| |
| |||||||
Log-Analyse und Auswertung: Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
08.02.2014, 04:38
| #1 |
| |  Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? Hallo, mir ist gestern aufgefallen, dass ich im Taskmanager eine Instanz von explorer.exe laufen habe, der mir die Hälfte der Prozessorleistung zieht. Wenn ich den Prozess beende, startet er nach 2-3 Sekunden automatisch wieder neu. Bei näherer Betrachtung habe ich festgestellt, dass die explorer.exe mit einem langen Parameter gestartet wurde, der auf die Domain fast-pool.com verweist (an den genauen Parameter komme ich gerade nicht ran, da ich mich mit dem betroffenen Windowsaccount im Moment nicht anmelden möchte). Der Effekt mit der erhöhten Systemlast tritt nur in meinem normalen Arbeitsaccount (eingeschränkte Rechte) auf. Im Adminaccount ist dieser Prozess nicht vorhanden. Ich habe Malwarebytes, defogger, FRST sowie GMER wie in der Anleitung beschrieben ausgeführt. Nachstehend die Logs der Programme (in chronologischer Reihenfolge). Das Log von GMER musste ich aufgrund der Größe leider zippen. Vielen Dank im voraus! Gruß Colorlight Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.08.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Admin :: VINCENTS-PC [Administrator] 08.02.2014 02:54:32 mbam-log-2014-02-08 (02-54-32).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 312789 Laufzeit: 5 Minute(n), 1 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 1 C:\Users\Admin\AppData\Local\Temp\CT2438727 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 11 C:\Users\Heiko\AppData\Local\Temp\FIBJeDQZ.exe.part (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Heiko\AppData\Local\Temp\lQdt4XbZ.exe.part (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Heiko\Downloads\FlashPlayersetup__3873_i298808872_il22.exe (PUP.Optional.InstallMonetizer) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Julien\Downloads\FLVPlayerSetup.exe (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Julien\Downloads\iLividSetup-r342-n-bf(1).exe (PUP.Optional.Bandoo) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Julien\Downloads\iLividSetup-r342-n-bf.exe (PUP.Optional.Bandoo) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Julien\Downloads\SoftonicDownloader_fuer_minecraft.exe (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\CT2438727\CT2438727.txt (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\CT2438727\ddt.csf (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\CT2438727\initData.json (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\CT2438727\manifest.json (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 03:13 on 08/02/2014 (Admin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2014
Ran by Admin (administrator) on VINCENTS-PC on 08-02-2014 03:16:02
Running from C:\Users\Admin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun32.bin
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Pegtop Software) D:\PortableApps\PStart\PStart.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7284328 2011-08-30] (Realtek Semiconductor)
HKLM\...\Run: [fssui] - C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [892416 2012-09-12] (Microsoft Corporation)
HKLM\...\Run: [SuRun Systemmenü-Erweiterung] - C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
HKLM\...\Run: [tvncontrol] - C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-27] (AVAST Software)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\MountPoints2: {1db13b4c-7ac0-11e2-bd48-806e6f6e6963} - E:\DVDSetup.exe
IFEO\taskmgr.exe: [Debugger] "C:\PortableApps\ProcessExplorerPortable\ProcessExplorerPortable.exe"
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PStart - Verknüpfung.lnk
ShortcutTarget: PStart - Verknüpfung.lnk -> D:\PortableApps\PStart\PStart.exe (Pegtop Software)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.lnk
ShortcutTarget: Core Temp.lnk -> C:\Program Files\Core Temp\Core Temp.exe ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PortableAppsPlatform.exe - Verknüpfung.lnk
ShortcutTarget: PortableAppsPlatform.exe - Verknüpfung.lnk -> C:\PortableApps\PortableApps.com\PortableAppsPlatform.exe (PortableApps.com)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PStart - Verknüpfung.lnk
ShortcutTarget: PStart - Verknüpfung.lnk -> D:\PortableApps\PStart\PStart.exe (Pegtop Software)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XMediaGrabber.lnk
ShortcutTarget: XMediaGrabber.lnk -> C:\Program Files (x86)\XMediaGrabber\XMediaGrabber.exe (hxxp://www.xmediagrabber.de)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x163759EBE10ECE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0F4C14C4-945D-4990-9388-A3C7A2E9336F} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {94AE0E02-5D76-4244-8B5F-783BD0CA7D76} URL = hxxp://www.bing.com/?cc=de
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: No Name - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks: SuRun Shell Extension - {2C7B6088-5A77-4d48-BE43-30337DCA9A86} - C:\Windows\SuRunExt.dll [189952 2013-07-03] (hxxp://kay-bruns.de)
Tcpip\..\Interfaces\{57F85748-9E1C-49A3-89C9-3715B55FD919}: [NameServer]192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-02-20]
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-27] (AVAST Software)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S4 MsgPlusService; C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [128000 2013-06-27] (Yuna Software)
R2 SuRunSVC; C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
S4 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-27] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-27] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-27] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-27] ()
R3 dvdfab; C:\Windows\System32\drivers\dvdfab.sys [79232 2011-08-15] (Fengtao Software Inc.)
R3 MsgPlusDriver; C:\Windows\System32\DRIVERS\MsgPlusDriver.sys [125392 2013-05-07] (Yune Software)
S3 ALSysIO; \??\C:\Users\Admin\AppData\Local\Temp\ALSysIO64.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-08 03:16 - 2014-02-08 03:16 - 00011803 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-08 03:15 - 2014-02-08 03:16 - 00000000 ____D () C:\FRST
2014-02-08 03:14 - 2014-02-08 03:14 - 02079744 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000472 _____ () C:\Users\Admin\Downloads\defogger_disable.log
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:52 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-08 02:47 - 2014-02-08 02:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:33 - 2014-02-08 00:37 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:32 - 2014-02-08 00:41 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 20:18 - 2014-02-08 00:12 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:20 - 2014-02-07 19:58 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 10:18 - 2011-12-21 13:15 - 00219440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2014-02-05 10:18 - 2011-12-21 13:15 - 00044848 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:11 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 15:11 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-02-03 15:11 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 20:58 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2014-02-02 20:58 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2014-02-02 20:58 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2014-02-02 20:57 - 2014-02-02 20:58 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:57 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2014-02-02 20:57 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2014-02-02 20:57 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-02-02 20:57 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-02-02 20:57 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-02-02 20:57 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-02-02 20:57 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-02-02 20:57 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-02-02 20:57 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-02-02 20:57 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-02-02 20:57 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-02-02 20:57 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-08 00:49 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:07 - 2014-02-02 20:08 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-01-17 06:11 - 2014-01-17 06:12 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:11 - 2014-01-17 06:12 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:11 - 2014-01-17 06:12 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-15 17:55 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 17:55 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 17:55 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software
==================== One Month Modified Files and Folders =======
2014-02-08 03:16 - 2014-02-08 03:16 - 00011803 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-08 03:16 - 2014-02-08 03:15 - 00000000 ____D () C:\FRST
2014-02-08 03:14 - 2014-02-08 03:14 - 02079744 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000472 _____ () C:\Users\Admin\Downloads\defogger_disable.log
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:13 - 2013-02-19 21:23 - 00000000 ____D () C:\Users\Admin
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 03:12 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-08 03:12 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-08 03:09 - 2013-02-19 19:18 - 01374140 _____ () C:\Windows\WindowsUpdate.log
2014-02-08 03:06 - 2013-04-22 19:37 - 00000680 __RSH () C:\Users\Admin\ntuser.pol
2014-02-08 03:05 - 2013-04-05 04:12 - 00027444 _____ () C:\Windows\PFRO.log
2014-02-08 03:05 - 2013-03-30 01:05 - 00039037 _____ () C:\Windows\setupact.log
2014-02-08 03:05 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:48 - 2014-02-08 02:47 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 02:26 - 2013-02-20 07:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-08 02:10 - 2013-02-20 08:04 - 00000000 ____D () C:\Users\Admin\AppData\Local\Mozilla
2014-02-08 02:05 - 2013-04-16 18:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\Windows Live
2014-02-08 02:03 - 2013-08-05 08:37 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA.job
2014-02-08 02:03 - 2013-08-05 08:37 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core.job
2014-02-08 01:58 - 2013-08-05 08:37 - 00003918 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA
2014-02-08 01:58 - 2013-08-05 08:37 - 00003550 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core
2014-02-08 01:57 - 2013-02-22 19:02 - 00000000 ___RD () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:49 - 2014-02-02 20:09 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-08 00:41 - 2014-02-08 00:32 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:37 - 2014-02-08 00:33 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:12 - 2014-02-07 20:18 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-08 00:12 - 2013-08-16 19:19 - 00000000 ____D () C:\Users\Heiko\.xmg
