Email- und Ebaykonto missbraucht: TR/Fraud.Gen8 und TR/Crypt.TPM.Gen beim Virenscan gefunden

anwo1984 · 09.01.2014, 01:36

Hallo Trojaner-Board,

ich benötige bitte Eure Hilfe.

Ich habe vor einigen Tagen durch Zufall mitbekommen, dass mein Email- und mein Ebaykonto missbraucht wurden. Es war naheliegend, dass die Täter durch eine Schadsoftware an meine Zugangsdaten gekommen sind.

Der Virenscan hat folgende Trojaner gefunden:
TR/Fraud.Gen8 und TR/Crypt.TPM.Gen.

Das Virenprogramm hat diese gelöscht.

Da ich mir nicht sicher bin, ob der Rechner jetzt tatsächlich wieder sicher und virenfrei ist, habe ich Eure Anleitung befolgt und folgende Scans durchgeführt:
FRST.txt
Addition.txt
Gmer.zip
defogger_disable.txt.

Des Weiteren habe ich den Log mit den Funden von Avira angehangen. Der Scan mit Malwarebytes' Anti Malware ergab keine Funde.

defogger_disable.txt:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:58 on 08/01/2014 (*********)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST.txt:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-01-2014 01
Ran by ********* (administrator) on ANGI on 09-01-2014 00:02:10
Running from C:\Users\*********\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
() C:\Users\*********\Desktop\Defogger.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2014-01-06] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)
HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKLM - DefaultScope {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Ghostery - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\firefox@ghostery.com.xpi
FF Extension: NoScript - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: Adblock Plus - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: BetterPrivacy - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2014-01-06] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-27] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)
R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [28560 2012-08-30] (ELAN Microelectronics Corp.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-11] (Dritek System INC.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-07-31] (Atheros)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-01-06] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2014-01-06] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-11] (Dritek System Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-09 00:02 - 2014-01-09 00:02 - 00013052 _____ C:\Users\*********\Desktop\FRST.txt
2014-01-09 00:01 - 2014-01-09 00:01 - 00000000 ____D C:\FRST
2014-01-08 23:59 - 2014-01-08 23:59 - 01931770 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe
2014-01-08 23:58 - 2014-01-08 23:58 - 00000480 _____ C:\Users\*********\Desktop\defogger_disable.log
2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable
2014-01-08 23:53 - 2014-01-08 23:53 - 00050477 _____ C:\Users\*********\Desktop\Defogger.exe
2014-01-08 23:39 - 2014-01-08 23:39 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-08 23:36 - 2014-01-08 23:37 - 00000000 ____D C:\AdwCleaner
2014-01-08 23:35 - 2014-01-08 23:35 - 01233962 _____ C:\Users\*********\Desktop\adwcleaner.exe
2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-01-08 21:46 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Windows Live
2014-01-08 21:46 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-01-08 21:46 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-01-08 21:46 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-01-08 21:45 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-01-08 21:45 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-01-08 21:42 - 2014-01-08 21:42 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live
2014-01-08 21:40 - 2014-01-08 21:41 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt
2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log
2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe
2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg
2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes
2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-08 17:42 - 2014-01-08 23:43 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia
2014-01-06 18:43 - 2014-01-06 18:46 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett
2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk

==================== One Month Modified Files and Folders =======

2014-01-09 00:02 - 2014-01-09 00:02 - 00013052 _____ C:\Users\*********\Desktop\FRST.txt
2014-01-09 00:01 - 2014-01-09 00:01 - 00000000 ____D C:\FRST
2014-01-09 00:00 - 2013-06-23 00:28 - 00003594 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-627669732-214247668-4251278340-1002
2014-01-09 00:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2014-01-08 23:59 - 2014-01-08 23:59 - 01931770 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe
2014-01-08 23:58 - 2014-01-08 23:58 - 00000480 _____ C:\Users\*********\Desktop\defogger_disable.log
2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable
2014-01-08 23:58 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********
2014-01-08 23:56 - 2013-08-13 20:50 - 00000000 ____D C:\Program Files\Microsoft Office 15
2014-01-08 23:53 - 2014-01-08 23:53 - 00050477 _____ C:\Users\*********\Desktop\Defogger.exe
2014-01-08 23:43 - 2014-01-08 17:42 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2014-01-08 23:40 - 2013-08-30 20:49 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-08 23:39 - 2014-01-08 23:39 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-08 23:39 - 2013-06-28 18:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-08 23:39 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-08 23:38 - 2013-06-23 00:21 - 01869891 _____ C:\Windows\WindowsUpdate.log
2014-01-08 23:38 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2014-01-08 23:37 - 2014-01-08 23:36 - 00000000 ____D C:\AdwCleaner
2014-01-08 23:35 - 2014-01-08 23:35 - 01233962 _____ C:\Users\*********\Desktop\adwcleaner.exe
2014-01-08 23:31 - 2013-11-30 17:12 - 00000000 ____D C:\ProgramData\Skype
2014-01-08 23:27 - 2013-09-22 10:48 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-08 23:04 - 2013-08-30 20:49 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-01-08 21:47 - 2014-01-08 21:46 - 00000000 ____D C:\Program Files (x86)\Windows Live
2014-01-08 21:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2014-01-08 21:42 - 2014-01-08 21:42 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live
2014-01-08 21:41 - 2014-01-08 21:40 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-01-08 21:37 - 2012-10-11 17:27 - 00001024 ___RH C:\Users\Public\Documents\NTIMMV9REGET.dll
2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt
2014-01-08 21:34 - 2012-10-11 17:28 - 00001024 ___RH C:\Users\Public\Documents\NTILiveUpdateV9.dll
2014-01-08 21:34 - 2012-10-11 17:27 - 00001024 ___RH C:\Users\Public\Documents\NTIMMV9Acer.dll
2014-01-08 21:33 - 2012-10-11 17:28 - 00000000 ____D C:\ProgramData\NTI Launcher
2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log
2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe
2014-01-08 20:24 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********\AppData\Local\VirtualStore
2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg
2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes
2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-08 17:47 - 2013-12-01 11:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-08 17:41 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2014-01-08 17:36 - 2013-10-31 16:01 - 00000000 ____D C:\Users\*********\AppData\Local\CrashDumps
2014-01-08 17:36 - 2012-09-03 12:56 - 00000000 ____D C:\Windows\Panther
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia
2014-01-06 18:57 - 2013-06-22 19:01 - 00000000 ____D C:\Users\*********\AppData\Roaming\vlc
2014-01-06 18:46 - 2014-01-06 18:43 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett
2014-01-06 18:42 - 2012-10-12 02:44 - 00753134 _____ C:\Windows\system32\perfh007.dat
2014-01-06 18:42 - 2012-10-12 02:44 - 00155826 _____ C:\Windows\system32\perfc007.dat
2014-01-06 18:42 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-06 17:27 - 2013-09-22 10:48 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk
2014-01-06 16:58 - 2013-08-30 20:49 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-06 16:58 - 2013-06-23 20:19 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-01-06 16:58 - 2013-06-23 20:14 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-01-06 16:58 - 2013-06-23 20:14 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-01-06 16:55 - 2013-08-05 18:13 - 00000000 ___RD C:\Users\*********\Dropbox
2014-01-06 16:55 - 2013-08-05 18:10 - 00000000 ____D C:\Users\*********\AppData\Roaming\Dropbox

Some content of TEMP:
====================
C:\Users\*********\AppData\Local\Temp\avgnt.exe
C:\Users\*********\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-06 22:55

==================== End Of Log ============================

Addition.txt:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-01-2014 01
Ran by ********* at 2014-01-09 00:02:39
Running from C:\Users\*********\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 clear.fi SDK - Video 2 (x32 Version: 2.1.1925 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.1.2008 - CyberLink Corp.) Hidden
Acer Backup Manager (x32 Version: 4.0.0.0059 - NTI Corporation)
Acer Device Fast-lane (Version: 1.00.3007 - Acer Incorporated)
Acer Instant Update Service (Version: 1.00.3013 - Acer Incorporated)
Acer Power Management (Version: 7.00.3006 - Acer Incorporated)
Acer Recovery Management (Version: 6.00.3011 - Acer Incorporated)
AcerCloud (x32 Version: 2.01.3115 - Acer Incorporated)
AcerCloud Docs (x32 Version: 1.00.3201 - Acer Incorporated)
Adobe AIR (x32 Version: 3.7.0.2090 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.7.0.2090 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Backup Manager v4 (x32 Version: 4.0.0.0059 - NTI Corporation) Hidden
Broadcom Card Reader Driver Installer (Version: 15.4.7.1 - Broadcom Corporation)
clear.fi Media (x32 Version: 2.01.3108 - Acer Incorporated)
clear.fi Photo (x32 Version: 2.01.3108 - Acer Incorporated)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819 - CyberLink Corp.)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
dm-Fotowelt (x32 Version: 5.0.4 - CEWE COLOR AG u Co. OHG)
Dolby Home Theater v4 (x32 Version: 7.2.8000.13 - Dolby Laboratories Inc)
Dropbox (HKCU Version: 2.2.13 - Dropbox, Inc.)
ETDWare PS/2-X64 11.6.8.001_WHQL (Version: 11.6.8.001 - ELAN Microelectronic Corp.)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GIMP 2.8.6 (Version: 2.8.6 - The GIMP Team)
Google Earth (x32 Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Identity Card (x32 Version: 2.00.3004 - Acer Incorporated)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 11.5.0.1207 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Launch Manager (x32 Version: 7.0.5 - Acer Inc.)
Live Updater (x32 Version: 2.00.3004 - Acer Incorporated)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 365 Home Premium - de-de (Version: 15.0.4551.1011 - Microsoft Corporation)
Microsoft SkyDrive (HKCU Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Mozilla Thunderbird 24.1.1 (x86 de) (x32 Version: 24.1.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MyWinLocker (Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.35 - Egis Technology Inc.) Hidden
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.) Hidden
NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 306.97 (Version: 306.97 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.85.551 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.12.0613 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.12.0613 (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Systemsteuerung 306.97 (Version: 306.97 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1011 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1011 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1011 - Microsoft Corporation) Hidden
Office Addin (x32 Version: 2.01.3200 - Acer)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.0.206 - Ihr Firmenname)
Qualcomm Atheros WiFi Driver Installation (x32 Version: 11.05 - Qualcomm Atheros)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Saal Design Software (x32 Version: 3.1.26 - SSW Software GmbH)
Saal Design Software (x32 Version: 3.1.26 - SSW Software GmbH) Hidden
Shared C Run-time for x64 (Version: 10.0.0 - McAfee)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Spotify (x32 Version: 0.8.4.99.ga249b5f1 - Spotify AB)
Visual Studio 2005 Tools for Office Second Edition Runtime (x32 Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (x32 Version: 1 - Microsoft Corporation)
VLC media player 2.0.7 (x32 Version: 2.0.7 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

