09:36 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 09:36 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 09:36 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 09:36 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 09:36 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 09:36 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 09:36 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 09:36 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-12 09:36 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 09:36 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-12 09:36 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 09:36 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-12 09:36 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-12 09:36 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-12 09:36 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-04 21:19 - 2013-12-04 21:49 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-12-04 21:19 - 2013-12-04 21:19 - 00003364 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-12-01 12:01 - 2013-12-01 12:01 - 00001330 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\Users\Ralf\Documents\Freemake
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\ProgramData\Freemake
2013-12-01 12:00 - 2013-12-01 12:01 - 00000000 ____D C:\Program Files (x86)\Freemake

==================== One Month Modified Files and Folders =======

2013-12-31 18:14 - 2013-12-31 18:14 - 00017733 _____ C:\Users\Ralf\Desktop\FRST.txt
2013-12-31 18:12 - 2013-11-07 21:22 - 00004771 _____ C:\Windows\setupact.log
2013-12-31 18:12 - 2013-10-30 23:17 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Dropbox
2013-12-31 18:12 - 2012-05-26 01:26 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-31 18:12 - 2012-05-23 22:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-31 18:12 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-31 18:11 - 2012-05-23 19:45 - 01174359 _____ C:\Windows\WindowsUpdate.log
2013-12-31 18:08 - 2013-12-31 18:08 - 00000624 _____ C:\Users\Ralf\Desktop\JRT01.txt
2013-12-31 18:01 - 2009-07-14 18:58 - 00768542 _____ C:\Windows\system32\perfh007.dat
2013-12-31 18:01 - 2009-07-14 18:58 - 00175240 _____ C:\Windows\system32\perfc007.dat
2013-12-31 18:01 - 2009-07-14 06:13 - 01812778 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-31 18:01 - 2009-07-14 05:45 - 00015632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-31 18:01 - 2009-07-14 05:45 - 00015632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-31 17:59 - 2012-05-23 20:02 - 00000466 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-12-31 17:58 - 2013-12-31 17:58 - 00000000 ____D C:\Windows\ERUNT
2013-12-31 17:57 - 2013-12-31 17:57 - 01034531 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe
2013-12-31 17:55 - 2013-12-31 17:55 - 00002509 _____ C:\Users\Ralf\Desktop\AdwCleaner[S0].txt
2013-12-31 17:52 - 2013-12-31 17:51 - 00000000 ____D C:\AdwCleaner
2013-12-31 17:46 - 2012-05-26 01:26 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-31 17:44 - 2013-11-09 17:26 - 00904362 _____ C:\Windows\PFRO.log
2013-12-31 17:41 - 2012-05-24 13:15 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-31 17:33 - 2012-05-23 20:02 - 00003448 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-12-31 17:09 - 2013-12-31 17:09 - 01233962 _____ C:\Users\Ralf\Desktop\adwcleaner.exe
2013-12-30 22:40 - 2013-12-30 22:39 - 00000270 _____ C:\Users\Ralf\Desktop\Trojaner-Board.de.url
2013-12-30 21:38 - 2013-12-30 00:15 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-12-30 03:07 - 2013-12-30 03:07 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Malwarebytes
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-30 03:03 - 2013-12-30 03:03 - 00582248 _____ C:\Users\Ralf\Desktop\Gmer01.txt
2013-12-30 02:54 - 2013-12-30 02:54 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe
2013-12-30 02:53 - 2013-12-30 02:52 - 00054602 _____ C:\Users\Ralf\Desktop\FRST01.txt
2013-12-30 02:53 - 2013-12-30 02:52 - 00028535 _____ C:\Users\Ralf\Desktop\Addition01.txt
2013-12-30 02:52 - 2013-12-30 02:52 - 00000000 ____D C:\FRST
2013-12-30 02:51 - 2013-12-30 02:51 - 01931302 _____ (Farbar) C:\Users\Ralf\Desktop\FRST64.exe
2013-12-30 02:47 - 2013-12-30 02:47 - 00003122 _____ C:\Windows\System32\Tasks\{2217FBD7-B8CE-4751-B209-43640EB0A3C5}
2013-12-30 02:45 - 2013-12-30 02:32 - 00016516 _____ C:\Users\Ralf\Desktop\hijackthis.log
2013-12-30 02:41 - 2013-12-30 02:41 - 00003124 _____ C:\Windows\System32\Tasks\{358FB7F3-846B-4EEB-ABF6-C4A048164B6E}