2014-02-08 00:12 - 2013-04-16 18:21 - 00000680 __RSH () C:\Users\Heiko\ntuser.pol
2014-02-08 00:12 - 2013-02-22 19:01 - 00000000 ____D () C:\Users\Heiko
2014-02-07 23:41 - 2013-02-24 22:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\XBMC
2014-02-07 23:32 - 2013-08-25 00:42 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:17 - 2013-12-22 14:59 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\Skype
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 21:13 - 2013-04-16 18:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Windows Live
2014-02-07 19:58 - 2014-02-05 10:20 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-07 09:48 - 2013-08-29 17:05 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{12489FB2-B57C-4A9C-8F29-2291A874BC82}
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 12:09 - 2013-02-20 09:25 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 08:01 - 2013-12-20 07:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-04 22:26 - 2013-02-20 07:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 22:26 - 2013-02-20 07:36 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 22:26 - 2013-02-20 07:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 19:28 - 2013-04-22 19:35 - 00022330 __RSH () C:\Users\Julien\ntuser.pol
2014-02-03 19:28 - 2013-04-22 19:35 - 00000000 ____D () C:\Users\Julien
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:12 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 21:40 - 2013-04-16 18:26 - 00004682 __RSH () C:\Users\Jeremy\ntuser.pol
2014-02-02 21:40 - 2013-02-28 18:40 - 00000000 ____D () C:\Users\Jeremy
2014-02-02 20:58 - 2014-02-02 20:57 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:08 - 2014-02-02 20:07 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-02-02 19:45 - 2013-03-17 21:09 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\.minecraft
2014-02-01 08:52 - 2013-04-22 19:37 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\.minecraft
2014-01-25 19:44 - 2013-11-16 21:58 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Skype
2014-01-17 06:12 - 2014-01-17 06:11 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:12 - 2014-01-17 06:11 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:12 - 2014-01-17 06:11 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 20:18 - 2010-11-21 07:50 - 00697160 _____ () C:\Windows\system32\perfh007.dat
2014-01-16 20:18 - 2010-11-21 07:50 - 00148642 _____ () C:\Windows\system32\perfc007.dat
2014-01-16 20:18 - 2009-07-14 06:13 - 01613340 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-16 03:19 - 2009-07-14 05:45 - 00276968 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:03 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-16 03:00 - 2013-02-20 07:37 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-14 14:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-14 12:25 - 2013-02-20 08:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Admin\AppData\Local\Temp\sfextra.dll
C:\Users\Heiko\AppData\Local\Temp\dateinj01.dll
C:\Users\Heiko\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Heiko\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Heiko\AppData\Local\Temp\jna1090320167789684337.dll
C:\Users\Heiko\AppData\Local\Temp\jna146387679698056849.dll
C:\Users\Heiko\AppData\Local\Temp\jna1889692644574211350.dll
C:\Users\Heiko\AppData\Local\Temp\jna2335009430795990528.dll
C:\Users\Heiko\AppData\Local\Temp\jna2570889650698236768.dll
C:\Users\Heiko\AppData\Local\Temp\jna2579745138073087603.dll
C:\Users\Heiko\AppData\Local\Temp\jna2710169554635638698.dll
C:\Users\Heiko\AppData\Local\Temp\jna317314098607355768.dll
C:\Users\Heiko\AppData\Local\Temp\jna3550376239115613572.dll
C:\Users\Heiko\AppData\Local\Temp\jna3687876397338136285.dll
C:\Users\Heiko\AppData\Local\Temp\jna395911161415364618.dll
C:\Users\Heiko\AppData\Local\Temp\jna5090182510300320974.dll
C:\Users\Heiko\AppData\Local\Temp\jna5173797234473555658.dll
C:\Users\Heiko\AppData\Local\Temp\jna532471048345224569.dll
C:\Users\Heiko\AppData\Local\Temp\jna5331849837104093976.dll
C:\Users\Heiko\AppData\Local\Temp\jna5773945272469302218.dll
C:\Users\Heiko\AppData\Local\Temp\jna5834066976529262566.dll
C:\Users\Heiko\AppData\Local\Temp\jna5966279924322110094.dll
C:\Users\Heiko\AppData\Local\Temp\jna6229537924547466958.dll
C:\Users\Heiko\AppData\Local\Temp\jna6480371944392390404.dll
C:\Users\Heiko\AppData\Local\Temp\jna6629853560495946337.dll
C:\Users\Heiko\AppData\Local\Temp\jna6814767887592814909.dll
C:\Users\Heiko\AppData\Local\Temp\jna7414802737387451775.dll
C:\Users\Heiko\AppData\Local\Temp\jna7980470534759480116.dll
C:\Users\Heiko\AppData\Local\Temp\jna8561117166109762441.dll
C:\Users\Heiko\AppData\Local\Temp\jna8899161736838149126.dll
C:\Users\Heiko\AppData\Local\Temp\libcurl-4.dll
C:\Users\Heiko\AppData\Local\Temp\pthreadGC2.dll
C:\Users\Heiko\AppData\Local\Temp\SDL_1.dll
C:\Users\Heiko\AppData\Local\Temp\SDL_2.dll
C:\Users\Heiko\AppData\Local\Temp\SDL_3.dll
C:\Users\Heiko\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Heiko\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Heiko\AppData\Local\Temp\zlib1.dll
C:\Users\Julien\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Julien\AppData\Local\Temp\Softonic_DE_1-5-1.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-29 17:49
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-02-2014
Ran by Admin at 2014-02-08 03:16:38
Running from C:\Users\Admin\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
À plus! 1 Vokabeltrainer interaktiv (x32 Version: 1.0.0.0 - Cornelsen Verlag)
AC-3 ACM Codec x64 2.2 (Version: 2.2 - fccHandler)
Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.71219.1540 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
Ausnahmen (Version: - )
Ausnahmen64 (Version: - )
AutoIt v3.3.8.1 (x32 Version: - AutoIt Team)
avast! Free Antivirus (x32 Version: 9.0.2008 - Avast Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CloudReading (x32 Version: 1.0.31.1111 - Foxit Corporation)
Core Temp 1.0 RC5 (Version: 1.0 - Alcpu)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diablo II (x32 Version: - Blizzard Entertainment)
Diablo III (x32 Version: 1.0.8.16603 - Blizzard Entertainment)
DVDFab Passkey 8.1.0.1 (26/06/2013) (x32 Version: - Fengtao Software Inc.)
Facebook Video Calling 2.0.0.447 (x32 Version: 2.0.447 - Skype Limited)
Foxit Reader (x32 Version: 6.1.1.1031 - Foxit Corporation)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
K-Lite Mega Codec Pack 9.3.0 (x32 Version: 9.3.0 - )
Lame ACM MP3 Codec (Version: - )
Lame ACM MP3 Codec (x32 Version: - )
LAME v3.99.3 (for Windows) (x32 Version: - )
Link Shell Extension (Version: 3.7.1.9 - Hermann Schinagl)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Messenger Plus! for Skype (x32 Version: 2.0.0.150 - Yuna Software)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Compatibility Toolkit 5.6 (x32 Version: 5.6.7324.0 - Microsoft Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
No23 Recorder (x32 Version: 2.1.0.3 - No23)
Oracle VM VirtualBox 4.0.16 (Version: 4.0.16 - Oracle Corporation)
phase-6 2.3.3 (x32 Version: 2.3.3 - phase-6)
Pokémon Trading Card Game Online (x32 Version: 1.0.0 - The Pokémon Company International)
Realtek Ethernet Controller Driver (x32 Version: 7.46.610.2011 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6449 - Realtek Semiconductor Corp.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Sophos Virus Removal Tool (x32 Version: 2.4 - Sophos Limited)
Starbound (x32 Version: - )
Steam (x32 Version: - Valve Corporation)
Super User Run (SuRun) (Version: 1.2.1.0 - Kay Bruns)
TeamViewer 8 (x32 Version: 8.0.22298 - TeamViewer)
TightVNC (Version: 2.7.10.0 - GlavSoft LLC.)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
x264vfw - H.264/MPEG-4 AVC codec (remove only) (x32 Version: - )
XBMC (HKCU Version: - Team XBMC)
==================== Restore Points =========================
24-01-2014 15:25:49 Windows Update
28-01-2014 21:09:29 Windows Update
02-02-2014 19:56:44 DirectX wurde installiert
04-02-2014 11:32:50 Windows Update
05-02-2014 09:18:03 Installed Oracle VM VirtualBox 4.0.16
07-02-2014 20:31:17 Windows Update
07-02-2014 23:38:45 Installed Sophos Virus Removal Tool.
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {46D76E1C-8771-4E1C-9BBA-3FF274C05193} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-11-27] (AVAST Software)
Task: {55944064-FDE1-4F63-9305-AD5A84F33076} - System32\Tasks\{F218FF9C-718E-418F-8DFA-5C955E6FDC81} => C:\Program Files (x86)\phase-6\phase-6\phase-6.exe [2013-06-21] (phase-6)
Task: {6166713D-ECD1-4EF7-A763-54F41BB9A50E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA => C:\Users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-05] (Facebook Inc.)
Task: {8AFDF409-76A9-4980-BB04-6E1991ADEF08} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core => C:\Users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-05] (Facebook Inc.)
Task: {B17C2AD9-B4CD-43EB-94F3-A85840D059F6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-04] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core.job => C:\Users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA.job => C:\Users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job => C:\Program Files (x86)\XMediaGrabber\XMGTimerStartupScheduler.exe
==================== Loaded Modules (whitelisted) =============
2004-09-30 19:15 - 2004-09-30 19:15 - 00192000 _____ () C:\Program Files\LinkShellExtension\RockallDLL.dll
2012-12-19 15:32 - 2012-12-19 15:32 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-02-07 20:14 - 2014-02-07 19:49 - 02171904 _____ () C:\Program Files\AVAST Software\Avast\defs\14020701\algo.dll
2013-11-27 22:44 - 2013-11-27 22:44 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-12-20 07:16 - 2013-12-20 07:16 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\temp:1011F76C.dat
AlternateDataStreams: C:\temp:1319E5C0.dat
AlternateDataStreams: C:\temp:1A00BB4B.dat
AlternateDataStreams: C:\temp:list
AlternateDataStreams: C:\temp:pid1
AlternateDataStreams: C:\temp:pid2
AlternateDataStreams: C:\temp:srv
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/08/2014 03:07:09 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/08/2014 02:05:22 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/08/2014 01:19:26 AM) (Source: Application Hang) (User: )
Description: Programm 9638489.exe, Version 11.0.0.1245 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: a60
Startzeit: 01cf24616e46c4e3
Endzeit: 16
Anwendungspfad: C:\Users\Heiko\AppData\Local\Temp\5151293\9638489.exe
Berichts-ID: a42eaf03-9056-11e3-b8c5-8c89a583a54a
Error: (02/08/2014 00:48:17 AM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (02/08/2014 00:06:58 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/07/2014 11:51:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/07/2014 11:48:53 PM) (Source: MsgPlusService) (User: )
Description: MsgPlusServiceService failed to shut down.