30-11-2013 16:20:51 Geplanter Prüfpunkt
06-01-2014 22:31:32 Geplanter Prüfpunkt
08-01-2014 20:42:35 Windows Live Essentials
08-01-2014 20:44:59 DirectX wurde installiert

==================== Hosts content: ==========================

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {1C5FFE65-693F-4FF6-B38B-7BB11A6BE63E} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-01-06] (Microsoft Corporation)
Task: {1F069D73-D2DA-4AAF-A370-6B1C036D7A3D} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {356FB18C-819E-4EDA-A16B-7FDC6D1C607F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-30] (Google Inc.)
Task: {3B04812C-632E-440A-9B5B-B3AEF5B353AF} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-08-22] ()
Task: {93FBD9F6-5C1F-4B2F-840C-7D2248B7EAF7} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-08-22] (Acer Incorporated)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AC55B1E4-5529-46F4-A4BB-ED179CA6C012} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-11-02] (Microsoft Corporation)
Task: {B7FF15ED-EA7E-4BD3-861B-A8B8547E91C3} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-07-04] (CyberLink)
Task: {C29914B2-FB69-4A6D-ADCA-C1C36A633DD5} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-08-30] ()
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {CEDAB060-F54A-42B8-BFD4-65CDCA82D8CE} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PmmUpdate.exe [2012-07-12] (Egis Technology Inc.)
Task: {D006E8A2-BFD0-4652-AB90-5D00FE4B91F3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-30] (Google Inc.)
Task: {E1B232EC-44E8-4A4C-974B-D2ECB59CF591} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-08-22] ()
Task: {E3A2E92C-8A5E-469E-83FB-DFCC1F111F33} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()
Task: {E93B81FF-7E59-4CB3-85D0-CB8E5CF6B286} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-06] (Adobe Systems Incorporated)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-06-22 02:12 - 2012-06-22 02:12 - 01407568 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2012-09-03 12:50 - 2012-08-08 16:48 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-08-10 17:28 - 2012-08-10 17:28 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-08-10 17:23 - 2012-08-10 17:23 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2013-06-23 20:14 - 2013-01-25 09:25 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-08-23 07:26 - 2012-08-23 07:26 - 00465384 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 00125504 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2012-08-23 07:26 - 2012-08-23 07:26 - 00155712 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\VolumeSnapshot.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 00118336 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\Online.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 01081408 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 00052288 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OsSettingPort.dll
2012-08-23 07:26 - 2012-08-23 07:26 - 00727616 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OutlookShadow.dll
2012-10-11 17:06 - 2012-06-25 18:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-12-01 11:25 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Bluetooth USB Module
Description: Bluetooth USB Module
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/08/2014 11:57:25 PM) (Source: Application Hang) (User: )
Description: Programm soffice.bin, Version 3.4.9593.500 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 718

Startzeit: 01cf0cc4be9b5ae5

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

Berichts-ID: 38bb39a2-78b8-11e3-bea3-b888e3a652b8

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (01/08/2014 11:39:48 PM) (Source: ETDService) (User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0

Error: (01/08/2014 09:45:39 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (01/08/2014 09:43:58 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (01/08/2014 08:37:40 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (01/08/2014 07:53:06 PM) (Source: Office 2013 Licensing Service) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (01/08/2014 06:55:36 PM) (Source: Application Hang) (User: )
Description: Programm iuEmailOutlookAgent.exe, Version 1.0.3013.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 11c8

Startzeit: 01cf0af7ecb5c314

Endzeit: 188

Anwendungspfad: C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe

Berichts-ID: f4d64800-788d-11e3-bea2-b888e3a652b8

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (01/08/2014 05:21:05 PM) (Source: Office 2013 Licensing Service) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (01/06/2014 10:21:31 PM) (Source: Office 2013 Licensing Service) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (01/06/2014 04:52:44 PM) (Source: ETDService) (User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0


System errors:
=============
Error: (01/06/2014 04:52:44 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (12/06/2013 00:24:59 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (12/06/2013 10:10:22 AM) (Source: DCOM) (User: Angi)
Description: App.wwa

Error: (12/06/2013 10:08:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (12/02/2013 08:53:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (12/01/2013 11:24:34 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst defragsvc erreicht.

Error: (11/30/2013 04:41:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/30/2013 00:11:30 AM) (Source: Tcpip) (User: )
Description: Das System hat einen Adressenkonflikt der IP-Adresse 192.168.0.101 mit dem Computer mit der
Netzwerkhardwareadresse 88-30-8A-7D-B1-43 ermittelt. Netzwerkvorgänge könnten daher auf diesem
System unterbrochen werden.

Error: (11/29/2013 09:06:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/29/2013 07:19:39 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (01/08/2014 11:57:25 PM) (Source: Application Hang)(User: )
Description: soffice.bin3.4.9593.50071801cf0cc4be9b5ae50C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin38bb39a2-78b8-11e3-bea3-b888e3a652b8

Error: (01/08/2014 11:39:48 PM) (Source: ETDService)(User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0

Error: (01/08/2014 09:45:39 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (01/08/2014 09:43:58 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (01/08/2014 08:37:40 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\*********\AppData\Local\Temp\IDC2.tmp\ESETSmartInstaller.exe

Error: (01/08/2014 07:53:06 PM) (Source: Office 2013 Licensing Service)(User: )
Description: Subscription licensing service failed: -1073415161

Error: (01/08/2014 06:55:36 PM) (Source: Application Hang)(User: )
Description: iuEmailOutlookAgent.exe1.0.3013.011c801cf0af7ecb5c314188C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exef4d64800-788d-11e3-bea2-b888e3a652b8

Error: (01/08/2014 05:21:05 PM) (Source: Office 2013 Licensing Service)(User: )
Description: Subscription licensing service failed: -1073415161

Error: (01/06/2014 10:21:31 PM) (Source: Office 2013 Licensing Service)(User: )
Description: Subscription licensing service failed: -1073415161

Error: (01/06/2014 04:52:44 PM) (Source: ETDService)(User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0


==================== Memory info =========================== 

Percentage of memory in use: 23%
Total physical RAM: 8007.27 MB
Available physical RAM: 6164.89 MB
Total Pagefile: 9223.27 MB
Available Pagefile: 7239.14 MB
Total Virtual: 8192 MB
Available Virtual: 8191.75 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:913.19 GB) (Free:531.86 GB) NTFS
Drive e: (My Passport) (Fixed) (Total:298.02 GB) (Free:249.26 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 6B73424A)

Partition: GPT Partition Type
========================================================
Disk: 1 (Size: 298 GB) (Disk ID: B13D6473)
Partition 1: (Not Active) - (Size=298 GB) - (Type=0C)

==================== End Of Log ============================

Gmer.txt:

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-09 00:14:08
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000039 ST1000LM024_HN-M101MBB rev.2AR10001 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\******~1\AppData\Local\Temp\uglorpod.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\system32\dwm.exe[492] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                     000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\dwm.exe[492] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                     000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\dwm.exe[492] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                   000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[336] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                        000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[336] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                        000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[336] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                      000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\MSIMG32.dll!GradientFill + 690                                                  000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\MSIMG32.dll!GradientFill + 698                                                  000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246                                                000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                        000007f81fa8177a 4 bytes [A8, 1F, F8, 07]
.text   C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                        000007f81fa81782 4 bytes [A8, 1F, F8, 07]
.text   C:\Windows\system32\taskhostex.exe[2712] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                             000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\taskhostex.exe[2712] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                             000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\taskhostex.exe[2712] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                           000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Elantech\ETDCtrl.exe[3080] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                          000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Elantech\ETDCtrl.exe[3080] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                          000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Elantech\ETDCtrl.exe[3080] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                        000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                        000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                        000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                      000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742                                                            000007f80e581b32 4 bytes [58, 0E, F8, 07]
.text   C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750                                                            000007f80e581b3a 4 bytes [58, 0E, F8, 07]
.text   C:\Windows\system32\wbem\unsecapp.exe[3708] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                          000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\wbem\unsecapp.exe[3708] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                          000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\wbem\unsecapp.exe[3708] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                        000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[3720] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                    000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[3720] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                    000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[3720] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                  000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                             000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                             000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                           000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                              000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1868] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                         000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1868] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                         000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1868] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                       000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\System32\igfxtray.exe[1624] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                               000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\System32\igfxtray.exe[1624] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                               000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\System32\igfxtray.exe[1624] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                             000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\System32\hkcmd.exe[1404] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                  000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\System32\hkcmd.exe[1404] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                  000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\System32\hkcmd.exe[1404] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\System32\igfxpers.exe[4084] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                     000007f81fa8177a 4 bytes [A8, 1F, F8, 07]
.text   C:\Windows\System32\igfxpers.exe[4084] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                     000007f81fa81782 4 bytes [A8, 1F, F8, 07]
.text   C:\Windows\System32\igfxpers.exe[4084] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                               000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\System32\igfxpers.exe[4084] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                               000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\System32\igfxpers.exe[4084] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                             000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[236] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                               000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2200] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                 000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2200] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2200] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                               000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Dolby PCEE4\pcee4.exe[4548] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                       000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Dolby PCEE4\pcee4.exe[4548] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                       000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Dolby PCEE4\pcee4.exe[4548] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                     000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[4920] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306            000007f81fa8177a 4 bytes [A8, 1F, F8, 07]
.text   C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[4920] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314            000007f81fa81782 4 bytes [A8, 1F, F8, 07]
.text   C:\Windows\system32\igfxsrvc.exe[4980] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                               000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\igfxsrvc.exe[4980] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                               000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\igfxsrvc.exe[4980] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                             000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\wbem\unsecapp.exe[5008] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                          000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\wbem\unsecapp.exe[5008] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                          000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Windows\system32\wbem\unsecapp.exe[5008] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                        000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5036] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                    000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5036] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                    000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5036] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                  000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[1148] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                              000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[1148] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                              000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[1148] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                            000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                            000007f81ad61532 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                            000007f81ad6153a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                          000007f81ad6165a 4 bytes [D6, 1A, F8, 07]
.text   C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742                                000007f80e581b32 4 bytes [58, 0E, F8, 07]
.text   C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750                                000007f80e581b3a 4 bytes [58, 0E, F8, 07]
.text   C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe[2132] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306  000007f81fa8177a 4 bytes [A8, 1F, F8, 07]
.text   C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe[2132] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314  000007f81fa81782 4 bytes [A8, 1F, F8, 07]