2013-12-30 02:30 - 2013-12-30 02:30 - 00388608 _____ (Trend Micro Inc.) C:\Users\Ralf\Desktop\YES WE CAN.com
2013-12-30 00:16 - 2013-12-30 00:16 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\AVAST Software
2013-12-30 00:16 - 2013-12-30 00:15 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-30 00:15 - 2013-12-30 00:15 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-30 00:15 - 2013-12-30 00:15 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-30 00:14 - 2012-06-01 12:26 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-29 23:51 - 2013-09-05 14:10 - 00001912 _____ C:\Windows\epplauncher.mif
2013-12-29 23:28 - 2012-05-28 16:05 - 00000000 ____D C:\Users\Ralf\AppData\Local\837516E7-1B0C-4816-BE63-04306B16DBFD.aplzod
2013-12-29 23:28 - 2012-02-19 12:50 - 00000000 ____D C:\Users\Ralf\Documents\Outlook-Dateien
2013-12-29 23:05 - 2013-12-29 23:05 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\QuickScan
2013-12-26 23:59 - 2013-12-26 23:59 - 00000000 ____D C:\Users\Ralf\Documents\ANNO 2070
2013-12-26 23:30 - 2013-12-26 23:11 - 00000000 ____D C:\Users\Ralf\AppData\Local\Ubisoft Game Launcher
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Ubisoft
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\ProgramData\Solidshield
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-12-26 23:11 - 2012-05-23 19:59 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-26 23:10 - 2013-12-26 23:10 - 00017475 _____ C:\Windows\DirectX.log
2013-12-26 23:08 - 2012-05-23 20:03 - 00119216 _____ C:\Users\Ralf\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-26 22:54 - 2009-07-14 05:45 - 00435688 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-26 22:52 - 2013-12-26 22:52 - 00000263 _____ C:\Windows\system32\TeamViewer9_Hooks.log
2013-12-26 22:52 - 2012-05-24 13:25 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2013-12-22 14:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-20 23:16 - 2013-10-30 23:17 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-20 23:16 - 2012-05-23 19:45 - 00000000 ___RD C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iTunes
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iPod
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-18 01:14 - 2013-12-18 01:14 - 00000000 ____D C:\Users\Ralf\Documents\Paradox Interactive
2013-12-18 00:48 - 2013-12-18 00:45 - 00000000 ____D C:\Users\Ralf\Documents\CarrierCommandDemo
2013-12-17 22:47 - 2013-12-17 22:47 - 00002222 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-12-17 22:47 - 2012-05-26 01:26 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-17 22:45 - 2013-12-17 22:45 - 00003276 _____ C:\Windows\System32\Tasks\{4E791C89-B08C-4509-9F96-F278849D5D69}
2013-12-15 03:29 - 2012-05-24 18:25 - 01787058 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-12-14 23:32 - 2012-05-27 19:57 - 00000000 ____D C:\Users\Ralf\Documents\My Games
2013-12-14 23:29 - 2012-05-23 19:46 - 00001431 _____ C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-14 03:22 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-14 03:07 - 2013-12-14 03:02 - 00009916 _____ C:\Windows\IE11_main.log
2013-12-14 03:02 - 2013-12-14 03:02 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-14 03:01 - 2013-08-18 12:16 - 00000000 ____D C:\Windows\system32\MRT
2013-12-14 03:00 - 2012-05-24 14:56 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-12 12:40 - 2012-05-24 17:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-11 23:41 - 2012-05-24 13:15 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 23:41 - 2012-05-24 13:15 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 23:41 - 2012-05-24 13:15 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-11 01:41 - 2012-05-26 01:26 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-11 01:41 - 2012-05-26 01:26 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-05 23:29 - 2012-05-23 20:02 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-12-04 21:49 - 2013-12-04 21:19 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-12-04 21:19 - 2013-12-04 21:19 - 00003364 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-12-04 21:19 - 2012-05-23 20:02 - 00004232 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-12-01 12:01 - 2013-12-01 12:01 - 00001330 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\Users\Ralf\Documents\Freemake
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-12-01 12:01 - 2013-12-01 12:01 - 00000000 ____D C:\ProgramData\Freemake
2013-12-01 12:01 - 2013-12-01 12:00 - 00000000 ____D C:\Program Files (x86)\Freemake