Error: (02/07/2014 11:48:53 PM) (Source: MsgPlusService) (User: )
Description: MsgPlusServiceReceiving shutdown message.
Error: (02/07/2014 11:15:29 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FreeCommander.exe, Version: 0.0.0.609, Zeitstempel: 0x50b8d9df
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0xa8000002
ID des fehlerhaften Prozesses: 0x2a78
Startzeit der fehlerhaften Anwendung: 0xFreeCommander.exe0
Pfad der fehlerhaften Anwendung: FreeCommander.exe1
Pfad des fehlerhaften Moduls: FreeCommander.exe2
Berichtskennung: FreeCommander.exe3
Error: (02/07/2014 06:41:12 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
System errors:
=============
Error: (02/03/2014 02:38:48 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR7 gefunden.
Error: (02/03/2014 02:38:48 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR7 gefunden.
Error: (02/02/2014 08:45:18 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 11.
Error: (02/02/2014 08:44:54 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (02/02/2014 08:13:19 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/02/2014 08:13:19 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
Error: (02/02/2014 02:01:35 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR6 gefunden.
Error: (02/02/2014 02:01:33 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR6 gefunden.
Error: (01/16/2014 03:22:15 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x80080005
Error: (01/16/2014 03:22:15 AM) (Source: DCOM) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Microsoft Office Sessions:
=========================
Error: (02/08/2014 03:07:09 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/08/2014 02:05:22 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/08/2014 01:19:26 AM) (Source: Application Hang)(User: )
Description: 9638489.exe11.0.0.1245a6001cf24616e46c4e316C:\Users\Heiko\AppData\Local\Temp\5151293\9638489.exea42eaf03-9056-11e3-b8c5-8c89a583a54a
Error: (02/08/2014 00:48:17 AM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (02/08/2014 00:06:58 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/07/2014 11:51:28 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/07/2014 11:48:53 PM) (Source: MsgPlusService)(User: )
Description: MsgPlusServiceService failed to shut down.
Error: (02/07/2014 11:48:53 PM) (Source: MsgPlusService)(User: )
Description: MsgPlusServiceReceiving shutdown message.
Error: (02/07/2014 11:15:29 PM) (Source: Application Error)(User: )
Description: FreeCommander.exe0.0.0.60950b8d9dfunknown0.0.0.000000000c0000005a80000022a7801cf21147786fa0cD:\PortableApps\FreeCommanderXE\FreeCommander.exeunknown59e87a16-9045-11e3-a710-8c89a583a54a
Error: (02/07/2014 06:41:12 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
==================== Memory info ===========================
Percentage of memory in use: 22%
Total physical RAM: 7669.41 MB
Available physical RAM: 5937.38 MB
Total Pagefile: 15337 MB
Available Pagefile: 13348.44 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:293.79 GB) (Free:214.67 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:1275.44 GB) (Free:1012.74 GB) NTFS
Drive e: (Iomega HDD) (Fixed) (Total:931.51 GB) (Free:430.46 GB) NTFS
Drive o: (DRIVE-N-GO) (Fixed) (Total:465.76 GB) (Free:45.41 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 183DAD37)
Partition 1: (Active) - (Size=294 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-514082872832) - (Type=OF Extended)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 932 GB) (Disk ID: CBCE2081)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
========================================================
Disk: 6 (Size: 466 GB) (Disk ID: 9288BBD1)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
08.02.2014, 10:08
| #2 | |
| /// the machine /// TB-Ausbilder    | Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
08.02.2014, 11:44
| #3 |
| | Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? Hallo Schrauber,
__________________hier das Log von Combofix: Code:
ATTFilter ComboFix 14-02-05.02 - Admin 08.02.2014 11:11:10.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.7669.6010 [GMT 1:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Admin\AppData\Local\lame_enc.dll
c:\users\Admin\AppData\Local\no23xwrapper.dll
c:\users\Admin\AppData\Local\ogg.dll
c:\users\Admin\AppData\Local\vorbis.dll
c:\users\Admin\AppData\Local\vorbisenc.dll
c:\users\Admin\AppData\Local\vorbisfile.dll
d:\portableapps\PStart\PStart.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-01-08 bis 2014-02-08 ))))))))))))))))))))))))))))))
.
.
2014-02-08 10:19 . 2014-02-08 10:19 -------- d-----w- c:\users\Julien\AppData\Local\temp
2014-02-08 10:19 . 2014-02-08 10:19 -------- d-----w- c:\users\Jeremy\AppData\Local\temp
2014-02-08 10:19 . 2014-02-08 10:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-08 10:19 . 2014-02-08 10:19 -------- d-----w- c:\users\Heiko\AppData\Local\temp
2014-02-08 02:15 . 2014-02-08 02:17 -------- d-----w- C:\FRST
2014-02-08 01:52 . 2014-02-08 01:52 -------- d-----w- c:\users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 01:52 . 2014-02-08 01:52 -------- d-----w- c:\programdata\Malwarebytes
2014-02-08 01:52 . 2014-02-08 01:52 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2014-02-08 01:52 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-02-08 00:05 . 2014-02-08 00:05 -------- d-----w- c:\programdata\Kaspersky Lab
2014-02-07 23:39 . 2014-02-07 23:39 -------- d-----w- c:\programdata\Sophos
2014-02-07 23:39 . 2014-02-07 23:39 73728 ----a-r- c:\users\Heiko\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe1_810EDD9E2F0A4E2BACF86673C38D9F48.exe
2014-02-07 23:39 . 2014-02-07 23:39 73728 ----a-r- c:\users\Heiko\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe_810EDD9E2F0A4E2BACF86673C38D9F48.exe
2014-02-07 23:39 . 2014-02-07 23:39 73728 ----a-r- c:\users\Heiko\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\ARPPRODUCTICON.exe
2014-02-07 23:39 . 2014-02-07 23:39 -------- d-----w- c:\program files (x86)\Sophos
2014-02-07 22:27 . 2014-02-07 22:27 -------- d-----w- c:\users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 20:31 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E5A589F3-ECFB-402F-8037-5C6AB3177B37}\mpengine.dll
2014-02-05 23:33 . 2014-02-08 01:02 -------- d---a-w- C:\temp
2014-02-05 09:25 . 2014-02-05 09:25 -------- d-----w- c:\users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 09:20 . 2014-02-07 18:58 -------- d-----w- c:\programdata\Sirrix AG
2014-02-05 09:18 . 2011-12-21 12:15 219440 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2014-02-05 09:18 . 2011-12-21 12:15 44848 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2014-02-05 09:18 . 2014-02-05 09:18 -------- d-----w- c:\program files\Oracle
2014-02-03 14:11 . 2014-02-03 14:12 -------- d-----w- c:\users\Jamie
2014-02-03 13:07 . 2014-02-03 13:07 -------- d-----w- c:\users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 19:57 . 2008-03-05 15:03 238088 ----a-w- c:\windows\SysWow64\xactengine3_0.dll
2014-02-02 19:09 . 2014-02-02 20:41 -------- d-----w- c:\program files (x86)\Common Files\Steam
2014-02-02 19:09 . 2014-02-07 23:49 -------- d-----w- c:\program files (x86)\Steam
2014-01-15 16:55 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 16:55 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 16:55 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 16:55 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 16:55 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 16:55 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 16:55 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 16:55 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-01-15 16:55 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2014-01-14 15:34 . 2014-01-14 15:34 -------- d-----w- c:\users\Admin\AppData\Roaming\AVAST Software
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-04 21:26 . 2013-02-20 06:36 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-04 21:26 . 2013-02-20 06:36 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-16 02:00 . 2013-02-20 06:37 86054176 ----a-w- c:\windows\system32\MRT.exe
2013-12-18 05:13 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-11-27 21:44 . 2013-04-24 18:13 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-11-27 21:44 . 2013-04-24 18:13 205320 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-11-27 21:44 . 2013-02-20 08:25 409832 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-11-27 21:44 . 2013-02-20 08:25 38984 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-11-27 21:44 . 2013-02-20 08:25 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-11-27 21:44 . 2013-02-20 08:25 65264 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-11-27 21:44 . 2013-02-20 08:25 1032416 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-11-27 21:44 . 2013-02-20 08:25 84328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-11-27 21:44 . 2013-02-20 08:25 334648 ----a-w- c:\windows\system32\aswBoot.exe
2013-11-27 21:44 . 2013-02-20 08:19 43152 ----a-w- c:\windows\avastSS.scr
2013-11-26 11:54 . 2013-12-13 02:01 23183360 ----a-w- c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-13 02:01 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-13 02:01 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-13 02:01 66048 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-13 02:01 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-13 02:01 2764288 ----a-w- c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-13 02:01 53760 ----a-w- c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-13 02:01 33792 ----a-w- c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-13 02:01 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-13 02:01 574976 ----a-w- c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-13 02:01 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-13 02:01 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-13 02:01 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-13 02:01 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-13 02:01 5769216 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-13 02:01 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-13 02:01 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-13 02:01 1995264 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-13 02:01 12996608 ----a-w- c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-13 02:01 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-13 02:01 2334208 ----a-w- c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-13 02:01 1395200 ----a-w- c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-13 02:01 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-13 02:01 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2013-11-23 18:26 . 2013-12-12 03:27 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 03:27 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-13 02:02 . 2013-11-13 02:02 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-13 02:02 . 2013-11-13 02:02 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-13 02:02 . 2013-11-13 02:02 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-13 02:02 . 2013-11-13 02:02 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-13 02:02 . 2013-11-13 02:02 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-13 02:02 . 