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\csrss.exe [592:636]                                                                                                 fffff960009235e8

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                                   unknown MBR code

---- EOF - GMER 2.1 ----

avira.txt:

Code:

ATTFilter

Exportierte Ereignisse:

08.01.2014 17:11 [System-Scanner] Malware gefunden
      Die Datei 
      'C:\Users\*********\Desktop\Festplatte\Magix.Fotos.auf.CD.und.DVD.Deluxe.6.5.Ger
      man.DVD-RESTORE\mfotos65dlx\RESTORE\scheduler.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Fraud.Gen8' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde gelöscht.

08.01.2014 17:11 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\*********\Desktop\Festplatte\Ansys\MAGNiTUDE\a11calc.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.TPM.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde gelöscht.

Ich hoffe Ihr könnt mir weiterhelfen.
Vielen Dank schon einmal.

Viele Grüße
anwo

schrauber · 09.01.2014, 08:12

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

anwo1984 · 09.01.2014, 14:29

Hallo schrauber,

vielen Dank für deine Antwort.

Hier die Combofix.txt:

Code:

ATTFilter

ComboFix 14-01-08.03 - ********* 09.01.2014  13:44:16.1.4 - x64
Microsoft Windows 8  6.2.9200.0.1252.49.1031.18.8007.6536 [GMT 1:00]
ausgeführt von:: c:\users\*********\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\*********\AppData\Local\assembly\tmp
c:\users\Public\Documents\NTILiveUpdateV9.dll
c:\users\Public\Documents\NTIMMV9Acer.dll
c:\users\Public\Documents\NTIMMV9REGET.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-12-09 bis 2014-01-09  ))))))))))))))))))))))))))))))
.
.
2014-01-09 12:38 . 2013-12-03 18:28	10315576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{42212923-B9F7-4788-9332-A40749E27AA9}\mpengine.dll
2014-01-09 12:38 . 2013-11-19 10:21	267936	------w-	c:\windows\system32\MpSigStub.exe
2014-01-09 01:28 . 2014-01-09 01:28	--------	d-----w-	c:\program files (x86)\HyperCam 2
2014-01-08 23:01 . 2014-01-08 23:01	--------	d-----w-	C:\FRST
2014-01-08 22:36 . 2014-01-08 22:37	--------	d-----w-	C:\AdwCleaner
2014-01-08 20:48 . 2014-01-08 20:48	--------	d-----w-	c:\windows\de
2014-01-08 20:47 . 2014-01-08 20:47	--------	d-----w-	c:\program files (x86)\Microsoft SQL Server Compact Edition
2014-01-08 20:47 . 2014-01-08 20:47	--------	d-----w-	c:\windows\PCHEALTH
2014-01-08 20:46 . 2014-01-08 20:47	--------	d-----w-	c:\program files (x86)\Windows Live
2014-01-08 20:46 . 2010-06-02 03:55	77656	----a-w-	c:\windows\system32\XAPOFX1_5.dll
2014-01-08 20:46 . 2010-06-02 03:55	74072	----a-w-	c:\windows\SysWow64\XAPOFX1_5.dll
2014-01-08 20:46 . 2010-06-02 03:55	527192	----a-w-	c:\windows\SysWow64\XAudio2_7.dll
2014-01-08 20:46 . 2010-06-02 03:55	518488	----a-w-	c:\windows\system32\XAudio2_7.dll
2014-01-08 20:46 . 2010-05-26 10:41	2526056	----a-w-	c:\windows\system32\D3DCompiler_43.dll
2014-01-08 20:46 . 2010-05-26 10:41	2106216	----a-w-	c:\windows\SysWow64\D3DCompiler_43.dll
2014-01-08 20:46 . 2010-05-26 10:41	276832	----a-w-	c:\windows\system32\d3dx11_43.dll
2014-01-08 20:46 . 2010-05-26 10:41	248672	----a-w-	c:\windows\SysWow64\d3dx11_43.dll
2014-01-08 20:46 . 2009-09-04 16:29	453456	----a-w-	c:\windows\SysWow64\d3dx10_42.dll
2014-01-08 20:46 . 2009-09-04 16:29	523088	----a-w-	c:\windows\system32\d3dx10_42.dll
2014-01-08 20:45 . 2006-11-29 12:06	4398360	----a-w-	c:\windows\system32\d3dx9_32.dll
2014-01-08 20:45 . 2006-11-29 12:06	3426072	----a-w-	c:\windows\SysWow64\d3dx9_32.dll
2014-01-08 20:42 . 2014-01-09 00:39	--------	d-----w-	c:\users\*********\AppData\Local\Windows Live
2014-01-08 20:42 . 2014-01-08 20:42	--------	d-----w-	c:\program files (x86)\Common Files\Windows Live
2014-01-08 20:34 . 2014-01-08 20:34	--------	d-----w-	c:\programdata\NTIRegEt
2014-01-08 17:00 . 2014-01-08 17:00	--------	d-----w-	c:\users\*********\AppData\Roaming\Malwarebytes
2014-01-08 16:59 . 2014-01-08 16:59	--------	d-----w-	c:\programdata\Malwarebytes
2014-01-08 16:47 . 2013-12-05 19:41	272496	----a-w-	c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2014-01-08 16:42 . 2014-01-08 22:43	--------	d-----w-	c:\program files (x86)\FileHippo.com
2014-01-08 16:30 . 2014-01-08 16:30	--------	d-----w-	c:\users\*********\AppData\Local\Secunia PSI
2014-01-08 16:30 . 2014-01-08 16:30	--------	d-----w-	c:\program files (x86)\Secunia
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-06 16:11 . 2013-08-13 19:58	566480	----a-w-	c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2014-01-06 15:58 . 2013-06-23 19:19	84720	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-01-06 15:58 . 2013-06-23 19:14	131576	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-01-06 15:58 . 2013-06-23 19:14	108440	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-11-27 22:14 . 2013-06-23 19:14	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-08-13 20:07	222712	----a-w-	c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-08-13 20:07	222712	----a-w-	c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-08-13 20:07	222712	----a-w-	c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-08-03 00:56	130736	----a-w-	c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-08-03 00:56	130736	----a-w-	c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-08-03 00:56	130736	----a-w-	c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dolby Home Theater v4"="c:\dolby pcee4\pcee4.exe" [2012-04-23 508256]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-01-06 684600]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2012-07-26 62976]
.
c:\users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-8-3 28057256]
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\
Acer Backup Manager Tray.lnk - c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe -h -k [2012-8-23 533568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 btath_avdt;Qualcomm Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\System32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\System32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 BthLEEnum;Treiber für energiearme Bluetooth-Geräte;c:\windows\system32\DRIVERS\BthLEEnum.sys;c:\windows\SYSNATIVE\DRIVERS\BthLEEnum.sys [x]
R3 DeviceFastLaneService;Device Fast-lane Service;c:\program files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe;c:\program files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [x]
R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 BrcmCardReader;Broadcom Card Reader Service;c:\program files\Broadcom\MemoryCard\BrcmCardReader.exe;c:\program files\Broadcom\MemoryCard\BrcmCardReader.exe [x]
S2 CCDMonitorService;CCDMonitorService;c:\program files (x86)\Acer\Acer Cloud\CCDMonitorService.exe;c:\program files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ETDService;Elan Service;c:\program files\Elantech\ETDService.exe;c:\program files\Elantech\ETDService.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x]
S2 OfficeSvc;Microsoft Office-Dienst;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe [x]
S2 RfButtonDriverService;Dritek RF Button Command Service;c:\windows\RfBtnSvc64.exe;c:\windows\RfBtnSvc64.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 ZAtheros Wlan Agent;ZAtheros Wlan Agent;c:\program files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe;c:\program files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [x]
S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\System32\drivers\b57xdbd.sys;c:\windows\SYSNATIVE\drivers\b57xdbd.sys [x]
S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\System32\drivers\b57xdmp.sys;c:\windows\SYSNATIVE\drivers\b57xdmp.sys [x]
S3 bScsiMSa;bScsiMSa;c:\windows\System32\drivers\bScsiMSa.sys;c:\windows\SYSNATIVE\drivers\bScsiMSa.sys [x]
S3 bScsiSDa;bScsiSDa;c:\windows\System32\drivers\bScsiSDa.sys;c:\windows\SYSNATIVE\drivers\bScsiSDa.sys [x]
S3 BTATH_BUS;Qualcomm Atheros Bluetooth Bus;c:\windows\System32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x]
S3 ePowerSvc;ePower Service;c:\program files\Acer\Acer Power Management\ePowerSvc.exe;c:\program files\Acer\Acer Power Management\ePowerSvc.exe [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 k57nd60a;Broadcom NetLink (TM)-Gigabit-Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 Ps2Kb2Hid;PS/2 Keyboard to HID Driver;c:\windows\System32\drivers\aPs2Kb2Hid.sys;c:\windows\SYSNATIVE\drivers\aPs2Kb2Hid.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-23 16:27]
.
2014-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-30 19:49]
.
2014-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-30 19:49]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-08-13 20:07	261624	----a-w-	c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-08-13 20:07	261624	----a-w-	c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-08-13 20:07	261624	----a-w-	c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-01-06 16:12	2331336	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-01-06 16:12	2331336	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-01-06 16:12	2331336	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-08-03 00:56	164016	----a-w-	c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-08-03 00:56	164016	----a-w-	c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-08-03 00:56	164016	----a-w-	c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-08-03 00:56	164016	----a-w-	c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-08-08 170304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-08-08 398656]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-08-08 440640]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 12503184]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-06-07 1212048]
"BtPreLoad"="c:\program files (x86)\Bluetooth Suite\BtPreLoad.exe" [2012-08-10 64640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\
FF - ExtSQL: 2014-01-08 17:39; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:\users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF - ExtSQL: 2014-01-08 17:40; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-LManager - (no file)
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]
@Denied: (A) (Everyone)
"Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]
"Key"="ActionsPane"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2014-01-09  13:49:15
ComboFix-quarantined-files.txt  2014-01-09 12:49
.
Vor Suchlauf: 11 Verzeichnis(se), 567.488.360.448 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 567.147.814.912 Bytes frei
.
- - End Of File - - BE55BE7B761D07BF142D403CC201BE8B

Des Weiteren kam von Avira trotz Deaktivierung noch folgende Warnung:

Code:

ATTFilter

Exportierte Ereignisse:

09.01.2014 13:42 [Echtzeit-Scanner] Registry blockiert
      Der Administrator hat per Sicherheitsrichtlinie den Zugriff auf die Registry 
      blockiert.