Some content of TEMP:
====================
C:\Users\Ralf\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-22 14:09

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Okay, und nun?

Wünsche Dir einen tollen Abend und einen guten Rutsch!

SirEav · 31.12.2013, 21:18

...ich habe nochmal mit Avast gescannt - der meldet folgendes:

Ich weiß nicht, ob das neben den gepostetem Logs noch relevant ist.

Grüße

schrauber · 01.01.2014, 13:36

Ich brauch bitte den kompletten Pfad wo das gefunden wurde.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte.

SirEav · 01.01.2014, 17:57

Moin,
also hier erst einmal der Pfad aus dem Avast-Log:

File C:\avast! sandbox\S-1-5-21-3572172129-898756615-2021906008-1000\webStorage\C\Windows\system32\xpssvcs.dll **HIDDEN**

Den Rest scannte ich (mit allen! Wechselmedien, außer meiner Backup-Platte...habe die (leider?) länger nicht dran gehabt und ich habe Sorge, die ggf. auch noch zu verseuchen, falls sie ja doch noch sauber ist).
Ich lasse also die Backup-Platte noch außen vor, bis Du Dich bitte dazu nochmal äußerst, okay?

So hier nun die Ergebnisse bzw. Logs...

Eset:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=5368c452663e2d4e9791bddc7182cc0b
# engine=16478
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-01 04:36:34
# local_time=2014-01-01 05:36:34 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 71 77 234782 238848 0 0
# compatibility_mode=5893 16776573 100 94 0 140224044 0 0
# scanned=315470
# found=0
# cleaned=0
# scan_time=8078

SecurityCheck:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.77  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java 7 Update 45  
 Adobe Flash Player 11.9.900.170  
 Adobe Reader XI  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

und das FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-12-2013 01
Ran by Ralf (administrator) on LENOVOW701 on 01-01-2014 17:51:15
Running from C:\Users\Ralf\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\DISPUTIL\tplcdclr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\DigitizerMonitor\DigiMon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(3Dconnexion, INC) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Dropbox, Inc.) C:\Users\Ralf\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3DxNumpad.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Lenovo Group Limited) C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AcWin7Hlpr] - C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe [60920 2013-05-29] (Lenovo Group Limited)
HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [384296 2013-08-21] (Lenovo.)
HKLM\...\Run: [ThinkPadDisplayUtility] - C:\Program Files\Lenovo\DISPUTIL\tplcdclr.exe [86376 2009-10-28] (Lenovo Group Limited)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-15] ()
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [Digimon] - C:\Program Files\Lenovo\DigitizerMonitor\DigiMon.exe [17256 2009-10-28] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-09-26] (Synaptics Incorporated)
HKLM-x32\...\Run: [PWMTRV] - C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL [6619432 2013-09-03] (Lenovo Group Limited)
HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111928 2013-05-03] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [69632 2004-04-13] (InstallShield Software Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-30] (AVAST Software)
Winlogon\Notify\LBTWlgn: C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKCU\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKCU\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKCU\...\Run: [ISUSPM Startup] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-05-26] (Google Inc.)
HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\Administrator\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\Administrator\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\Administrator\...\Run: [ISUSPM Startup] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKU\Administrator\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-05-26] (Google Inc.)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll ACGina
Startup: C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Ralf\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
SearchScopes: HKCU - {647A34C2-6D48-41CB-A17F-3922643A51EB} URL = 
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\..\Interfaces\{06D60E06-9F95-47D0-95EF-C4F625AB7591}: [NameServer]192.168.0.1