2013-11-13 02:02 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-13 02:02 . 2013-11-13 02:02 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-13 02:02 . 2013-11-13 02:02 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-13 02:02 . 2013-11-13 02:02 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-13 02:02 . 2013-11-13 02:02 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-13 02:02 . 2013-11-13 02:02 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-13 02:02 . 2013-11-13 02:02 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-13 02:02 . 2013-11-13 02:02 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-13 02:02 . 2013-11-13 02:02 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-13 02:02 . 2013-11-13 02:02 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-13 02:02 . 2013-11-13 02:02 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-13 02:02 . 2013-11-13 02:02 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-13 02:02 . 2013-11-13 02:02 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-13 02:02 . 2013-11-13 02:02 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-13 02:02 . 2013-11-13 02:02 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-13 02:02 . 2013-11-13 02:02 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-11-13 02:02 . 2013-11-13 02:02 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-13 02:02 . 2013-11-13 02:02 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-13 02:02 . 2013-11-13 02:02 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-13 02:02 . 2013-11-13 02:02 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-13 02:02 . 2013-11-13 02:02 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-13 02:02 . 2013-11-13 02:02 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-13 02:02 . 2013-11-13 02:02 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-13 02:02 . 2013-11-13 02:02 413696 ----a-w- c:\windows\system32\html.iec
2013-11-13 02:02 . 2013-11-13 02:02 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-13 02:02 . 2013-11-13 02:02 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-13 02:02 . 2013-11-13 02:02 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-13 02:02 . 2013-11-13 02:02 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-13 02:02 . 2013-11-13 02:02 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-13 02:02 . 2013-11-13 02:02 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-13 02:02 . 2013-11-13 02:02 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-13 02:02 . 2013-11-13 02:02 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-13 02:02 . 2013-11-13 02:02 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-13 02:02 . 2013-11-13 02:02 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-13 02:02 . 2013-11-13 02:02 235520 ----a-w- c:\windows\system32\url.dll
2013-11-13 02:02 . 2013-11-13 02:02 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-13 02:02 . 2013-11-13 02:02 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-13 02:02 . 2013-11-13 02:02 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-13 02:02 . 2013-11-13 02:02 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-13 02:02 . 2013-11-13 02:02 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-13 02:02 . 2013-11-13 02:02 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-13 02:02 . 2013-11-13 02:02 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-13 02:02 . 2013-11-13 02:02 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-13 02:02 . 2013-11-13 02:02 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-13 02:02 . 2013-11-13 02:02 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-13 02:02 . 2013-11-13 02:02 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-13 02:02 . 2013-11-13 02:02 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-13 02:02 . 2013-11-13 02:02 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-13 02:02 . 2013-11-13 02:02 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-13 02:02 . 2013-11-13 02:02 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-13 02:02 . 2013-11-13 02:02 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-13 02:02 . 2013-11-13 02:02 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-13 02:02 . 2013-11-13 02:02 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-13 02:02 . 2013-11-13 02:02 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-12 02:23 . 2013-12-12 03:26 2048 ----a-w- c:\windows\system32\tzres.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-11-27 3568312]
.
c:\users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Core Temp.lnk - c:\program files\Core Temp\Core Temp.exe [2013-7-6 856016]
PortableAppsPlatform.exe - Verknüpfung.lnk - c:\portableapps\PortableApps.com\PortableAppsPlatform.exe [2013-2-23 2713672]
XMediaGrabber.lnk - c:\program files (x86)\XMediaGrabber\XMediaGrabber.exe [2013-2-22 37888]
.
c:\users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\
FreeNFS.lnk - d:\portableapps\FreeNFS\FreeNFS.exe [2013-7-25 498176]
SynkronPortable.lnk - c:\portableapps\SynkronPortable\SynkronPortable.exe [2011-3-16 134776]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.130\SSScheduler.exe [2013-9-6 324320]
phase-6 Reminder.lnk - c:\program files (x86)\phase-6\phase-6\reminder\reminder.exe [2013-6-21 724992]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\
Core Temp.lnk - c:\program files\Core Temp\Core Temp.exe [2013-7-6 856016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SmartDefragBootTime.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 ALSysIO;ALSysIO;c:\users\Admin\AppData\Local\Temp\ALSysIO64.sys;c:\users\Admin\AppData\Local\Temp\ALSysIO64.sys [x]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 MsgPlusService;Messenger Plus! Service;c:\program files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe;c:\program files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [x]
R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R4 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
R4 tvnserver;TightVNC Server;c:\program files\TightVNC\tvnserver.exe;c:\program files\TightVNC\tvnserver.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys;c:\windows\SYSNATIVE\drivers\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 SuRunSVC;Super User Run (SuRun) Service;c:\windows\SuRun.exe;c:\windows\SuRun.exe [x]
S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\amdhub30.sys;c:\windows\SYSNATIVE\DRIVERS\amdhub30.sys [x]
S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\amdxhc.sys;c:\windows\SYSNATIVE\DRIVERS\amdxhc.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 dvdfab;dvdfab;c:\windows\system32\drivers\dvdfab.sys;c:\windows\SYSNATIVE\drivers\dvdfab.sys [x]
S3 MsgPlusDriver;Messenger Plus! Virtual Camera;c:\windows\system32\DRIVERS\MsgPlusDriver.sys;c:\windows\SYSNATIVE\DRIVERS\MsgPlusDriver.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-20 21:26]
.
2014-02-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core.job
- c:\users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-05 07:37]
.
2014-02-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA.job
- c:\users\Julien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-05 07:37]
.
2014-02-07 c:\windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
- c:\program files (x86)\XMediaGrabber\XMGTimerStartupScheduler.exe [2013-02-22 12:40]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-11-27 21:44 326944 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HardLinkMenu]
@="{0A479751-02BC-11d3-A855-0004AC2568AA}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568AA}]
2012-05-27 19:50 522440 ----a-w- c:\program files\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHardLink]
@="{0A479751-02BC-11d3-A855-0004AC2568DD}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568DD}]
2012-05-27 19:50 522440 ----a-w- c:\program files\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlaySymbolicLink]
@="{0A479751-02BC-11d3-A855-0004AC2568EE}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568EE}]
2012-05-27 19:50 522440 ----a-w- c:\program files\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-08-30 7284328]
"fssui"="c:\program files (x86)\Windows Live\Family Safety\fsui.exe" [2012-09-12 892416]
"SuRun Systemmenü-Erweiterung"="c:\windows\SuRun.exe" [2013-07-03 727552]
"tvncontrol"="c:\program files\TightVNC\tvnserver.exe" [2013-07-19 2179056]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{2C7B6088-5A77-4d48-BE43-30337DCA9A86}"= "SuRunExt.dll" [2013-07-03 189952]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: Interfaces\{57F85748-9E1C-49A3-89C9-3715B55FD919}: NameServer = 192.168.1.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
c:\users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PStart - Verknüpfung.lnk - d:\portableapps\PStart\PStart.exe
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PStart - Verknüpfung.lnk - d:\portableapps\PStart\PStart.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-02-08 11:24:05
ComboFix-quarantined-files.txt 2014-02-08 10:24
.
Vor Suchlauf: 15 Verzeichnis(se), 229.847.916.544 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 230.975.238.144 Bytes frei
.
- - End Of File - - B10931FE20B238A09E8E93CB99F96A17
A36C5E4F47E84449FF07ED3517B43A31
|
|
09.02.2014, 08:48
| #4 |
| /// the machine /// TB-Ausbilder | Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.02.2014, 15:56
| #5 |
| | Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? Hier die gewünschten Logs: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.09.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Admin :: VINCENTS-PC [Administrator] 09.02.2014 15:03:36 mbam-log-2014-02-09 (15-03-36).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 314798 Laufzeit: 4 Minute(n), 12 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v3.018 - Bericht erstellt am 09/02/2014 um 15:15:20
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Admin - VINCENTS-PC
# Gestartet von : C:\Users\Admin\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Datei Gelöscht : C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\bxj6o4g7.default-1366913149784\Extensions\browserprotect@browserprotect.com.xpi
Datei Gelöscht : C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.default2\Extensions\browserprotect@browserprotect.com.xpi
Datei Gelöscht : C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\bxj6o4g7.default-1366913149784\searchplugins\bingp.xml
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\smartbar
Schlüssel Gelöscht : HKLM\Software\Freeze.com
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\prefs.js ]
[ Datei : C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\bxj6o4g7.default-1366913149784\prefs.js ]
Zeile gelöscht : user_pref("extensions.browserprotect.searchProviderExceptions", "hxxp://en.wikipedia.org/wiki/Special:Search;hxxp://search.yahoo.com/search;hxxp://www.amazon.com/exec/obidos/external-search/;hxxp://ww[...]
[ Datei : C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.default2\prefs.js ]
Zeile gelöscht : user_pref("browser.search.defaultenginename", "QIP Search");
Zeile gelöscht : user_pref("extensions.browserprotect.searchProviderExceptions", "hxxp://en.wikipedia.org/wiki/Special:Search;hxxp://search.yahoo.com/search;hxxp://www.amazon.com/exec/obidos/external-search/;hxxp://ww[...]