Weiterhin vielen Dank und viele Grüße
anwo

schrauber · 10.01.2014, 09:47

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

anwo1984 · 12.01.2014, 15:58

Hallo,

hier sind die neuen Logs.

mbam.txt:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.10.08

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16660
********* :: **** [Administrator]

10.01.2014 23:23:04
mbam-log-2014-01-10 (23-23-04).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 238257
Laufzeit: 3 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

AdwCleaner[S1].txt:

Code:

ATTFilter

# AdwCleaner v3.016 - Bericht erstellt am 12/01/2014 um 14:43:04
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : ********* - ****
# Gestartet von : C:\Users\*********\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16660


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [962 octets] - [08/01/2014 23:36:54]
AdwCleaner[R1].txt - [903 octets] - [11/01/2014 09:51:19]
AdwCleaner[R2].txt - [962 octets] - [12/01/2014 14:38:45]
AdwCleaner[S0].txt - [1022 octets] - [08/01/2014 23:37:39]
AdwCleaner[S1].txt - [884 octets] - [12/01/2014 14:43:04]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [943 octets] ##########

JRT.txt:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 8 x64
Ran by ********* on 12.01.2014 at 14:52:30,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\*********\AppData\Roaming\mozilla\firefox\profiles\yahdabz0.default\minidumps [33 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.01.2014 at 14:56:19,55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Und ein neues FRST Log:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2014
Ran by ********* (administrator) on **** on 12-01-2014 15:00:59
Running from C:\Users\*********\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2014-01-06] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Ghostery - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\firefox@ghostery.com.xpi [2013-08-20]
FF Extension: NoScript - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-08]
FF Extension: Adblock Plus - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-08]
FF Extension: BetterPrivacy - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-06-23]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

U2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2014-01-06] (Avira Operations GmbH & Co. KG)
U2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-27] (Avira Operations GmbH & Co. KG)
U2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)
U2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)
U2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
U3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)
U3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
U2 ETDService; C:\Program Files\Elantech\ETDService.exe [28560 2012-08-30] (ELAN Microelectronics Corp.)
U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
U2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)
U2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)
U2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-11] (Dritek System INC.)
U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
U2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-07-31] (Atheros)