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-30] (AVAST Software)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2013-09-03] (Lenovo.)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSSQL$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [43028328 2011-09-22] (Microsoft Corporation)
R2 NVWMI; C:\Windows\system32\nvwmi64.exe [2273568 2013-10-23] (NVIDIA Corporation)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\RpcAgentSrv.exe [71832 2008-10-02] (SiSoftware)
S4 SQLAgent$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [370024 2011-09-22] (Microsoft Corporation)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22888 2013-09-17] ()
R2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1028096 2009-09-25] (Lenovo Group Limited)
S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1475896 2010-07-06] (Lenovo Group Limited)
S4 ServiceControl_RTE23_3S_GmbH; "C:\Program Files (x86)\3S Software\CoDeSys SP RTE\ServiceControl_RTE23.exe" [x]
S2 TabletServicePen; C:\Program Files\Tablet\Pen\Pen_Tablet.exe [x]
S2 TouchServicePen; C:\Program Files\Tablet\Pen\Pen_TouchService.exe [x]

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-30] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-30] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-30] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-30] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-30] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R0 Digimon; C:\Windows\System32\Drivers\Digimon.sys [18472 2009-02-20] (Lenovo Group Limited)
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37456 2011-02-18] (Paragon Software Group)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-02] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2013-09-26] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [53840 2011-02-18] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [528464 2011-02-18] (Paragon)
S3 wacommousefilter; system32\DRIVERS\wacommousefilter.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-01 17:51 - 2014-01-01 17:51 - 00018056 _____ C:\Users\Ralf\Desktop\FRST.txt
2014-01-01 17:51 - 2014-01-01 17:51 - 00000945 _____ C:\Users\Ralf\Desktop\checkup.txt
2014-01-01 17:42 - 2014-01-01 17:42 - 00891200 _____ C:\Users\Ralf\Desktop\SecurityCheck.exe
2014-01-01 15:09 - 2014-01-01 15:09 - 02347384 _____ (ESET) C:\Users\Ralf\Desktop\esetsmartinstaller_enu.exe
2013-12-31 18:14 - 2013-12-31 18:14 - 00057412 _____ C:\Users\Ralf\Desktop\FRST02.txt
2013-12-31 18:08 - 2013-12-31 18:08 - 00000624 _____ C:\Users\Ralf\Desktop\JRT01.txt
2013-12-31 17:58 - 2013-12-31 17:58 - 00000000 ____D C:\Windows\ERUNT
2013-12-31 17:57 - 2013-12-31 17:57 - 01034531 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe
2013-12-31 17:55 - 2013-12-31 17:55 - 00002509 _____ C:\Users\Ralf\Desktop\AdwCleaner[S0].txt
2013-12-31 17:51 - 2013-12-31 17:52 - 00000000 ____D C:\AdwCleaner
2013-12-31 17:09 - 2013-12-31 17:09 - 01233962 _____ C:\Users\Ralf\Desktop\adwcleaner.exe
2013-12-30 22:39 - 2013-12-30 22:40 - 00000270 _____ C:\Users\Ralf\Desktop\Trojaner-Board.de.url
2013-12-30 03:07 - 2013-12-30 03:07 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Malwarebytes
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-30 03:07 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-30 03:03 - 2013-12-30 03:03 - 00582248 _____ C:\Users\Ralf\Desktop\Gmer01.txt
2013-12-30 02:54 - 2013-12-30 02:54 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe
2013-12-30 02:52 - 2013-12-30 02:53 - 00054602 _____ C:\Users\Ralf\Desktop\FRST01.txt
2013-12-30 02:52 - 2013-12-30 02:53 - 00028535 _____ C:\Users\Ralf\Desktop\Addition01.txt
2013-12-30 02:52 - 2013-12-30 02:52 - 00000000 ____D C:\FRST
2013-12-30 02:51 - 2013-12-30 02:51 - 01931302 _____ (Farbar) C:\Users\Ralf\Desktop\FRST64.exe
2013-12-30 02:47 - 2013-12-30 02:47 - 00003122 _____ C:\Windows\System32\Tasks\{2217FBD7-B8CE-4751-B209-43640EB0A3C5}
2013-12-30 02:41 - 2013-12-30 02:41 - 00003124 _____ C:\Windows\System32\Tasks\{358FB7F3-846B-4EEB-ABF6-C4A048164B6E}
2013-12-30 02:32 - 2013-12-30 02:45 - 00016516 _____ C:\Users\Ralf\Desktop\hijackthis.log
2013-12-30 02:30 - 2013-12-30 02:30 - 00388608 _____ (Trend Micro Inc.) C:\Users\Ralf\Desktop\YES WE CAN.com
2013-12-30 00:16 - 2013-12-30 00:16 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\AVAST Software
2013-12-30 00:15 - 2013-12-30 21:38 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-12-30 00:15 - 2013-12-30 00:16 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-30 00:15 - 2013-12-30 00:15 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-30 00:15 - 2013-12-30 00:15 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-29 23:05 - 2013-12-29 23:05 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\QuickScan
2013-12-26 23:59 - 2013-12-26 23:59 - 00000000 ____D C:\Users\Ralf\Documents\ANNO 2070