Zeile gelöscht : user_pref("extensions.browserprotect.urlBarEngine", "hxxp://search.qip.ru/search?from=FF&query=");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.qip.ru/search?from=FF&query=");
[ Datei : C:\Users\Jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\pwb30e1g.default\prefs.js ]
[ Datei : C:\Users\Julien\AppData\Roaming\Mozilla\Firefox\Profiles\j4ewmmn2.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [2575 octets] - [09/02/2014 15:11:45]
AdwCleaner[S0].txt - [2500 octets] - [09/02/2014 15:15:20]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2560 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Home Premium x64
Ran by Admin on 09.02.2014 at 15:29:53,95
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
Successfully stopped: [Service] msgplusservice
Successfully deleted: [Service] msgplusservice
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{37211D63-CCE9-4780-B182-96538CFC6FED}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{8B9C4F32-044E-491C-893E-362CB8A679D5}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CBC3E05C-F841-452A-A600-E8D8BBEA63D9}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CBC3E05D-F841-452A-A600-E8D8BBEA63DA}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CF2BF214-9D1E-4803-9AEB-38552615FD40}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\yuna software
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\msgplusforskype.animationpackage
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\msgplusforskype.skinpack
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\msgplusforskype.soundpack
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\plusskypeservice_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\messenger plus! for skype
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\messenger plus! for skype"
Successfully deleted: [Folder] "C:\Users\Admin\appdata\local\cre"
Successfully deleted: [Folder] "C:\Program Files (x86)\yuna software"
~~~ FireFox
Emptied folder: C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\k9c3t3zj.default\minidumps [6 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.02.2014 at 15:38:01,87
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-02-2014
Ran by Admin (administrator) on VINCENTS-PC on 09-02-2014 15:47:04
Running from C:\Users\Admin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun32.bin
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7284328 2011-08-30] (Realtek Semiconductor)
HKLM\...\Run: [fssui] - C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [892416 2012-09-12] (Microsoft Corporation)
HKLM\...\Run: [SuRun Systemmenü-Erweiterung] - C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
HKLM\...\Run: [tvncontrol] - C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-27] (AVAST Software)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.lnk
ShortcutTarget: Core Temp.lnk -> C:\Program Files\Core Temp\Core Temp.exe ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PortableAppsPlatform.exe - Verknüpfung.lnk
ShortcutTarget: PortableAppsPlatform.exe - Verknüpfung.lnk -> C:\PortableApps\PortableApps.com\PortableAppsPlatform.exe (PortableApps.com)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XMediaGrabber.lnk
ShortcutTarget: XMediaGrabber.lnk -> C:\Program Files (x86)\XMediaGrabber\XMediaGrabber.exe (hxxp://www.xmediagrabber.de)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x163759EBE10ECE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0F4C14C4-945D-4990-9388-A3C7A2E9336F} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKLM-x32 - {94AE0E02-5D76-4244-8B5F-783BD0CA7D76} URL = hxxp://www.bing.com/?cc=de
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: No Name - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks: SuRun Shell Extension - {2C7B6088-5A77-4d48-BE43-30337DCA9A86} - C:\Windows\SuRunExt.dll [189952 2013-07-03] (hxxp://kay-bruns.de)
Tcpip\..\Interfaces\{57F85748-9E1C-49A3-89C9-3715B55FD919}: [NameServer]192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NoScript - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-08]
FF Extension: Adblock Plus - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-08]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-02-20]
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-27] (AVAST Software)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 SuRunSVC; C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
S4 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-27] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-27] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-27] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-27] ()
R3 dvdfab; C:\Windows\System32\drivers\dvdfab.sys [79232 2011-08-15] (Fengtao Software Inc.)
R3 MsgPlusDriver; C:\Windows\System32\DRIVERS\MsgPlusDriver.sys [125392 2013-05-07] (Yune Software)
S3 ALSysIO; \??\C:\Users\Admin\AppData\Local\Temp\ALSysIO64.sys [X]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-09 15:47 - 2014-02-09 15:47 - 00011301 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-09 15:44 - 2014-02-09 15:44 - 00000000 ____D () C:\Users\Admin\Downloads\FRST-OlderVersion
2014-02-09 15:38 - 2014-02-09 15:38 - 00002209 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-02-09 15:29 - 2014-02-09 15:29 - 00000000 ____D () C:\Windows\ERUNT
2014-02-09 15:28 - 2014-02-09 15:28 - 01037530 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2014-02-09 15:11 - 2014-02-09 15:15 - 00000000 ____D () C:\AdwCleaner
2014-02-09 15:10 - 2014-02-09 15:10 - 01166132 _____ () C:\Users\Admin\Downloads\adwcleaner.exe
2014-02-09 02:31 - 2014-02-09 02:31 - 10779656 ____N (Marek Jasinski) C:\Users\Admin\Downloads\SandboxFreeCommander.cameyo.exe
2014-02-08 21:24 - 2014-02-08 21:24 - 00001142 _____ () C:\Users\Admin\Desktop\FreeCommander - Verknüpfung.lnk
2014-02-08 20:54 - 2014-02-08 20:54 - 00000000 ____D () C:\Users\Admin\Downloads\Jamie
2014-02-08 20:52 - 2014-02-08 20:52 - 00000000 ____D () C:\Users\Admin\Downloads\Jeremy
2014-02-08 20:29 - 2014-02-08 20:30 - 00000000 ____D () C:\Users\Admin\Downloads\Julien
2014-02-08 18:31 - 2014-02-08 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Local\Cameyo
2014-02-08 18:24 - 2014-02-08 19:05 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\VOS
2014-02-08 18:19 - 2014-02-08 18:20 - 18807821 _____ (Cameyo) C:\Users\Admin\Downloads\Cameyo.exe
2014-02-08 11:24 - 2014-02-08 11:24 - 00028654 _____ () C:\ComboFix.txt
2014-02-08 11:08 - 2014-02-08 11:24 - 00000000 ____D () C:\Qoobox
2014-02-08 11:08 - 2014-02-08 11:22 - 00000000 ____D () C:\Windows\erdnt
2014-02-08 11:08 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-08 11:08 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-08 11:08 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-08 11:04 - 2014-02-08 11:04 - 05180173 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-02-08 05:10 - 2014-02-08 05:10 - 589632224 _____ () C:\Windows\MEMORY.DMP
2014-02-08 05:10 - 2014-02-08 05:10 - 00455520 _____ () C:\Windows\Minidump\020814-14726-01.dmp
2014-02-08 03:26 - 2014-02-08 03:26 - 00380416 _____ () C:\Users\Admin\Downloads\2euv8v11.exe
2014-02-08 03:15 - 2014-02-09 15:47 - 00000000 ____D () C:\FRST
2014-02-08 03:14 - 2014-02-09 15:44 - 02170368 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:52 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-08 02:47 - 2014-02-08 02:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:33 - 2014-02-08 00:37 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:32 - 2014-02-08 00:41 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 20:18 - 2014-02-08 00:12 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:20 - 2014-02-07 19:58 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 10:18 - 2011-12-21 13:15 - 00219440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2014-02-05 10:18 - 2011-12-21 13:15 - 00044848 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:11 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 15:11 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-02-03 15:11 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 20:58 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2014-02-02 20:58 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2014-02-02 20:58 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2014-02-02 20:57 - 2014-02-02 20:58 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:57 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2014-02-02 20:57 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2014-02-02 20:57 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-02-02 20:57 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-02-02 20:57 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-02-02 20:57 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-02-02 20:57 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-02-02 20:57 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-02-02 20:57 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-02-02 20:57 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-02-02 20:57 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-02-02 20:57 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-08 00:49 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:07 - 2014-02-02 20:08 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-01-17 06:11 - 2014-01-17 06:12 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:11 - 2014-01-17 06:12 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:11 - 2014-01-17 06:12 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-15 17:55 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 17:55 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 17:55 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software
==================== One Month Modified Files and Folders =======
2014-02-09 15:47 - 2014-02-09 15:47 - 00011301 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-09 15:47 - 2014-02-08 03:15 - 00000000 ____D () C:\FRST
2014-02-09 15:46 - 2013-04-22 19:37 - 00000680 __RSH () C:\Users\Admin\ntuser.pol
2014-02-09 15:46 - 2013-02-19 21:23 - 00000000 ____D () C:\Users\Admin
2014-02-09 15:45 - 2013-03-30 01:05 - 00039317 _____ () C:\Windows\setupact.log
2014-02-09 15:45 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-09 15:44 - 2014-02-09 15:44 - 00000000 ____D () C:\Users\Admin\Downloads\FRST-OlderVersion
2014-02-09 15:44 - 2014-02-08 03:14 - 02170368 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-09 15:44 - 2013-02-19 19:18 - 01453937 _____ () C:\Windows\WindowsUpdate.log
2014-02-09 15:38 - 2014-02-09 15:38 - 00002209 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-02-09 15:29 - 2014-02-09 15:29 - 00000000 ____D () C:\Windows\ERUNT
2014-02-09 15:29 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-09 15:29 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-09 15:28 - 2014-02-09 15:28 - 01037530 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2014-02-09 15:26 - 2013-02-20 07:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-09 15:15 - 2014-02-09 15:11 - 00000000 ____D () C:\AdwCleaner