==================== Drivers (Whitelisted) ====================

U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-01-06] (Avira Operations GmbH & Co. KG)
U1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2014-01-06] (Avira Operations GmbH & Co. KG)
U1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
U3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
U3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
U3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-11] (Dritek System Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
U3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-12 15:00 - 2014-01-12 15:00 - 00000000 ____D C:\Users\*********\Desktop\FRST-OlderVersion
2014-01-12 14:56 - 2014-01-12 14:56 - 00000752 _____ C:\Users\*********\Desktop\JRT.txt
2014-01-12 14:52 - 2014-01-12 14:52 - 00000000 ____D C:\Windows\ERUNT
2014-01-12 14:51 - 2014-01-12 14:51 - 01037068 _____ (Thisisu) C:\Users\*********\Desktop\JRT.exe
2014-01-12 14:43 - 2014-01-12 14:48 - 00001022 _____ C:\Users\*********\Desktop\AdwCleaner[S1].txt
2014-01-12 14:37 - 2014-01-12 14:37 - 01233962 _____ C:\Users\*********\Desktop\adwcleaner.exe
2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setuperr.log
2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setupact.log
2014-01-11 19:15 - 2014-01-11 19:52 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett - Kopie
2014-01-10 23:12 - 2014-01-10 23:12 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-10 23:12 - 2014-01-10 23:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-10 23:12 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-10 22:52 - 2014-01-10 22:53 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\*********\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-10 21:54 - 2014-01-10 21:55 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-09 14:10 - 2014-01-09 14:10 - 00000378 _____ C:\Users\*********\Desktop\Avira_2.text
2014-01-09 13:49 - 2014-01-09 14:15 - 00021066 _____ C:\Users\*********\Desktop\ComboFix.txt
2014-01-09 13:42 - 2014-01-09 13:49 - 00000000 ____D C:\Qoobox
2014-01-09 13:42 - 2014-01-09 13:48 - 00000000 ____D C:\Windows\erdnt
2014-01-09 13:42 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-09 13:42 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-09 13:42 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-09 13:38 - 2013-11-19 11:21 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-09 13:36 - 2014-01-09 13:36 - 05162489 ____R (Swearware) C:\Users\*********\Desktop\ComboFix.exe
2014-01-09 02:55 - 2014-01-09 02:55 - 212230516 _____ C:\Users\*********\Documents\clip0008.avi
2014-01-09 02:52 - 2014-01-09 02:53 - 224291418 _____ C:\Users\*********\Documents\clip0007.avi
2014-01-09 02:50 - 2014-01-09 02:51 - 156283886 _____ C:\Users\*********\Documents\clip0006.avi
2014-01-09 02:49 - 2014-01-09 02:49 - 149440834 _____ C:\Users\*********\Documents\clip0005.avi
2014-01-09 02:46 - 2014-01-09 02:47 - 110648088 _____ C:\Users\*********\Documents\clip0004.avi
2014-01-09 02:43 - 2014-01-09 02:43 - 109383106 _____ C:\Users\*********\Documents\clip0003.avi
2014-01-09 02:36 - 2014-01-09 02:37 - 153556170 _____ C:\Users\*********\Documents\clip0002.avi
2014-01-09 02:28 - 2014-01-09 02:28 - 05401856 _____ C:\Users\*********\Downloads\HC228SetDE.exe
2014-01-09 02:28 - 2014-01-09 02:28 - 00000925 _____ C:\Users\*********\Desktop\HyperCam 2.lnk
2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2
2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Program Files (x86)\HyperCam 2
2014-01-09 02:08 - 2014-01-09 02:08 - 00087414 _____ C:\Users\*********\Desktop\FRA-DOH.kmz
2014-01-09 01:28 - 2013-08-10 06:21 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\SettingSync.dll
2014-01-09 01:28 - 2013-08-10 06:21 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncInfo.dll
2014-01-09 01:28 - 2013-08-10 04:58 - 00356352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll
2014-01-09 01:28 - 2013-08-02 07:28 - 19758080 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-01-09 01:28 - 2013-08-02 07:28 - 10116608 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-01-09 01:28 - 2013-08-02 07:28 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2014-01-09 01:28 - 2013-08-02 07:26 - 02304512 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-01-09 01:28 - 2013-08-02 06:08 - 17561088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-01-09 01:28 - 2013-08-02 06:08 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-01-09 01:28 - 2013-08-02 06:08 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2014-01-09 01:28 - 2013-08-02 06:06 - 02035712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-01-09 01:28 - 2013-08-01 11:41 - 02233688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-01-09 01:28 - 2013-07-25 00:10 - 00158208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mbsmsapi.dll
2014-01-09 01:28 - 2013-07-25 00:06 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\mbsmsapi.dll
2014-01-09 01:28 - 2013-04-10 00:17 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2014-01-09 01:28 - 2013-04-09 23:29 - 00893952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2014-01-09 01:27 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-01-09 01:27 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-01-09 01:27 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-01-09 01:27 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-01-09 01:27 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-01-09 01:27 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-01-09 01:27 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-01-09 01:27 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-01-09 01:27 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-01-09 01:27 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-01-09 01:27 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-01-09 01:27 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-01-09 01:27 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-01-09 01:27 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-01-09 01:27 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-01-09 01:27 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-01-09 01:27 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-01-09 01:27 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-01-09 01:27 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2014-01-09 01:27 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-01-09 01:27 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2014-01-09 01:27 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-01-09 01:27 - 2013-08-03 07:40 - 01374208 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2014-01-09 01:27 - 2013-08-03 07:40 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll
2014-01-09 01:27 - 2013-08-03 07:40 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2014-01-09 01:27 - 2013-08-03 06:14 - 00399360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2014-01-09 01:27 - 2013-08-03 06:13 - 01245696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2014-01-09 01:27 - 2013-08-03 06:13 - 00437248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2014-01-09 01:27 - 2013-07-05 23:02 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2014-01-09 01:27 - 2013-07-05 23:01 - 00210560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2014-01-09 01:27 - 2013-06-22 06:45 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-01-09 01:27 - 2013-06-22 06:45 - 00054488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2014-01-09 01:27 - 2013-05-15 23:37 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-01-09 01:27 - 2013-05-15 23:35 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-01-09 01:27 - 2013-05-14 14:14 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-01-09 01:27 - 2013-05-14 10:23 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-01-09 01:27 - 2013-02-21 11:29 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-01-09 01:27 - 2013-02-21 11:29 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-01-09 01:27 - 2013-02-21 11:29 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-01-09 01:27 - 2013-02-21 11:29 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-01-09 01:27 - 2013-02-21 11:14 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-01-09 01:27 - 2013-02-21 11:14 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-01-09 01:27 - 2013-02-19 10:53 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-01-09 01:27 - 2012-11-08 05:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-01-09 01:27 - 2012-11-08 05:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-01-09 01:26 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-01-09 01:26 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-01-09 01:26 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2014-01-09 01:26 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2014-01-09 01:26 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crashdmp.sys
2014-01-09 01:26 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2014-01-09 01:26 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2014-01-09 01:26 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2014-01-09 01:26 - 2013-08-16 06:21 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-01-09 01:26 - 2013-08-16 06:21 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-01-09 01:26 - 2013-08-15 23:43 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-01-09 01:26 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys
2014-01-09 01:26 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-01-09 01:26 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-01-09 01:26 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2014-01-09 01:26 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2014-01-09 01:26 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2014-01-09 01:26 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2014-01-09 01:26 - 2013-07-06 01:15 - 00652288 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-01-09 01:26 - 2013-07-04 03:13 - 00541696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2014-01-09 01:26 - 2013-07-01 23:14 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbprint.sys
2014-01-09 01:26 - 2013-06-29 04:08 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-01-09 01:26 - 2013-06-29 04:07 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-01-09 01:25 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-01-09 01:25 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-01-09 01:25 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-01-09 01:25 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-01-09 01:25 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-01-09 01:25 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-01-09 01:25 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-01-09 01:25 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2014-01-09 01:25 - 2013-10-03 23:09 - 00385528 _____ C:\Windows\system32\ApnDatabase.xml
2014-01-09 01:25 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-01-09 01:25 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2014-01-09 01:25 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2014-01-09 01:25 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-01-09 01:25 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-01-09 01:25 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-01-09 01:25 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-01-09 01:25 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-01-09 01:25 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\resutils.dll
2014-01-09 01:25 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2014-01-09 01:25 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2014-01-09 01:25 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2014-01-09 01:25 - 2013-08-16 06:41 - 00058200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dam.sys
2014-01-09 01:25 - 2013-08-16 06:39 - 02371728 _____ (Microsoft Corporation) C:\Windows\system32\WSService.dll
2014-01-09 01:25 - 2013-08-16 06:32 - 00209200 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-01-09 01:25 - 2013-08-16 06:22 - 04917760 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2014-01-09 01:25 - 2013-08-16 06:21 - 01164288 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00204800 _____ (Microsoft Corporation) C:\Windows\system32\WSClient.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\WSSync.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\sppc.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\setupcln.dll
2014-01-09 01:25 - 2013-08-16 06:20 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00167424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSClient.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSSync.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00083968 _____ C:\Windows\SysWOW64\OEMLicense.dll
2014-01-09 01:25 - 2013-08-15 23:42 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppc.dll
2014-01-09 01:25 - 2013-08-15 23:42 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupcln.dll
2014-01-09 01:25 - 2013-07-09 09:04 - 00120144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msgpioclx.sys
2014-01-09 01:25 - 2013-07-09 07:18 - 00439488 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2014-01-09 01:25 - 2013-07-09 05:25 - 00385768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2014-01-09 01:25 - 2013-07-09 04:57 - 00245760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LocationApi.dll
2014-01-09 01:25 - 2013-07-08 23:46 - 00543744 _____ (Microsoft Corporation) C:\Windows\system32\wwanmm.dll
2014-01-09 01:25 - 2013-07-08 23:46 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll
2014-01-09 01:25 - 2013-07-08 23:46 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\Wwanadvui.dll
2014-01-09 01:25 - 2013-07-08 23:45 - 00312832 _____ (Microsoft Corporation) C:\Windows\system32\LocationApi.dll
2014-01-09 01:25 - 2013-07-06 01:16 - 01025024 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-01-09 01:25 - 2013-07-03 01:23 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.BackgroundTransfer.dll
2014-01-09 01:25 - 2013-07-03 01:22 - 02839552 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2014-01-09 01:25 - 2013-07-03 01:11 - 00268800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2014-01-09 01:25 - 2013-07-03 01:10 - 02273792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2014-01-09 01:25 - 2013-06-30 23:30 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\openfiles.exe
2014-01-09 01:25 - 2013-06-30 23:29 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\openfiles.exe
2014-01-09 01:25 - 2013-06-29 07:15 - 00195416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2014-01-09 01:25 - 2013-06-29 07:15 - 00125784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2014-01-09 01:25 - 2013-06-29 06:43 - 00327512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-01-09 01:25 - 2013-06-26 04:01 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2014-01-09 01:25 - 2013-06-26 03:59 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\HdAudio.sys
2014-01-09 01:25 - 2013-06-24 23:54 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-01-09 01:25 - 2013-06-24 23:54 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2014-01-09 01:25 - 2013-06-24 23:54 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2014-01-09 01:25 - 2013-06-19 06:36 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\winmmbase.dll
2014-01-09 01:25 - 2013-06-19 06:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll
2014-01-09 01:25 - 2013-06-18 23:38 - 00160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmmbase.dll
2014-01-09 01:25 - 2013-06-18 23:38 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll
2014-01-09 01:25 - 2013-06-12 00:43 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2014-01-09 01:25 - 2013-06-12 00:26 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2014-01-09 01:25 - 2013-06-10 20:16 - 00888832 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2014-01-09 01:25 - 2013-06-10 20:15 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-01-09 01:25 - 2013-06-10 20:10 - 00702464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2014-01-09 01:25 - 2013-06-10 20:10 - 00245248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2014-01-09 01:25 - 2013-06-06 09:03 - 00119040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2014-01-09 01:24 - 2013-07-02 02:41 - 00337752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2014-01-09 01:24 - 2013-07-02 02:41 - 00213336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2014-01-09 01:24 - 2013-07-01 02:42 - 00623448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-09 01:24 - 2013-07-01 02:42 - 00498008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-09 01:24 - 2013-07-01 02:42 - 00079192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-09 01:24 - 2013-07-01 02:42 - 00021848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-09 01:24 - 2013-06-29 04:07 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-09 01:24 - 2013-06-29 04:06 - 00120832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-09 01:23 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-09 01:23 - 2013-08-07 06:15 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\tssdisai.dll
2014-01-09 01:23 - 2013-07-19 23:13 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-01-09 01:23 - 2013-07-19 23:13 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2014-01-09 01:22 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2014-01-09 01:22 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll
2014-01-09 01:22 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2014-01-09 01:22 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-01-09 01:22 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-01-09 01:22 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2014-01-09 01:22 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-01-09 01:22 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-01-09 01:22 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-01-09 01:22 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-01-09 01:22 - 2013-05-27 00:17 - 00035328 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2014-01-09 01:22 - 2013-05-26 23:59 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-01-09 01:22 - 2013-05-25 04:15 - 00362496 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-01-09 01:22 - 2013-05-25 03:32 - 00300032 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2014-01-09 00:35 - 2014-01-09 00:41 - 00001368 _____ C:\Users\*********\Desktop\avira.txt
2014-01-09 00:30 - 2014-01-09 14:32 - 00001896 _____ C:\Windows\PFRO.log
2014-01-09 00:14 - 2014-01-09 00:46 - 00015328 _____ C:\Users\*********\Desktop\Gmer.txt
2014-01-09 00:05 - 2014-01-09 00:05 - 00377856 _____ C:\Users\*********\Desktop\gmer_2.1.19163.exe
2014-01-09 00:02 - 2014-01-12 15:00 - 00012998 _____ C:\Users\*********\Desktop\FRST.txt
2014-01-09 00:02 - 2014-01-09 00:45 - 00024083 _____ C:\Users\*********\Desktop\Addition.txt
2014-01-09 00:01 - 2014-01-12 15:00 - 00000000 ____D C:\FRST
2014-01-08 23:59 - 2014-01-12 15:00 - 02075136 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe
2014-01-08 23:58 - 2014-01-09 00:45 - 00000482 _____ C:\Users\*********\Desktop\defogger_disable.log
2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable
2014-01-08 23:53 - 2014-01-08 23:53 - 00050477 _____ C:\Users\*********\Desktop\Defogger.exe
2014-01-08 23:41 - 2014-01-09 00:45 - 00001022 _____ C:\Users\*********\Desktop\AdwCleaner[S0].txt
2014-01-08 23:36 - 2014-01-12 14:49 - 00000000 ____D C:\AdwCleaner
2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-01-08 21:46 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Windows Live
2014-01-08 21:46 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-01-08 21:46 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-01-08 21:46 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-01-08 21:45 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-01-08 21:45 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-01-08 21:42 - 2014-01-09 01:39 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live
2014-01-08 21:40 - 2014-01-08 21:41 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt
2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log
2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe
2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg
2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes
2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-08 17:42 - 2014-01-08 23:43 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia
2014-01-06 18:43 - 2014-01-09 02:34 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett
2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk

==================== One Month Modified Files and Folders =======

2014-01-12 15:01 - 2014-01-09 00:02 - 00012998 _____ C:\Users\*********\Desktop\FRST.txt
2014-01-12 15:00 - 2014-01-12 15:00 - 00000000 ____D C:\Users\*********\Desktop\FRST-OlderVersion
2014-01-12 15:00 - 2014-01-09 00:01 - 00000000 ____D C:\FRST
2014-01-12 15:00 - 2014-01-08 23:59 - 02075136 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe
2014-01-12 15:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2014-01-12 14:56 - 2014-01-12 14:56 - 00000752 _____ C:\Users\*********\Desktop\JRT.txt
2014-01-12 14:52 - 2014-01-12 14:52 - 00000000 ____D C:\Windows\ERUNT
2014-01-12 14:51 - 2014-01-12 14:51 - 01037068 _____ (Thisisu) C:\Users\*********\Desktop\JRT.exe
2014-01-12 14:50 - 2013-06-23 00:21 - 02015459 _____ C:\Windows\WindowsUpdate.log
2014-01-12 14:49 - 2014-01-08 23:36 - 00000000 ____D C:\AdwCleaner
2014-01-12 14:48 - 2014-01-12 14:43 - 00001022 _____ C:\Users\*********\Desktop\AdwCleaner[S1].txt
2014-01-12 14:47 - 2013-08-30 20:49 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-12 14:44 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-12 14:37 - 2014-01-12 14:37 - 01233962 _____ C:\Users\*********\Desktop\adwcleaner.exe
2014-01-11 22:05 - 2013-06-22 19:01 - 00000000 ____D C:\Users\*********\AppData\Roaming\vlc
2014-01-11 22:04 - 2013-08-30 20:49 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-11 21:27 - 2013-09-22 10:48 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setuperr.log
2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setupact.log
2014-01-11 19:52 - 2014-01-11 19:15 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett - Kopie
2014-01-11 01:19 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2014-01-11 00:45 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SecureBootUpdates
2014-01-10 23:24 - 2012-10-12 02:44 - 00753134 _____ C:\Windows\system32\perfh007.dat
2014-01-10 23:24 - 2012-10-12 02:44 - 00155826 _____ C:\Windows\system32\perfc007.dat
2014-01-10 23:24 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-10 23:12 - 2014-01-10 23:12 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-10 23:12 - 2014-01-10 23:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-10 22:53 - 2014-01-10 22:52 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\*********\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-10 21:55 - 2014-01-10 21:54 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-09 14:41 - 2013-06-23 00:22 - 00000000 ___RD C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-09 14:41 - 2013-06-23 00:22 - 00000000 ___RD C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-09 14:37 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2014-01-09 14:37 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\PolicyDefinitions
2014-01-09 14:36 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe
2014-01-09 14:35 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ToastData
2014-01-09 14:32 - 2014-01-09 00:30 - 00001896 _____ C:\Windows\PFRO.log
2014-01-09 14:28 - 2013-08-25 16:30 - 00000000 ____D C:\Windows\system32\MRT
2014-01-09 14:22 - 2013-06-23 00:28 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-627669732-214247668-4251278340-1002
2014-01-09 14:15 - 2014-01-09 13:49 - 00021066 _____ C:\Users\*********\Desktop\ComboFix.txt
2014-01-09 14:10 - 2014-01-09 14:10 - 00000378 _____ C:\Users\*********\Desktop\Avira_2.text
2014-01-09 13:49 - 2014-01-09 13:42 - 00000000 ____D C:\Qoobox
2014-01-09 13:49 - 2012-07-26 06:37 - 00000000 __RHD C:\Users\Default
2014-01-09 13:48 - 2014-01-09 13:42 - 00000000 ____D C:\Windows\erdnt
2014-01-09 13:47 - 2012-07-26 06:26 - 00000215 _____ C:\Windows\system.ini
2014-01-09 13:36 - 2014-01-09 13:36 - 05162489 ____R (Swearware) C:\Users\*********\Desktop\ComboFix.exe
2014-01-09 02:55 - 2014-01-09 02:55 - 212230516 _____ C:\Users\*********\Documents\clip0008.avi
2014-01-09 02:53 - 2014-01-09 02:52 - 224291418 _____ C:\Users\*********\Documents\clip0007.avi
2014-01-09 02:51 - 2014-01-09 02:50 - 156283886 _____ C:\Users\*********\Documents\clip0006.avi
2014-01-09 02:49 - 2014-01-09 02:49 - 149440834 _____ C:\Users\*********\Documents\clip0005.avi
2014-01-09 02:47 - 2014-01-09 02:46 - 110648088 _____ C:\Users\*********\Documents\clip0004.avi
2014-01-09 02:43 - 2014-01-09 02:43 - 109383106 _____ C:\Users\*********\Documents\clip0003.avi
2014-01-09 02:37 - 2014-01-09 02:36 - 153556170 _____ C:\Users\*********\Documents\clip0002.avi
2014-01-09 02:34 - 2014-01-06 18:43 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett
2014-01-09 02:28 - 2014-01-09 02:28 - 05401856 _____ C:\Users\*********\Downloads\HC228SetDE.exe
2014-01-09 02:28 - 2014-01-09 02:28 - 00000925 _____ C:\Users\*********\Desktop\HyperCam 2.lnk
2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2
2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Program Files (x86)\HyperCam 2
2014-01-09 02:08 - 2014-01-09 02:08 - 00087414 _____ C:\Users\*********\Desktop\FRA-DOH.kmz
2014-01-09 01:39 - 2014-01-08 21:42 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live
2014-01-09 01:29 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2014-01-09 00:46 - 2014-01-09 00:14 - 00015328 _____ C:\Users\*********\Desktop\Gmer.txt
2014-01-09 00:45 - 2014-01-09 00:02 - 00024083 _____ C:\Users\*********\Desktop\Addition.txt
2014-01-09 00:45 - 2014-01-08 23:58 - 00000482 _____ C:\Users\*********\Desktop\defogger_disable.log
2014-01-09 00:45 - 2014-01-08 23:41 - 00001022 _____ C:\Users\*********\Desktop\AdwCleaner[S0].txt
2014-01-09 00:41 - 2014-01-09 00:35 - 00001368 _____ C:\Users\*********\Desktop\avira.txt
2014-01-09 00:05 - 2014-01-09 00:05 - 00377856 _____ C:\Users\*********\Desktop\gmer_2.1.19163.exe
2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable
2014-01-08 23:58 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********
2014-01-08 23:56 - 2013-08-13 20:50 - 00000000 ____D C:\Program Files\Microsoft Office 15
2014-01-08 23:53 - 2014-01-08 23:53 - 00050477 _____ C:\Users\*********\Desktop\Defogger.exe
2014-01-08 23:43 - 2014-01-08 17:42 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2014-01-08 23:39 - 2013-06-28 18:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-08 23:38 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2014-01-08 23:31 - 2013-11-30 17:12 - 00000000 ____D C:\ProgramData\Skype
2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-01-08 21:47 - 2014-01-08 21:46 - 00000000 ____D C:\Program Files (x86)\Windows Live
2014-01-08 21:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2014-01-08 21:41 - 2014-01-08 21:40 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt
2014-01-08 21:33 - 2012-10-11 17:28 - 00000000 ____D C:\ProgramData\NTI Launcher
2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log
2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe
2014-01-08 20:24 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********\AppData\Local\VirtualStore
2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg
2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes
2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-08 17:47 - 2013-12-01 11:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-08 17:36 - 2013-10-31 16:01 - 00000000 ____D C:\Users\*********\AppData\Local\CrashDumps
2014-01-08 17:36 - 2012-09-03 12:56 - 00000000 ____D C:\Windows\Panther
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia
2014-01-06 17:27 - 2013-09-22 10:48 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk
2014-01-06 16:58 - 2013-08-30 20:49 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-06 16:58 - 2013-06-23 20:19 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-01-06 16:58 - 2013-06-23 20:14 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-01-06 16:58 - 2013-06-23 20:14 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-01-06 16:55 - 2013-08-05 18:13 - 00000000 ___RD C:\Users\*********\Dropbox
2014-01-06 16:55 - 2013-08-05 18:10 - 00000000 ____D C:\Users\*********\AppData\Roaming\Dropbox

Some content of TEMP:
====================
C:\Users\*********\AppData\Local\temp\avgnt.exe
C:\Users\*********\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-10 22:58

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Danke schön
und viele Grüße
anwo

schrauber · 13.01.2014, 10:23

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

anwo1984 · 15.01.2014, 22:58

Hallo Schrauber,

vielen Dank

.

Hier sind die drei Logs.

eset.txt:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=a41a32bed181664087b4266a2d17e3b0
# engine=16652
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-14 10:38:05
# local_time=2014-01-14 11:38:05 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT 
# compatibility_mode=1799 16775165 100 96 16462 255162375 9247 0
# compatibility_mode=5893 16776574 100 94 207164 17022560 0 0
# scanned=248027
# found=0
# cleaned=0
# scan_time=4871

checkup.txt:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.78  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
Avira Desktop      
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Adobe Flash Player 	11.9.900.170  
 Mozilla Firefox (26.0) 
 Mozilla Thunderbird (24.1.1) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

Und ein frisches FRST.txt:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2014
Ran by ********* (administrator) on **** on 15-01-2014 22:46:01
Running from C:\Users\*********\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2014-01-06] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)
HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Ghostery - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\firefox@ghostery.com.xpi [2013-08-20]
FF Extension: NoScript - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-08]
FF Extension: Adblock Plus - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-08]
FF Extension: BetterPrivacy - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-06-23]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

U2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2014-01-06] (Avira Operations GmbH & Co. KG)
U2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-27] (Avira Operations GmbH & Co. KG)
U2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)
U2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)
U2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
U3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)
U3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
U2 ETDService; C:\Program Files\Elantech\ETDService.exe [28560 2012-08-30] (ELAN Microelectronics Corp.)
U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
U2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)
U2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)
U2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-11] (Dritek System INC.)
U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
U2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-07-31] (Atheros)