2013-12-26 23:11 - 2013-12-26 23:30 - 00000000 ____D C:\Users\Ralf\AppData\Local\Ubisoft Game Launcher
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Ubisoft
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\ProgramData\Solidshield
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-12-26 23:10 - 2013-12-26 23:10 - 00017475 _____ C:\Windows\DirectX.log
2013-12-26 22:52 - 2013-12-26 22:52 - 00000263 _____ C:\Windows\system32\TeamViewer9_Hooks.log
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iTunes
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iPod
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-18 01:14 - 2013-12-18 01:14 - 00000000 ____D C:\Users\Ralf\Documents\Paradox Interactive
2013-12-18 00:45 - 2013-12-18 00:48 - 00000000 ____D C:\Users\Ralf\Documents\CarrierCommandDemo
2013-12-17 22:47 - 2013-12-17 22:47 - 00002222 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-12-17 22:45 - 2013-12-17 22:45 - 00003276 _____ C:\Windows\System32\Tasks\{4E791C89-B08C-4509-9F96-F278849D5D69}
2013-12-15 03:00 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-15 03:00 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-15 03:00 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-15 03:00 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-15 03:00 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-15 03:00 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-15 03:00 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-15 03:00 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-15 03:00 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-15 03:00 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-15 03:00 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-15 03:00 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-15 03:00 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-15 03:00 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-15 03:00 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-15 03:00 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-15 03:00 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-15 03:00 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-15 03:00 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-15 03:00 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-15 03:00 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-15 03:00 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-15 03:00 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-15 03:00 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-15 03:00 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-15 03:00 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-15 03:00 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-15 03:00 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-15 03:00 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-15 03:00 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-15 03:00 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-14 03:06 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-12-14 03:02 - 2013-12-14 03:07 - 00009916 _____ C:\Windows\IE11_main.log
2013-12-14 03:02 - 2013-12-14 03:02 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-12 12:41 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 12:41 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 12:41 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 12:41 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-12 09:36 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 09:36 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 09:36 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-12 09:36 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-12 09:36 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 09:36 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 09:36 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 09:36 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 09:36 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 09:36 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 09:36 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 09:36 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-12 09:36 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 09:36 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-12 09:36 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 09:36 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-12 09:36 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-12 09:36 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-12 09:36 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-04 21:19 - 2013-12-04 21:49 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-12-04 21:19 - 2013-12-04 21:19 - 00003364 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay

==================== One Month Modified Files and Folders =======

2014-01-01 17:51 - 2014-01-01 17:51 - 00018056 _____ C:\Users\Ralf\Desktop\FRST.txt
2014-01-01 17:51 - 2014-01-01 17:51 - 00000945 _____ C:\Users\Ralf\Desktop\checkup.txt
2014-01-01 17:48 - 2012-05-23 20:02 - 00003448 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2014-01-01 17:48 - 2012-05-23 20:02 - 00000000 ____D C:\ProgramData\PCDr
2014-01-01 17:48 - 2012-05-23 19:45 - 01214606 _____ C:\Windows\WindowsUpdate.log
2014-01-01 17:47 - 2013-10-30 23:17 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Dropbox
2014-01-01 17:46 - 2013-11-09 17:26 - 00905188 _____ C:\Windows\PFRO.log
2014-01-01 17:46 - 2013-11-07 21:22 - 00004883 _____ C:\Windows\setupact.log
2014-01-01 17:46 - 2012-05-26 01:26 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-01 17:46 - 2012-05-23 22:11 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-01 17:46 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-01 17:42 - 2014-01-01 17:42 - 00891200 _____ C:\Users\Ralf\Desktop\SecurityCheck.exe
2014-01-01 17:41 - 2012-05-24 13:15 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-01 17:33 - 2012-05-23 20:02 - 00000466 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2014-01-01 16:46 - 2012-05-26 01:26 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-01 15:12 - 2009-07-14 18:58 - 00768542 _____ C:\Windows\system32\perfh007.dat
2014-01-01 15:12 - 2009-07-14 18:58 - 00175240 _____ C:\Windows\system32\perfc007.dat
2014-01-01 15:12 - 2009-07-14 06:13 - 01812778 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-01 15:09 - 2014-01-01 15:09 - 02347384 _____ (ESET) C:\Users\Ralf\Desktop\esetsmartinstaller_enu.exe
2014-01-01 14:57 - 2009-07-14 05:45 - 00015632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-01 14:57 - 2009-07-14 05:45 - 00015632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-01 02:48 - 2012-05-28 16:05 - 00000000 ____D C:\Users\Ralf\AppData\Local\837516E7-1B0C-4816-BE63-04306B16DBFD.aplzod
2014-01-01 02:48 - 2012-02-19 12:50 - 00000000 ____D C:\Users\Ralf\Documents\Outlook-Dateien
2013-12-31 18:14 - 2013-12-31 18:14 - 00057412 _____ C:\Users\Ralf\Desktop\FRST02.txt
2013-12-31 18:08 - 2013-12-31 18:08 - 00000624 _____ C:\Users\Ralf\Desktop\JRT01.txt
2013-12-31 17:58 - 2013-12-31 17:58 - 00000000 ____D C:\Windows\ERUNT
2013-12-31 17:57 - 2013-12-31 17:57 - 01034531 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe
2013-12-31 17:55 - 2013-12-31 17:55 - 00002509 _____ C:\Users\Ralf\Desktop\AdwCleaner[S0].txt
2013-12-31 17:52 - 2013-12-31 17:51 - 00000000 ____D C:\AdwCleaner
2013-12-31 17:09 - 2013-12-31 17:09 - 01233962 _____ C:\Users\Ralf\Desktop\adwcleaner.exe
2013-12-30 22:40 - 2013-12-30 22:39 - 00000270 _____ C:\Users\Ralf\Desktop\Trojaner-Board.de.url
2013-12-30 21:38 - 2013-12-30 00:15 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-12-30 03:07 - 2013-12-30 03:07 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Malwarebytes
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-30 03:07 - 2013-12-30 03:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-30 03:03 - 2013-12-30 03:03 - 00582248 _____ C:\Users\Ralf\Desktop\Gmer01.txt
2013-12-30 02:54 - 2013-12-30 02:54 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe
2013-12-30 02:53 - 2013-12-30 02:52 - 00054602 _____ C:\Users\Ralf\Desktop\FRST01.txt
2013-12-30 02:53 - 2013-12-30 02:52 - 00028535 _____ C:\Users\Ralf\Desktop\Addition01.txt
2013-12-30 02:52 - 2013-12-30 02:52 - 00000000 ____D C:\FRST
2013-12-30 02:51 - 2013-12-30 02:51 - 01931302 _____ (Farbar) C:\Users\Ralf\Desktop\FRST64.exe
2013-12-30 02:47 - 2013-12-30 02:47 - 00003122 _____ C:\Windows\System32\Tasks\{2217FBD7-B8CE-4751-B209-43640EB0A3C5}
2013-12-30 02:45 - 2013-12-30 02:32 - 00016516 _____ C:\Users\Ralf\Desktop\hijackthis.log
2013-12-30 02:41 - 2013-12-30 02:41 - 00003124 _____ C:\Windows\System32\Tasks\{358FB7F3-846B-4EEB-ABF6-C4A048164B6E}
2013-12-30 02:30 - 2013-12-30 02:30 - 00388608 _____ (Trend Micro Inc.) C:\Users\Ralf\Desktop\YES WE CAN.com
2013-12-30 00:16 - 2013-12-30 00:16 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\AVAST Software