2014-02-09 15:10 - 2014-02-09 15:10 - 01166132 _____ () C:\Users\Admin\Downloads\adwcleaner.exe
2014-02-09 13:18 - 2013-04-16 18:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\Windows Live
2014-02-09 13:18 - 2013-02-20 09:25 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-09 02:31 - 2014-02-09 02:31 - 10779656 ____N (Marek Jasinski) C:\Users\Admin\Downloads\SandboxFreeCommander.cameyo.exe
2014-02-08 21:24 - 2014-02-08 21:24 - 00001142 _____ () C:\Users\Admin\Desktop\FreeCommander - Verknüpfung.lnk
2014-02-08 20:54 - 2014-02-08 20:54 - 00000000 ____D () C:\Users\Admin\Downloads\Jamie
2014-02-08 20:52 - 2014-02-08 20:52 - 00000000 ____D () C:\Users\Admin\Downloads\Jeremy
2014-02-08 20:30 - 2014-02-08 20:29 - 00000000 ____D () C:\Users\Admin\Downloads\Julien
2014-02-08 19:05 - 2014-02-08 18:24 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\VOS
2014-02-08 18:31 - 2014-02-08 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Local\Cameyo
2014-02-08 18:20 - 2014-02-08 18:19 - 18807821 _____ (Cameyo) C:\Users\Admin\Downloads\Cameyo.exe
2014-02-08 11:38 - 2013-04-05 04:12 - 00027990 _____ () C:\Windows\PFRO.log
2014-02-08 11:24 - 2014-02-08 11:24 - 00028654 _____ () C:\ComboFix.txt
2014-02-08 11:24 - 2014-02-08 11:08 - 00000000 ____D () C:\Qoobox
2014-02-08 11:22 - 2014-02-08 11:08 - 00000000 ____D () C:\Windows\erdnt
2014-02-08 11:22 - 2013-02-22 19:02 - 00000000 ___RD () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 11:22 - 2013-02-19 21:23 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 11:21 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-08 11:04 - 2014-02-08 11:04 - 05180173 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-02-08 05:10 - 2014-02-08 05:10 - 589632224 _____ () C:\Windows\MEMORY.DMP
2014-02-08 05:10 - 2014-02-08 05:10 - 00455520 _____ () C:\Windows\Minidump\020814-14726-01.dmp
2014-02-08 05:10 - 2013-03-25 07:31 - 00000000 ____D () C:\Windows\Minidump
2014-02-08 03:26 - 2014-02-08 03:26 - 00380416 _____ () C:\Users\Admin\Downloads\2euv8v11.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:48 - 2014-02-08 02:47 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 02:10 - 2013-02-20 08:04 - 00000000 ____D () C:\Users\Admin\AppData\Local\Mozilla
2014-02-08 02:03 - 2013-08-05 08:37 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA.job
2014-02-08 02:03 - 2013-08-05 08:37 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core.job
2014-02-08 01:58 - 2013-08-05 08:37 - 00003918 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA
2014-02-08 01:58 - 2013-08-05 08:37 - 00003550 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:49 - 2014-02-02 20:09 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-08 00:41 - 2014-02-08 00:32 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:37 - 2014-02-08 00:33 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:12 - 2014-02-07 20:18 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-08 00:12 - 2013-08-16 19:19 - 00000000 ____D () C:\Users\Heiko\.xmg
2014-02-08 00:12 - 2013-04-16 18:21 - 00000680 __RSH () C:\Users\Heiko\ntuser.pol
2014-02-08 00:12 - 2013-02-22 19:01 - 00000000 ____D () C:\Users\Heiko
2014-02-07 23:41 - 2013-02-24 22:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\XBMC
2014-02-07 23:32 - 2013-08-25 00:42 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:17 - 2013-12-22 14:59 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\Skype
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 21:13 - 2013-04-16 18:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Windows Live
2014-02-07 19:58 - 2014-02-05 10:20 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-07 09:48 - 2013-08-29 17:05 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{12489FB2-B57C-4A9C-8F29-2291A874BC82}
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 08:01 - 2013-12-20 07:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-04 22:26 - 2013-02-20 07:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 22:26 - 2013-02-20 07:36 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 22:26 - 2013-02-20 07:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 19:28 - 2013-04-22 19:35 - 00022330 __RSH () C:\Users\Julien\ntuser.pol
2014-02-03 19:28 - 2013-04-22 19:35 - 00000000 ____D () C:\Users\Julien
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:12 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 21:40 - 2013-04-16 18:26 - 00004682 __RSH () C:\Users\Jeremy\ntuser.pol
2014-02-02 21:40 - 2013-02-28 18:40 - 00000000 ____D () C:\Users\Jeremy
2014-02-02 20:58 - 2014-02-02 20:57 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:08 - 2014-02-02 20:07 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-02-02 19:45 - 2013-03-17 21:09 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\.minecraft
2014-02-01 08:52 - 2013-04-22 19:37 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\.minecraft
2014-01-25 19:44 - 2013-11-16 21:58 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Skype
2014-01-17 06:12 - 2014-01-17 06:11 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:12 - 2014-01-17 06:11 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:12 - 2014-01-17 06:11 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 20:18 - 2010-11-21 07:50 - 00697160 _____ () C:\Windows\system32\perfh007.dat
2014-01-16 20:18 - 2010-11-21 07:50 - 00148642 _____ () C:\Windows\system32\perfc007.dat
2014-01-16 20:18 - 2009-07-14 06:13 - 01613340 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-16 03:19 - 2009-07-14 05:45 - 00276968 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:03 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-16 03:00 - 2013-02-20 07:37 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-14 14:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-14 12:25 - 2013-02-20 08:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-08 05:39
==================== End Of Log ============================
--- --- --- |
|
10.02.2014, 10:15
| #6 |
| /// the machine /// TB-Ausbilder | Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet?ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? |
|
11.02.2014, 08:23
| #7 |
| | Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? Hallo Schrauber, hier die Logs der letzten Nacht: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=7df079b1324f2d4f920512ea0694230c
# engine=17018
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-10 11:27:56
# local_time=2014-02-11 12:27:56 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 83 6486091 168781148 0 0
# compatibility_mode=5893 16776573 100 94 119244 143704726 0 0
# scanned=634425
# found=6
# cleaned=0
# scan_time=14999
sh=0A7A819A37F7DECC122BEE248C22D6F7E4F38B57 ft=1 fh=a37716ba891ceb75 vn="Win32/CoinMiner.KX trojan" ac=I fn="C:\temp:1011F76C.dat"
sh=293E9FD449441B6157F4253B14BC1C4FE6B20394 ft=1 fh=a37716ba6f24d9f4 vn="a variant of Win32/Injector.AXBQ trojan" ac=I fn="C:\temp:1319E5C0.dat"
sh=BB4C1C887BEB20333EF68B8D2F743C3DBDD581B0 ft=1 fh=619666096b676d4b vn="a variant of Win32/Injector.AXGJ trojan" ac=I fn="C:\temp:1A00BB4B.dat"
sh=0A7A819A37F7DECC122BEE248C22D6F7E4F38B57 ft=1 fh=a37716ba891ceb75 vn="Win32/CoinMiner.KX trojan" ac=I fn="C:\temp\fbsgen.dat"
sh=93B0442BBB2FFBDC303DDB8B854A00098B4A8ED0 ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.AN trojan" ac=I fn="C:\Users\Heiko\Downloads\_x3\YAIX3T 1.0.4.1.zip"
sh=2483ED987A0C85B80495BB0082BC33B03F76D64F ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.AN trojan" ac=I fn="C:\Users\Heiko\Downloads\_x3\YAIX3T\Root\zergRush"
Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 45 Java version out of Date! Adobe Flash Player 11.9.900.170 Mozilla Firefox (26.0) ````````Process Check: objlist.exe by Laurent```````` AVAST Software Avast AvastSvc.exe AVAST Software Avast AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-02-2014 01
Ran by Admin (administrator) on VINCENTS-PC on 11-02-2014 08:18:23
Running from C:\Users\Admin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun.exe
(hxxp://kay-bruns.de) C:\Windows\SuRun32.bin
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(PortableApps.com) C:\PortableApps\PortableApps.com\PortableAppsPlatform.exe
(Marek Jasinski) D:\PortableApps\FreeCommanderXE\FreeCommander.exe
(Nenad Hrg (SoftwareOK.com)) C:\PortableApps\DontSleepPortable\DontSleepPortable.exe
(Marek Jasinski) D:\PortableApps\FreeCommanderXE\FcContextMenu64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7284328 2011-08-30] (Realtek Semiconductor)
HKLM\...\Run: [fssui] - C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [892416 2012-09-12] (Microsoft Corporation)
HKLM\...\Run: [SuRun Systemmenü-Erweiterung] - C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
HKLM\...\Run: [tvncontrol] - C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-27] (AVAST Software)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3586121593-417037200-197760878-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.lnk
ShortcutTarget: Core Temp.lnk -> C:\Program Files\Core Temp\Core Temp.exe ()
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PortableAppsPlatform.exe - Verknüpfung.lnk
ShortcutTarget: PortableAppsPlatform.exe - Verknüpfung.lnk -> C:\PortableApps\PortableApps.com\PortableAppsPlatform.exe (PortableApps.com)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XMediaGrabber.lnk
ShortcutTarget: XMediaGrabber.lnk -> C:\Program Files (x86)\XMediaGrabber\XMediaGrabber.exe (hxxp://www.xmediagrabber.de)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x163759EBE10ECE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0F4C14C4-945D-4990-9388-A3C7A2E9336F} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKLM-x32 - {94AE0E02-5D76-4244-8B5F-783BD0CA7D76} URL = hxxp://www.bing.com/?cc=de
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: No Name - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks: SuRun Shell Extension - {2C7B6088-5A77-4d48-BE43-30337DCA9A86} - C:\Windows\SuRunExt.dll [189952 2013-07-03] (hxxp://kay-bruns.de)
Tcpip\..\Interfaces\{57F85748-9E1C-49A3-89C9-3715B55FD919}: [NameServer]192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PortableApps\FoxitReaderPortable\App\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NoScript - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-08]
FF Extension: Adblock Plus - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k9c3t3zj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-08]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-02-20]
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-27] (AVAST Software)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 SuRunSVC; C:\Windows\SuRun.exe [727552 2013-07-03] (hxxp://kay-bruns.de)
S4 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-27] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-27] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-27] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-27] ()
R3 dvdfab; C:\Windows\System32\drivers\dvdfab.sys [79232 2011-08-15] (Fengtao Software Inc.)