==================== Drivers (Whitelisted) ====================

U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-01-06] (Avira Operations GmbH & Co. KG)
U1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2014-01-06] (Avira Operations GmbH & Co. KG)
U1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
U3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
U3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
U3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-11] (Dritek System Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
U3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-15 22:46 - 2014-01-15 22:46 - 00013121 _____ C:\Users\*********\Desktop\FRST.txt
2014-01-15 22:45 - 2014-01-15 22:45 - 00000806 _____ C:\Users\*********\Desktop\checkup.txt
2014-01-15 22:34 - 2014-01-15 22:34 - 00000698 _____ C:\Users\*********\Desktop\eset.txt
2014-01-14 22:12 - 2014-01-14 22:12 - 00987410 _____ C:\Users\*********\Downloads\SecurityCheck.exe
2014-01-14 21:33 - 2014-01-14 21:33 - 01110476 _____ C:\Users\*********\Downloads\7z920.exe
2014-01-14 21:33 - 2014-01-14 21:33 - 00000000 ____D C:\Program Files (x86)\7-Zip
2014-01-12 14:52 - 2014-01-12 14:52 - 00000000 ____D C:\Windows\ERUNT
2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setuperr.log
2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setupact.log
2014-01-11 19:15 - 2014-01-11 19:52 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett - Kopie
2014-01-10 23:12 - 2014-01-10 23:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-10 23:12 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-10 21:54 - 2014-01-10 21:55 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-09 13:42 - 2014-01-09 13:49 - 00000000 ____D C:\Qoobox
2014-01-09 13:42 - 2014-01-09 13:48 - 00000000 ____D C:\Windows\erdnt
2014-01-09 13:42 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-09 13:42 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-09 13:42 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-09 13:42 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-09 13:38 - 2013-11-19 11:21 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-09 02:55 - 2014-01-09 02:55 - 212230516 _____ C:\Users\*********\Documents\clip0008.avi
2014-01-09 02:52 - 2014-01-09 02:53 - 224291418 _____ C:\Users\*********\Documents\clip0007.avi
2014-01-09 02:50 - 2014-01-09 02:51 - 156283886 _____ C:\Users\*********\Documents\clip0006.avi
2014-01-09 02:49 - 2014-01-09 02:49 - 149440834 _____ C:\Users\*********\Documents\clip0005.avi
2014-01-09 02:46 - 2014-01-09 02:47 - 110648088 _____ C:\Users\*********\Documents\clip0004.avi
2014-01-09 02:43 - 2014-01-09 02:43 - 109383106 _____ C:\Users\*********\Documents\clip0003.avi
2014-01-09 02:36 - 2014-01-09 02:37 - 153556170 _____ C:\Users\*********\Documents\clip0002.avi
2014-01-09 02:28 - 2014-01-09 02:28 - 05401856 _____ C:\Users\*********\Downloads\HC228SetDE.exe
2014-01-09 02:28 - 2014-01-09 02:28 - 00000925 _____ C:\Users\*********\Desktop\HyperCam 2.lnk
2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2
2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Program Files (x86)\HyperCam 2
2014-01-09 02:08 - 2014-01-09 02:08 - 00087414 _____ C:\Users\*********\Desktop\FRA-DOH.kmz
2014-01-09 01:28 - 2013-08-10 06:21 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\SettingSync.dll
2014-01-09 01:28 - 2013-08-10 06:21 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncInfo.dll
2014-01-09 01:28 - 2013-08-10 04:58 - 00356352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll
2014-01-09 01:28 - 2013-08-02 07:28 - 19758080 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-01-09 01:28 - 2013-08-02 07:28 - 10116608 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-01-09 01:28 - 2013-08-02 07:28 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2014-01-09 01:28 - 2013-08-02 07:26 - 02304512 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-01-09 01:28 - 2013-08-02 06:08 - 17561088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-01-09 01:28 - 2013-08-02 06:08 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-01-09 01:28 - 2013-08-02 06:08 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2014-01-09 01:28 - 2013-08-02 06:06 - 02035712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-01-09 01:28 - 2013-08-01 11:41 - 02233688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-01-09 01:28 - 2013-07-25 00:10 - 00158208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mbsmsapi.dll
2014-01-09 01:28 - 2013-07-25 00:06 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\mbsmsapi.dll
2014-01-09 01:28 - 2013-04-10 00:17 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2014-01-09 01:28 - 2013-04-09 23:29 - 00893952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2014-01-09 01:27 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-01-09 01:27 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-01-09 01:27 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-01-09 01:27 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-01-09 01:27 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-01-09 01:27 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-01-09 01:27 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-01-09 01:27 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-01-09 01:27 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-01-09 01:27 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-01-09 01:27 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-01-09 01:27 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-01-09 01:27 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-01-09 01:27 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-01-09 01:27 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-01-09 01:27 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-01-09 01:27 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-01-09 01:27 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-01-09 01:27 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2014-01-09 01:27 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-01-09 01:27 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2014-01-09 01:27 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-01-09 01:27 - 2013-08-03 07:40 - 01374208 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2014-01-09 01:27 - 2013-08-03 07:40 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll
2014-01-09 01:27 - 2013-08-03 07:40 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2014-01-09 01:27 - 2013-08-03 06:14 - 00399360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2014-01-09 01:27 - 2013-08-03 06:13 - 01245696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2014-01-09 01:27 - 2013-08-03 06:13 - 00437248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2014-01-09 01:27 - 2013-07-05 23:02 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2014-01-09 01:27 - 2013-07-05 23:01 - 00210560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2014-01-09 01:27 - 2013-06-22 06:45 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-01-09 01:27 - 2013-06-22 06:45 - 00054488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2014-01-09 01:27 - 2013-05-15 23:37 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-01-09 01:27 - 2013-05-15 23:35 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-01-09 01:27 - 2013-05-14 14:14 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-01-09 01:27 - 2013-05-14 10:23 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-01-09 01:27 - 2013-02-21 11:29 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-01-09 01:27 - 2013-02-21 11:29 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-01-09 01:27 - 2013-02-21 11:29 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-01-09 01:27 - 2013-02-21 11:29 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-01-09 01:27 - 2013-02-21 11:14 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-01-09 01:27 - 2013-02-21 11:14 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-01-09 01:27 - 2013-02-19 10:53 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-01-09 01:27 - 2012-11-08 05:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-01-09 01:27 - 2012-11-08 05:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-01-09 01:26 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-01-09 01:26 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-01-09 01:26 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2014-01-09 01:26 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2014-01-09 01:26 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crashdmp.sys
2014-01-09 01:26 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2014-01-09 01:26 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2014-01-09 01:26 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2014-01-09 01:26 - 2013-08-16 06:21 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-01-09 01:26 - 2013-08-16 06:21 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-01-09 01:26 - 2013-08-15 23:43 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-01-09 01:26 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys
2014-01-09 01:26 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-01-09 01:26 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-01-09 01:26 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2014-01-09 01:26 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2014-01-09 01:26 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2014-01-09 01:26 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2014-01-09 01:26 - 2013-07-06 01:15 - 00652288 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-01-09 01:26 - 2013-07-04 03:13 - 00541696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2014-01-09 01:26 - 2013-07-01 23:14 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbprint.sys
2014-01-09 01:26 - 2013-06-29 04:08 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-01-09 01:26 - 2013-06-29 04:07 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-01-09 01:25 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-01-09 01:25 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-01-09 01:25 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-01-09 01:25 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-01-09 01:25 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-01-09 01:25 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-01-09 01:25 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-01-09 01:25 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-01-09 01:25 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2014-01-09 01:25 - 2013-10-03 23:09 - 00385528 _____ C:\Windows\system32\ApnDatabase.xml
2014-01-09 01:25 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-01-09 01:25 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2014-01-09 01:25 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2014-01-09 01:25 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-01-09 01:25 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-01-09 01:25 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-01-09 01:25 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-01-09 01:25 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-01-09 01:25 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\resutils.dll
2014-01-09 01:25 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2014-01-09 01:25 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2014-01-09 01:25 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2014-01-09 01:25 - 2013-08-16 06:41 - 00058200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dam.sys
2014-01-09 01:25 - 2013-08-16 06:39 - 02371728 _____ (Microsoft Corporation) C:\Windows\system32\WSService.dll
2014-01-09 01:25 - 2013-08-16 06:32 - 00209200 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-01-09 01:25 - 2013-08-16 06:22 - 04917760 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2014-01-09 01:25 - 2013-08-16 06:21 - 01164288 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00204800 _____ (Microsoft Corporation) C:\Windows\system32\WSClient.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\WSSync.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\sppc.dll
2014-01-09 01:25 - 2013-08-16 06:21 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\setupcln.dll
2014-01-09 01:25 - 2013-08-16 06:20 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00167424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSClient.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSSync.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-09 01:25 - 2013-08-15 23:43 - 00083968 _____ C:\Windows\SysWOW64\OEMLicense.dll
2014-01-09 01:25 - 2013-08-15 23:42 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppc.dll
2014-01-09 01:25 - 2013-08-15 23:42 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupcln.dll
2014-01-09 01:25 - 2013-07-09 09:04 - 00120144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msgpioclx.sys
2014-01-09 01:25 - 2013-07-09 07:18 - 00439488 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2014-01-09 01:25 - 2013-07-09 05:25 - 00385768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2014-01-09 01:25 - 2013-07-09 04:57 - 00245760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LocationApi.dll
2014-01-09 01:25 - 2013-07-08 23:46 - 00543744 _____ (Microsoft Corporation) C:\Windows\system32\wwanmm.dll
2014-01-09 01:25 - 2013-07-08 23:46 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll
2014-01-09 01:25 - 2013-07-08 23:46 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\Wwanadvui.dll
2014-01-09 01:25 - 2013-07-08 23:45 - 00312832 _____ (Microsoft Corporation) C:\Windows\system32\LocationApi.dll
2014-01-09 01:25 - 2013-07-06 01:16 - 01025024 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-01-09 01:25 - 2013-07-03 01:23 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.BackgroundTransfer.dll
2014-01-09 01:25 - 2013-07-03 01:22 - 02839552 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2014-01-09 01:25 - 2013-07-03 01:11 - 00268800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2014-01-09 01:25 - 2013-07-03 01:10 - 02273792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2014-01-09 01:25 - 2013-06-30 23:30 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\openfiles.exe
2014-01-09 01:25 - 2013-06-30 23:29 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\openfiles.exe
2014-01-09 01:25 - 2013-06-29 07:15 - 00195416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2014-01-09 01:25 - 2013-06-29 07:15 - 00125784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2014-01-09 01:25 - 2013-06-29 06:43 - 00327512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-01-09 01:25 - 2013-06-26 04:01 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2014-01-09 01:25 - 2013-06-26 03:59 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\HdAudio.sys
2014-01-09 01:25 - 2013-06-24 23:54 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-01-09 01:25 - 2013-06-24 23:54 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2014-01-09 01:25 - 2013-06-24 23:54 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2014-01-09 01:25 - 2013-06-19 06:36 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\winmmbase.dll
2014-01-09 01:25 - 2013-06-19 06:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll
2014-01-09 01:25 - 2013-06-18 23:38 - 00160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmmbase.dll
2014-01-09 01:25 - 2013-06-18 23:38 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll
2014-01-09 01:25 - 2013-06-12 00:43 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2014-01-09 01:25 - 2013-06-12 00:26 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2014-01-09 01:25 - 2013-06-10 20:16 - 00888832 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2014-01-09 01:25 - 2013-06-10 20:15 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-01-09 01:25 - 2013-06-10 20:10 - 00702464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2014-01-09 01:25 - 2013-06-10 20:10 - 00245248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2014-01-09 01:25 - 2013-06-06 09:03 - 00119040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2014-01-09 01:24 - 2013-07-02 02:41 - 00337752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2014-01-09 01:24 - 2013-07-02 02:41 - 00213336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2014-01-09 01:24 - 2013-07-01 02:42 - 00623448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-09 01:24 - 2013-07-01 02:42 - 00498008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-09 01:24 - 2013-07-01 02:42 - 00079192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-09 01:24 - 2013-07-01 02:42 - 00021848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-09 01:24 - 2013-06-29 04:07 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-09 01:24 - 2013-06-29 04:06 - 00120832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-09 01:23 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-09 01:23 - 2013-08-07 06:15 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\tssdisai.dll
2014-01-09 01:23 - 2013-07-19 23:13 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-01-09 01:23 - 2013-07-19 23:13 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2014-01-09 01:22 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2014-01-09 01:22 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll
2014-01-09 01:22 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2014-01-09 01:22 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-01-09 01:22 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-01-09 01:22 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2014-01-09 01:22 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-01-09 01:22 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-01-09 01:22 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-01-09 01:22 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-01-09 01:22 - 2013-05-27 00:17 - 00035328 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2014-01-09 01:22 - 2013-05-26 23:59 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-01-09 01:22 - 2013-05-25 04:15 - 00362496 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-01-09 01:22 - 2013-05-25 03:32 - 00300032 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2014-01-09 00:30 - 2014-01-09 14:32 - 00001896 _____ C:\Windows\PFRO.log
2014-01-09 00:01 - 2014-01-12 15:00 - 00000000 ____D C:\FRST
2014-01-08 23:59 - 2014-01-12 15:00 - 02075136 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe
2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable
2014-01-08 23:36 - 2014-01-12 14:49 - 00000000 ____D C:\AdwCleaner
2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-01-08 21:46 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Windows Live
2014-01-08 21:46 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-01-08 21:46 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-01-08 21:46 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-01-08 21:46 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-01-08 21:46 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-01-08 21:45 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-01-08 21:45 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-01-08 21:42 - 2014-01-14 20:31 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live
2014-01-08 21:40 - 2014-01-08 21:41 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt
2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log
2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe
2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg
2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes
2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-08 17:42 - 2014-01-08 23:43 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia
2014-01-06 18:43 - 2014-01-09 02:34 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett
2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk

==================== One Month Modified Files and Folders =======

2014-01-15 22:46 - 2014-01-15 22:46 - 00013121 _____ C:\Users\*********\Desktop\FRST.txt
2014-01-15 22:45 - 2014-01-15 22:45 - 00000806 _____ C:\Users\*********\Desktop\checkup.txt
2014-01-15 22:43 - 2013-06-23 00:21 - 01163501 _____ C:\Windows\WindowsUpdate.log
2014-01-15 22:34 - 2014-01-15 22:34 - 00000698 _____ C:\Users\*********\Desktop\eset.txt
2014-01-15 22:30 - 2013-08-25 16:30 - 00000000 ____D C:\Windows\system32\MRT
2014-01-15 22:30 - 2013-08-04 07:44 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 22:27 - 2013-09-22 10:48 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-15 22:17 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2014-01-15 01:04 - 2013-08-30 20:49 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-14 22:14 - 2012-10-12 02:44 - 00753134 _____ C:\Windows\system32\perfh007.dat
2014-01-14 22:14 - 2012-10-12 02:44 - 00155826 _____ C:\Windows\system32\perfc007.dat
2014-01-14 22:14 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-14 22:12 - 2014-01-14 22:12 - 00987410 _____ C:\Users\*********\Downloads\SecurityCheck.exe
2014-01-14 21:33 - 2014-01-14 21:33 - 01110476 _____ C:\Users\*********\Downloads\7z920.exe
2014-01-14 21:33 - 2014-01-14 21:33 - 00000000 ____D C:\Program Files (x86)\7-Zip
2014-01-14 21:09 - 2013-06-22 19:01 - 00000000 ____D C:\Users\*********\AppData\Roaming\vlc
2014-01-14 21:06 - 2013-10-31 16:01 - 00000000 ____D C:\Users\*********\AppData\Local\CrashDumps
2014-01-14 20:31 - 2014-01-08 21:42 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live
2014-01-14 20:01 - 2013-08-30 20:49 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-14 20:00 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-12 15:00 - 2014-01-09 00:01 - 00000000 ____D C:\FRST
2014-01-12 15:00 - 2014-01-08 23:59 - 02075136 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe
2014-01-12 14:52 - 2014-01-12 14:52 - 00000000 ____D C:\Windows\ERUNT
2014-01-12 14:49 - 2014-01-08 23:36 - 00000000 ____D C:\AdwCleaner
2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setuperr.log
2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setupact.log
2014-01-11 19:52 - 2014-01-11 19:15 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett - Kopie
2014-01-11 01:19 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2014-01-11 00:45 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SecureBootUpdates
2014-01-10 23:12 - 2014-01-10 23:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-10 21:55 - 2014-01-10 21:54 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-09 14:41 - 2013-06-23 00:22 - 00000000 ___RD C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-09 14:41 - 2013-06-23 00:22 - 00000000 ___RD C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-09 14:37 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2014-01-09 14:37 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\PolicyDefinitions
2014-01-09 14:36 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe
2014-01-09 14:35 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ToastData
2014-01-09 14:32 - 2014-01-09 00:30 - 00001896 _____ C:\Windows\PFRO.log
2014-01-09 14:22 - 2013-06-23 00:28 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-627669732-214247668-4251278340-1002
2014-01-09 13:49 - 2014-01-09 13:42 - 00000000 ____D C:\Qoobox
2014-01-09 13:49 - 2012-07-26 06:37 - 00000000 __RHD C:\Users\Default
2014-01-09 13:48 - 2014-01-09 13:42 - 00000000 ____D C:\Windows\erdnt
2014-01-09 13:47 - 2012-07-26 06:26 - 00000215 _____ C:\Windows\system.ini
2014-01-09 09:02 - 2013-08-05 17:54 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-09 09:02 - 2013-08-05 17:54 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-09 02:55 - 2014-01-09 02:55 - 212230516 _____ C:\Users\*********\Documents\clip0008.avi
2014-01-09 02:53 - 2014-01-09 02:52 - 224291418 _____ C:\Users\*********\Documents\clip0007.avi
2014-01-09 02:51 - 2014-01-09 02:50 - 156283886 _____ C:\Users\*********\Documents\clip0006.avi
2014-01-09 02:49 - 2014-01-09 02:49 - 149440834 _____ C:\Users\*********\Documents\clip0005.avi
2014-01-09 02:47 - 2014-01-09 02:46 - 110648088 _____ C:\Users\*********\Documents\clip0004.avi
2014-01-09 02:43 - 2014-01-09 02:43 - 109383106 _____ C:\Users\*********\Documents\clip0003.avi
2014-01-09 02:37 - 2014-01-09 02:36 - 153556170 _____ C:\Users\*********\Documents\clip0002.avi
2014-01-09 02:34 - 2014-01-06 18:43 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett
2014-01-09 02:28 - 2014-01-09 02:28 - 05401856 _____ C:\Users\*********\Downloads\HC228SetDE.exe
2014-01-09 02:28 - 2014-01-09 02:28 - 00000925 _____ C:\Users\*********\Desktop\HyperCam 2.lnk
2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2
2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Program Files (x86)\HyperCam 2
2014-01-09 02:08 - 2014-01-09 02:08 - 00087414 _____ C:\Users\*********\Desktop\FRA-DOH.kmz
2014-01-09 01:29 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable
2014-01-08 23:58 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********
2014-01-08 23:56 - 2013-08-13 20:50 - 00000000 ____D C:\Program Files\Microsoft Office 15
2014-01-08 23:43 - 2014-01-08 17:42 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2014-01-08 23:39 - 2013-06-28 18:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-08 23:38 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2014-01-08 23:31 - 2013-11-30 17:12 - 00000000 ____D C:\ProgramData\Skype
2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH
2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-01-08 21:47 - 2014-01-08 21:46 - 00000000 ____D C:\Program Files (x86)\Windows Live
2014-01-08 21:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2014-01-08 21:41 - 2014-01-08 21:40 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt
2014-01-08 21:33 - 2012-10-11 17:28 - 00000000 ____D C:\ProgramData\NTI Launcher
2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log
2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe
2014-01-08 20:24 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********\AppData\Local\VirtualStore
2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg
2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes
2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-08 17:47 - 2013-12-01 11:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-08 17:36 - 2012-09-03 12:56 - 00000000 ____D C:\Windows\Panther
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI
2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia
2014-01-06 17:27 - 2013-09-22 10:48 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk
2014-01-06 16:58 - 2013-08-30 20:49 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-06 16:58 - 2013-06-23 20:19 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-01-06 16:58 - 2013-06-23 20:14 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-01-06 16:58 - 2013-06-23 20:14 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-01-06 16:55 - 2013-08-05 18:13 - 00000000 ___RD C:\Users\*********\Dropbox
2014-01-06 16:55 - 2013-08-05 18:10 - 00000000 ____D C:\Users\*********\AppData\Roaming\Dropbox

Some content of TEMP:
====================
C:\Users\*********\AppData\Local\temp\avgnt.exe
C:\Users\*********\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-10 22:58

==================== End Of Log ============================

--- --- ---

--- --- ---

Vielen lieben Dank für Deine Hilfe.

Eine Frage habe ich noch. Gibt es eine Möglichkeit sich besser gegen die Viren zu schützen?

Danke schön und viele Grüße
anwo

schrauber · 16.01.2014, 17:14

Fertig

Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Email- und Ebaykonto missbraucht: TR/Fraud.Gen8 und TR/Crypt.TPM.Gen beim Virenscan gefunden

Log-Analyse und Auswertung: Email- und Ebaykonto missbraucht: TR/Fraud.Gen8 und TR/Crypt.TPM.Gen beim Virenscan gefunden