2013-12-30 00:16 - 2013-12-30 00:15 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-12-30 00:15 - 2013-12-30 00:15 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-12-30 00:15 - 2013-12-30 00:15 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-12-30 00:15 - 2013-12-30 00:15 - 00000000 ____D C:\Program Files\AVAST Software
2013-12-30 00:14 - 2012-06-01 12:26 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-29 23:51 - 2013-09-05 14:10 - 00001912 _____ C:\Windows\epplauncher.mif
2013-12-29 23:05 - 2013-12-29 23:05 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\QuickScan
2013-12-26 23:59 - 2013-12-26 23:59 - 00000000 ____D C:\Users\Ralf\Documents\ANNO 2070
2013-12-26 23:30 - 2013-12-26 23:11 - 00000000 ____D C:\Users\Ralf\AppData\Local\Ubisoft Game Launcher
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Ubisoft
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\ProgramData\Solidshield
2013-12-26 23:11 - 2013-12-26 23:11 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-12-26 23:11 - 2012-05-23 19:59 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-26 23:10 - 2013-12-26 23:10 - 00017475 _____ C:\Windows\DirectX.log
2013-12-26 23:08 - 2012-05-23 20:03 - 00119216 _____ C:\Users\Ralf\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-26 22:54 - 2009-07-14 05:45 - 00435688 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-26 22:52 - 2013-12-26 22:52 - 00000263 _____ C:\Windows\system32\TeamViewer9_Hooks.log
2013-12-26 22:52 - 2012-05-24 13:25 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2013-12-22 14:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-20 23:16 - 2013-10-30 23:17 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-12-20 23:16 - 2012-05-23 19:45 - 00000000 ___RD C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iTunes
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files\iPod
2013-12-18 22:03 - 2013-12-18 22:03 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-18 01:14 - 2013-12-18 01:14 - 00000000 ____D C:\Users\Ralf\Documents\Paradox Interactive
2013-12-18 00:48 - 2013-12-18 00:45 - 00000000 ____D C:\Users\Ralf\Documents\CarrierCommandDemo
2013-12-17 22:47 - 2013-12-17 22:47 - 00002222 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-12-17 22:47 - 2012-05-26 01:26 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-17 22:45 - 2013-12-17 22:45 - 00003276 _____ C:\Windows\System32\Tasks\{4E791C89-B08C-4509-9F96-F278849D5D69}
2013-12-15 03:29 - 2012-05-24 18:25 - 01787058 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-12-14 23:32 - 2012-05-27 19:57 - 00000000 ____D C:\Users\Ralf\Documents\My Games
2013-12-14 23:29 - 2012-05-23 19:46 - 00001431 _____ C:\Users\Ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-14 03:22 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-14 03:07 - 2013-12-14 03:02 - 00009916 _____ C:\Windows\IE11_main.log
2013-12-14 03:02 - 2013-12-14 03:02 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-14 03:02 - 2013-12-14 03:02 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-14 03:02 - 2013-12-14 03:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-14 03:02 - 2013-12-14 03:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-14 03:02 - 2013-12-14 03:02 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-14 03:02 - 2013-12-14 03:02 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-14 03:01 - 2013-08-18 12:16 - 00000000 ____D C:\Windows\system32\MRT
2013-12-14 03:00 - 2012-05-24 14:56 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-12 12:40 - 2012-05-24 17:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-11 23:41 - 2012-05-24 13:15 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 23:41 - 2012-05-24 13:15 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 23:41 - 2012-05-24 13:15 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-11 01:41 - 2012-05-26 01:26 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-11 01:41 - 2012-05-26 01:26 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-05 23:29 - 2012-05-23 20:02 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-12-04 21:49 - 2013-12-04 21:19 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-12-04 21:19 - 2013-12-04 21:19 - 00003364 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-12-04 21:19 - 2012-05-23 20:02 - 00004232 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask

Some content of TEMP:
====================
C:\Users\Ralf\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-31 19:18

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Grüße und die besten Neujahreswünsche
Ralf

schrauber · 02.01.2014, 16:47

Die kannste ruhig mitscannen, oder auch sein lassen, wie du magst, passieren kann nix

Zitat:

C:\avast! sandbox\S-1-5-21-3572172129-898756615-2021906008-1000\webStorage\C\Windows\system32\xpssvcs.dll **HIDDEN**

Kannste die nit einach löschen? Ansonsten ist der Rechner sauber.

SirEav · 02.01.2014, 17:11

Hallo Schrauber,

löschen habe ich schon versucht (via Avast-Funktion) - dann macht der Rechner einen Neustart - Avast scannt beim booten und löscht vermutlich - aber diese Datei

Zitat:

xpssvcs.dll

ist danach wieder/noch da. Kann ich die irgendwie auch anders löschen? Vielleicht im abgesicherten Modus oder mithilfe zusätzlicher Software?

Ansonsten bin ich Dir sehr dankbar für Deine Arbeit und möchte Euch (und dieses Projekt)gern unterstützen. Bist Du auch wirklich sicher? Nicht, dass mir mein Paypal-Account nach Passworteingabe um die Ohren fliegt

Herzliche Grüße und viel Erfolg im Studium
(Ich stecke auch gerade in den Prüfungsvorbereitungen)

schrauber · 03.01.2014, 12:24

In Avast:

setze mal die SafeZone Inhalte zurück: In der Benutzeroberfläche -> Zusätzlicher Schutz -> SafeZone -> Einstellungen -> SafeZone zurücksetzen.

SirEav · 03.01.2014, 21:50

Hallo Schrauber,

leider finde ich diese Optionen bei meinem Avast nicht...
Bei mir scheint es so, als sei die "SafeZone" nicht installiert (siehe Screenshots).

Ich kann in den Einstellungen nur "Auf Werkseinstellungen zurücksetzen" - ansonsten
gibt's da nichts derartiges.

Hast Du evtl. noch andere Ideen?

...Habe nun auch die Nutzung von Paypal wieder gewagt - wir werden ja sehen was jetzt noch so passiert

Grüße

SirEav · 03.01.2014, 23:01

.....Okay.....

so wie es aussieht, habe ich selbst doch eine Lösung gefunden.
Ich habe Avast deinstalliert und mit dem "avast Software Uninstall Utility" im abgesicherten Modus auch das Verzeichnis

Zitat:

C:\avast! sandbox

gelöscht.

Danach habe ich Avast Free AntiVirus neu installiert und gescannt. Avast hat nichts mehr gefunden.

Gibt's es aus Deiner Sicht noch etwas sinnvolles zu tun? Eine Art "finaler Scan" oder sowas?
Habe mich grad schon so sehr ans scannen gewöhnt

Wenn nicht, nochmals herzlichen Dank! ->kleine Spende ist erfolgt.

Dann wäre der Thread (und auch der threat

) aus meiner Sicht beendet.

schrauber · 04.01.2014, 15:50

Fertig

Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

SirEav · 05.01.2014, 02:32

Hmm, mit diesem Absatz weiß ich jetzt nichts anzufangen:

Zitat:

Die Reihenfolge ist hier entscheidend.
Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
Windowstaste + R > Combofix /Uninstall (eingeben) > OK
Alternative: Combofix.exe in uninstall.exe umbenennen und starten
Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.
Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Ich denke, Du hast hier den Thread etwas verplant, oder steh ich aufm Schlauch?

Was den Rest angeht:

Zitat:

Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun

Zitat:

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

All done!

mail gehackt - ebay-Konto missbraucht, Scans erhärten den Verdacht - System befallen!

Log-Analyse und Auswertung: mail gehackt - ebay-Konto missbraucht, Scans erhärten den Verdacht - System befallen!