R3 MsgPlusDriver; C:\Windows\System32\DRIVERS\MsgPlusDriver.sys [125392 2013-05-07] (Yune Software)
S3 ALSysIO; \??\C:\Users\Admin\AppData\Local\Temp\ALSysIO64.sys [X]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-11 08:18 - 2014-02-11 08:18 - 00011680 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-11 08:11 - 2014-02-11 08:11 - 00987425 _____ () C:\Users\Admin\Downloads\SecurityCheck.exe
2014-02-10 20:13 - 2014-02-10 20:14 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu.exe
2014-02-09 15:44 - 2014-02-11 08:18 - 00000000 ____D () C:\Users\Admin\Downloads\FRST-OlderVersion
2014-02-09 15:38 - 2014-02-09 15:38 - 00002209 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-02-09 15:29 - 2014-02-09 15:29 - 00000000 ____D () C:\Windows\ERUNT
2014-02-09 15:28 - 2014-02-09 15:28 - 01037530 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2014-02-09 15:11 - 2014-02-09 15:15 - 00000000 ____D () C:\AdwCleaner
2014-02-09 15:10 - 2014-02-09 15:10 - 01166132 _____ () C:\Users\Admin\Downloads\adwcleaner.exe
2014-02-09 02:31 - 2014-02-09 02:31 - 10779656 ____N (Marek Jasinski) C:\Users\Admin\Downloads\SandboxFreeCommander.cameyo.exe
2014-02-08 21:24 - 2014-02-08 21:24 - 00001142 _____ () C:\Users\Admin\Desktop\FreeCommander - Verknüpfung.lnk
2014-02-08 20:54 - 2014-02-08 20:54 - 00000000 ____D () C:\Users\Admin\Downloads\Jamie
2014-02-08 20:52 - 2014-02-08 20:52 - 00000000 ____D () C:\Users\Admin\Downloads\Jeremy
2014-02-08 20:29 - 2014-02-08 20:30 - 00000000 ____D () C:\Users\Admin\Downloads\Julien
2014-02-08 18:31 - 2014-02-08 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Local\Cameyo
2014-02-08 18:24 - 2014-02-08 19:05 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\VOS
2014-02-08 18:19 - 2014-02-08 18:20 - 18807821 _____ (Cameyo) C:\Users\Admin\Downloads\Cameyo.exe
2014-02-08 11:24 - 2014-02-08 11:24 - 00028654 _____ () C:\ComboFix.txt
2014-02-08 11:08 - 2014-02-08 11:24 - 00000000 ____D () C:\Qoobox
2014-02-08 11:08 - 2014-02-08 11:22 - 00000000 ____D () C:\Windows\erdnt
2014-02-08 11:08 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-08 11:08 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-08 11:08 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-08 11:08 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-08 11:04 - 2014-02-08 11:04 - 05180173 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-02-08 05:10 - 2014-02-08 05:10 - 589632224 _____ () C:\Windows\MEMORY.DMP
2014-02-08 05:10 - 2014-02-08 05:10 - 00455520 _____ () C:\Windows\Minidump\020814-14726-01.dmp
2014-02-08 03:26 - 2014-02-08 03:26 - 00380416 _____ () C:\Users\Admin\Downloads\2euv8v11.exe
2014-02-08 03:15 - 2014-02-11 08:18 - 00000000 ____D () C:\FRST
2014-02-08 03:14 - 2014-02-11 08:18 - 02151424 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:52 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-08 02:47 - 2014-02-08 02:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:33 - 2014-02-08 00:37 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:32 - 2014-02-08 00:41 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 20:18 - 2014-02-08 00:12 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:20 - 2014-02-07 19:58 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 10:18 - 2011-12-21 13:15 - 00219440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2014-02-05 10:18 - 2011-12-21 13:15 - 00044848 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:11 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 15:11 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-02-03 15:11 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 20:58 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-02-02 20:58 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2014-02-02 20:58 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2014-02-02 20:58 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2014-02-02 20:58 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2014-02-02 20:58 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-02-02 20:58 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2014-02-02 20:58 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2014-02-02 20:58 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2014-02-02 20:58 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2014-02-02 20:58 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2014-02-02 20:58 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2014-02-02 20:57 - 2014-02-02 20:58 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:57 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2014-02-02 20:57 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2014-02-02 20:57 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2014-02-02 20:57 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2014-02-02 20:57 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2014-02-02 20:57 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-02-02 20:57 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-02-02 20:57 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-02-02 20:57 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-02-02 20:57 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-02-02 20:57 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-02-02 20:57 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-02-02 20:57 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-02-02 20:57 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-02-02 20:57 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-02-02 20:57 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-02-02 20:57 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-02-02 20:57 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-02-02 20:57 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-02-02 20:57 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-02-02 20:57 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-02-02 20:57 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2014-02-02 20:57 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-02-02 20:57 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-02-02 20:57 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-02-02 20:57 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-02-02 20:57 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-02-02 20:57 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-02-02 20:57 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-02-02 20:57 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-08 00:49 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:07 - 2014-02-02 20:08 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-01-17 06:11 - 2014-01-17 06:12 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:11 - 2014-01-17 06:12 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:11 - 2014-01-17 06:12 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-15 17:55 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 17:55 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 17:55 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 17:55 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software
==================== One Month Modified Files and Folders =======
2014-02-11 08:18 - 2014-02-11 08:18 - 00011680 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-02-11 08:18 - 2014-02-09 15:44 - 00000000 ____D () C:\Users\Admin\Downloads\FRST-OlderVersion
2014-02-11 08:18 - 2014-02-08 03:15 - 00000000 ____D () C:\FRST
2014-02-11 08:18 - 2014-02-08 03:14 - 02151424 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-02-11 08:11 - 2014-02-11 08:11 - 00987425 _____ () C:\Users\Admin\Downloads\SecurityCheck.exe
2014-02-11 07:56 - 2013-04-16 18:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\Windows Live
2014-02-11 07:42 - 2013-02-19 19:18 - 01502750 _____ () C:\Windows\WindowsUpdate.log
2014-02-11 07:26 - 2013-02-20 07:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-10 20:14 - 2014-02-10 20:13 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu.exe
2014-02-10 19:55 - 2013-02-20 09:25 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-09 20:21 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-09 20:21 - 2009-07-14 05:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-09 20:16 - 2013-02-22 22:01 - 00000000 ____D () C:\Users\Admin\.xmg
2014-02-09 20:15 - 2013-04-22 19:37 - 00000680 __RSH () C:\Users\Admin\ntuser.pol
2014-02-09 20:15 - 2013-02-19 21:23 - 00000000 ____D () C:\Users\Admin
2014-02-09 20:14 - 2013-03-30 01:05 - 00039373 _____ () C:\Windows\setupact.log
2014-02-09 20:14 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-09 15:38 - 2014-02-09 15:38 - 00002209 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-02-09 15:29 - 2014-02-09 15:29 - 00000000 ____D () C:\Windows\ERUNT
2014-02-09 15:28 - 2014-02-09 15:28 - 01037530 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2014-02-09 15:15 - 2014-02-09 15:11 - 00000000 ____D () C:\AdwCleaner
2014-02-09 15:10 - 2014-02-09 15:10 - 01166132 _____ () C:\Users\Admin\Downloads\adwcleaner.exe
2014-02-09 02:31 - 2014-02-09 02:31 - 10779656 ____N (Marek Jasinski) C:\Users\Admin\Downloads\SandboxFreeCommander.cameyo.exe
2014-02-08 21:24 - 2014-02-08 21:24 - 00001142 _____ () C:\Users\Admin\Desktop\FreeCommander - Verknüpfung.lnk
2014-02-08 20:54 - 2014-02-08 20:54 - 00000000 ____D () C:\Users\Admin\Downloads\Jamie
2014-02-08 20:52 - 2014-02-08 20:52 - 00000000 ____D () C:\Users\Admin\Downloads\Jeremy
2014-02-08 20:30 - 2014-02-08 20:29 - 00000000 ____D () C:\Users\Admin\Downloads\Julien
2014-02-08 19:05 - 2014-02-08 18:24 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\VOS
2014-02-08 18:31 - 2014-02-08 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Local\Cameyo
2014-02-08 18:20 - 2014-02-08 18:19 - 18807821 _____ (Cameyo) C:\Users\Admin\Downloads\Cameyo.exe
2014-02-08 11:38 - 2013-04-05 04:12 - 00027990 _____ () C:\Windows\PFRO.log
2014-02-08 11:24 - 2014-02-08 11:24 - 00028654 _____ () C:\ComboFix.txt
2014-02-08 11:24 - 2014-02-08 11:08 - 00000000 ____D () C:\Qoobox
2014-02-08 11:22 - 2014-02-08 11:08 - 00000000 ____D () C:\Windows\erdnt
2014-02-08 11:22 - 2013-02-22 19:02 - 00000000 ___RD () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 11:22 - 2013-02-19 21:23 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 11:21 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-08 11:04 - 2014-02-08 11:04 - 05180173 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-02-08 05:10 - 2014-02-08 05:10 - 589632224 _____ () C:\Windows\MEMORY.DMP
2014-02-08 05:10 - 2014-02-08 05:10 - 00455520 _____ () C:\Windows\Minidump\020814-14726-01.dmp
2014-02-08 05:10 - 2013-03-25 07:31 - 00000000 ____D () C:\Windows\Minidump
2014-02-08 03:26 - 2014-02-08 03:26 - 00380416 _____ () C:\Users\Admin\Downloads\2euv8v11.exe
2014-02-08 03:13 - 2014-02-08 03:13 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-02-08 03:12 - 2014-02-08 03:12 - 00050477 _____ () C:\Users\Admin\Downloads\Defogger.exe
2014-02-08 02:52 - 2014-02-08 02:52 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 02:52 - 2014-02-08 02:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-08 02:48 - 2014-02-08 02:47 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-08 02:10 - 2013-02-20 08:04 - 00000000 ____D () C:\Users\Admin\AppData\Local\Mozilla
2014-02-08 02:03 - 2013-08-05 08:37 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA.job
2014-02-08 02:03 - 2013-08-05 08:37 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core.job
2014-02-08 01:58 - 2013-08-05 08:37 - 00003918 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007UA
2014-02-08 01:58 - 2013-08-05 08:37 - 00003550 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3586121593-417037200-197760878-1007Core
2014-02-08 01:05 - 2014-02-08 01:05 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-08 00:49 - 2014-02-02 20:09 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-08 00:41 - 2014-02-08 00:32 - 133796768 _____ () C:\Users\Heiko\Downloads\setup_11.0.1.1245.x01_2014_02_06_15_37.exe
2014-02-08 00:39 - 2014-02-08 00:39 - 00003205 _____ () C:\Users\Heiko\Desktop\Sophos Virus Removal Tool.lnk
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\ProgramData\Sophos
2014-02-08 00:39 - 2014-02-08 00:39 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-02-08 00:37 - 2014-02-08 00:33 - 78530544 _____ (Sophos Limited) C:\Users\Heiko\Downloads\SophosVirusRemovalTool-2.4.exe
2014-02-08 00:12 - 2014-02-07 20:18 - 00000492 _____ () C:\Windows\Tasks\XMediaGrabber Timer Startup 1921681105.job
2014-02-08 00:12 - 2013-08-16 19:19 - 00000000 ____D () C:\Users\Heiko\.xmg
2014-02-08 00:12 - 2013-04-16 18:21 - 00000680 __RSH () C:\Users\Heiko\ntuser.pol
2014-02-08 00:12 - 2013-02-22 19:01 - 00000000 ____D () C:\Users\Heiko
2014-02-07 23:41 - 2013-02-24 22:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\XBMC
2014-02-07 23:32 - 2013-08-25 00:42 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype
2014-02-07 23:27 - 2014-02-07 23:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Thunderbird
2014-02-07 23:18 - 2014-02-07 23:18 - 00715796 _____ () C:\Users\Heiko\Downloads\MKVExtractGUI-2.2.2.8.zip
2014-02-07 23:17 - 2013-12-22 14:59 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\Skype
2014-02-07 23:12 - 2014-02-07 23:12 - 00015346 _____ () C:\Users\Heiko\Downloads\gMKVExtractGUI.v1.0.7z
2014-02-07 21:13 - 2013-04-16 18:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Windows Live
2014-02-07 19:58 - 2014-02-05 10:20 - 00000000 ____D () C:\ProgramData\Sirrix AG
2014-02-07 09:48 - 2013-08-29 17:05 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{12489FB2-B57C-4A9C-8F29-2291A874BC82}
2014-02-06 18:22 - 2014-02-06 18:22 - 00589878 _____ () C:\Users\Heiko\Downloads\Jeremy (1).bmp
2014-02-05 10:25 - 2014-02-05 10:25 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Sirrix AG
2014-02-05 10:18 - 2014-02-05 10:18 - 00000000 ____D () C:\Program Files\Oracle
2014-02-05 08:01 - 2013-12-20 07:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-04 22:26 - 2013-02-20 07:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 22:26 - 2013-02-20 07:36 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 22:26 - 2013-02-20 07:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-03 20:51 - 2014-02-03 20:51 - 10046857 _____ () C:\Users\Heiko\Downloads\mkvtoolnix-6.7.0.7z
2014-02-03 19:28 - 2013-04-22 19:35 - 00022330 __RSH () C:\Users\Julien\ntuser.pol
2014-02-03 19:28 - 2013-04-22 19:35 - 00000000 ____D () C:\Users\Julien
2014-02-03 15:12 - 2014-02-03 15:12 - 00058016 _____ () C:\Users\Jamie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-03 15:12 - 2014-02-03 15:12 - 00001421 _____ () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ___RD () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\AVAST Software
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\ATI
2014-02-03 15:12 - 2014-02-03 15:12 - 00000000 ____D () C:\Users\Jamie\AppData\Local\AMD
2014-02-03 15:12 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie
2014-02-03 15:11 - 2014-02-03 15:11 - 00001328 __RSH () C:\Users\Jamie\ntuser.pol
2014-02-03 15:11 - 2014-02-03 15:11 - 00000020 ___SH () C:\Users\Jamie\ntuser.ini
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Vorlagen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Startmenü
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Netzwerkumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Lokale Einstellungen
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Eigene Dateien
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Druckumgebung
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Musik
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Documents\Eigene Bilder
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Verlauf
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\AppData\Local\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 _SHDL () C:\Users\Jamie\Anwendungsdaten
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Roaming\Adobe
2014-02-03 15:11 - 2014-02-03 15:11 - 00000000 ____D () C:\Users\Jamie\AppData\Local\VirtualStore
2014-02-03 14:07 - 2014-02-03 14:07 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Foxit Software
2014-02-02 21:42 - 2014-02-02 21:42 - 00000222 _____ () C:\Users\Jeremy\Desktop\Starbound.url
2014-02-02 21:40 - 2013-04-16 18:26 - 00004682 __RSH () C:\Users\Jeremy\ntuser.pol
2014-02-02 21:40 - 2013-02-28 18:40 - 00000000 ____D () C:\Users\Jeremy
2014-02-02 20:58 - 2014-02-02 20:57 - 00010009 _____ () C:\Windows\DirectX.log
2014-02-02 20:42 - 2014-02-02 20:42 - 00000000 _____ () C:\Users\Jeremy\Downloads\AngryBirds.themepack
2014-02-02 20:15 - 2014-02-02 20:15 - 00000222 _____ () C:\Users\Heiko\Desktop\Starbound.url
2014-02-02 20:15 - 2014-02-02 20:15 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-02 20:09 - 2014-02-02 20:09 - 00000963 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-02 20:08 - 2014-02-02 20:07 - 01133552 _____ () C:\Users\Heiko\Downloads\SteamSetup.exe
2014-02-02 19:45 - 2013-03-17 21:09 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\.minecraft
2014-02-01 08:52 - 2013-04-22 19:37 - 00000000 ____D () C:\Users\Julien\AppData\Roaming\.minecraft
2014-01-25 19:44 - 2013-11-16 21:58 - 00000000 ____D () C:\Users\Jeremy\AppData\Roaming\Skype
2014-01-17 06:12 - 2014-01-17 06:11 - 00002997 _____ () C:\Users\Julien\Downloads\server.log
2014-01-17 06:12 - 2014-01-17 06:11 - 00000554 _____ () C:\Users\Julien\Downloads\server.properties
2014-01-17 06:12 - 2014-01-17 06:11 - 00000000 ____D () C:\Users\Julien\Downloads\world
2014-01-17 06:11 - 2014-01-17 06:11 - 06527780 _____ () C:\Users\Julien\Downloads\minecraft_server.1.6.1.exe
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-players.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000109 _____ () C:\Users\Julien\Downloads\banned-ips.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\white-list.txt
2014-01-17 06:11 - 2014-01-17 06:11 - 00000000 _____ () C:\Users\Julien\Downloads\ops.txt
2014-01-16 20:18 - 2010-11-21 07:50 - 00697160 _____ () C:\Windows\system32\perfh007.dat
2014-01-16 20:18 - 2010-11-21 07:50 - 00148642 _____ () C:\Windows\system32\perfc007.dat
2014-01-16 20:18 - 2009-07-14 06:13 - 01613340 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-16 14:41 - 2014-01-16 14:41 - 00675988 _____ () C:\Users\Julien\Downloads\Minecraft(1).exe
2014-01-16 03:19 - 2009-07-14 05:45 - 00276968 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:03 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-16 03:00 - 2013-02-20 07:37 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-14 16:34 - 2014-01-14 16:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-14 14:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-14 12:25 - 2013-02-20 08:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-08 05:39
==================== End Of Log ============================
|
|
11.02.2014, 18:55
| #8 |
| /// the machine /// TB-Ausbilder | Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? Java updaten. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.02.2014, 19:48
| #9 |
| | Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? Hallo Schrauber, nochmal vielen vielen Dank für Deine Hilfe!!!  Ein einziges Problem hatte ich nach der Bereinigung noch: Eines der Bereinigungsprogramme hat in den eingeschränkten Accounts die Rechte der Konfigurationsdatei pref.js neu gesetzt. Zugriff auf die Datei hatten dann nur noch SYSTEM, die Gruppe der Administratoren sowie der Admin-Account, von dem aus ich die Bereinigung durchgeführt habe. Die User der eingeschränkten Accounts konnten Firefox zwar starten, aber jegliche Änderungen der Einstellungen gingen beim Beenden des Programms verloren, da die prefs.js nicht gespeichert werden konnte. Ich weiß nicht, ob das bei mir ein Einzelfall war. Falls nicht, hilft euch die Info vielleicht weiter. Den Thread kannst du schließen und aus Deinen Abos löschen. LG Colorlight |
|
14.02.2014, 15:54
| #10 |
| /// the machine /// TB-Ausbilder | Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? Werd ich mir anschauen. Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Win7 Home Premium - Verdacht Rootkit - Nutzung für Bitcoin-Botnet? |
| android/exploit.lotoor.an, branding, browser, defender, flash player, h.264/mpeg-4, kaspersky, pup.optional.bandoo, pup.optional.conduit.a, pup.optional.installcore.a, pup.optional.installerex, pup.optional.installmonetizer, pup.optional.softonic, registry, security, sekunden, services.exe, software, svchost.exe, systemlast, virtualbox, warnung, win32/coinminer.kx, win32/injector.axbq, win32/injector.axgj, windows xp |
Linear-Darstellung
