| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7: Langsam, MBam startet nicht, auch im abgesicherten ModusWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.03.2014, 10:50
| #1 |
| |  Windows 7: Langsam, MBam startet nicht, auch im abgesicherten Modus Hallo! Seit drei Tagen merke ich, dass mein Media-PC im Wohnzimmer langsam ist. Dies fiel vor allem in Bezug auf Datenbankprozesse auf. Folgendes hab ich heute früh gemacht bzw. festgestellt: 1. Als Virenscanner läuft Avast, Quick Scan geht verdammt quick und sagt: alles gut. Die vollständige Prüfung genauso. 2. Im TaskManager ist ein komischer Prozess namens 575533705.exe, der nach Beenden gerne wieder startet und trotz Anzeige versteckter Dateien nicht auffindbar ist und 70,000 bis 80,000 k Arbeitsspeicher belegt. 3. Dann das gute alte Malewarebytes probiert. Ergebnis: geht nicht, läßt sich nicht öffnen. Auch Neuinstallation bringt nichts. Beim Starten von mbam.exe kommt der Hinweis, dass er die Datei nicht finden kann. 4. Bin dann nach Anleitung aus dem Forum vorgegangen und hab Chameleon geladen. Läßt sich aber auch nicht öffnen, Hilfedateien schmieren grundsätzlich ab, alles mit .chm-Endung öffnet nur ein weisses Fenster und zeigt keinerlei Reaktion weiter. 5. Dann auf OTH gewechselt. Startet zwar, zeigt aber keine Reaktion, KILL ALL PROCESS führt zu nichts. 6. Als nächstes im abgesicherten Modus gestartet, auch da wird mbam nicht gefunden und Hilfedateien lassen sich nicht öffnen. 7. Wutanfall bekommen. 8. Gemäß Grundlagen alle Logfiles erstellt: defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:56 on 08/03/2014 (Sebastian)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST.txt FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-03-2014 01
Ran by Sebastian (administrator) on SEBASTIAN-PC on 08-03-2014 09:59:18
Running from C:\Users\Sebastian\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(LSoft Technologies Inc) C:\Program Files (x86)\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe
(ArcSoft, Inc.) C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dawicontrol GmbH) C:\Program Files (x86)\Dawicontrol GmbH\Dawicontrol RAID Monitor\RAIDservice.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
() C:\Program Files\Silicon Image\3114-W-A64-R SATARAID5\SATARaid5ConfigService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(VIA Technologies, Inc.) C:\Windows\system32\viakaraokesrv.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
() C:\Windows\SysWOW64\C2MP\TrayMenu.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
() C:\ProgramData\575533705.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WScript.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5299320 2012-10-25] (VIA)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-02-16] (AVAST Software)
HKLM-x32\...\Run: [Windows Registry] - C:\ProgramData\575533705.exe -rundll32 /SYSTEM32 "C:\Windows\System32\taskmgr.exe" "C:\Program Files\Microsoft\Windows"
HKU\.DEFAULT\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe -autorun
HKU\.DEFAULT\...\Run: [SearchProtect] - \SearchProtect\bin\cltmng.exe
HKU\.DEFAULT\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\.DEFAULT\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\.DEFAULT\...\Policies\Explorer: [NoResolveSearch] 1
HKU\.DEFAULT\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-3146263950-3329543529-1817725048-1001\...\CurrentVersion\Windows: [Load] C:\ProgramData\575533705.exe <===== ATTENTION
HKU\S-1-5-21-3146263950-3329543529-1817725048-1001\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-3146263950-3329543529-1817725048-1001\...\Policies\Explorer: [DisableThumbnails] 1
HKU\S-1-5-21-3146263950-3329543529-1817725048-1001\...\Policies\Explorer: [ThumbnailsOnNetworkFolders] 1
HKU\S-1-5-21-3146263950-3329543529-1817725048-1001\...\Policies\Explorer: [NoThumbnailCache] 1
HKU\S-1-5-21-3146263950-3329543529-1817725048-1001\...\MountPoints2: {31e93b91-5bba-11e0-a9f6-806e6f6e6963} - B:\shelexec.exe .\html\index.htm
AppInit_DLLs-x32: c:\progra~3\browse~1\25986~1.67\{c16c1~1\browse~1.dll => "c:\progra~3\browse~1\25986~1.67\{c16c1~1\browse~1.dll" File Not Found
IFEO\avcenter.exe: [Debugger] nsjw.exe
IFEO\avguard.exe: [Debugger] nsjw.exe
IFEO\avp.exe: [Debugger] nsjw.exe
IFEO\bdagent.exe: [Debugger] nsjw.exe
IFEO\ccuac.exe: [Debugger] nsjw.exe
IFEO\ComboFix.exe: [Debugger] nsjw.exe
IFEO\egui.exe: [Debugger] nsjw.exe
IFEO\hijackthis.exe: [Debugger] nsjw.exe
IFEO\keyscrambler.exe: [Debugger] nsjw.exe
IFEO\mbam.exe: [Debugger] nsjw.exe
IFEO\MpCmdRun.exe: [Debugger] nsjw.exe
IFEO\MSASCui.exe: [Debugger] nsjw.exe
IFEO\MsMpEng.exe: [Debugger] nsjw.exe
IFEO\msseces.exe: [Debugger] nsjw.exe
IFEO\spybotsd.exe: [Debugger] nsjw.exe
IFEO\wireshark.exe: [Debugger] nsjw.exe
IFEO\zlclient.exe: [Debugger] nsjw.exe
Startup: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
InternetURL: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Registry.url -> 0
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3297265&octid=CT3297265&SearchSource=61&CUI=UN49078945308221305&UM=2&UP=SP2A9BDED2-EA9C-47CD-A3F3-15B6B72E88EC
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3631C9849CFBCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
URLSearchHook: HKLM-x32 - Default Value = {FE69C007-C452-4d3e-86D2-1730DF8BC871}
URLSearchHook: HKLM-x32 - (No Name) - {FE69C007-C452-4d3e-86D2-1730DF8BC871} - No File
URLSearchHook: HKLM-x32 - DivX Browser Bar DE Toolbar - {6dad39c6-f4ac-4984-8e9b-f666269b9eb1} - C:\Program Files (x86)\DivX_Browser_Bar_DE\prxtbDiv2.dll (Conduit Ltd.)
URLSearchHook: HKCU - Default Value = {FE69C007-C452-4d3e-86D2-1730DF8BC871}
URLSearchHook: HKCU - (No Name) - {FE69C007-C452-4d3e-86D2-1730DF8BC871} - No File
URLSearchHook: HKCU - DivX Browser Bar DE Toolbar - {6dad39c6-f4ac-4984-8e9b-f666269b9eb1} - C:\Program Files (x86)\DivX_Browser_Bar_DE\prxtbDiv2.dll (Conduit Ltd.)
SearchScopes: HKLM - {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKLM-x32 - DefaultScope {E86BADBB-F734-42FB-852B-52C41B35559C} URL =
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKCU - DefaultScope {E86BADBB-F734-42FB-852B-52C41B35559C} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3297265&CUI=UN49078945308221305&UM=2
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=116295&tt=5012_8&babsrc=SP_ss&mntrId=2048d3ca000000000000bcaec5cbc100
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ANT&o=102823&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=4P&apn_dtid=YYYYYYYYDE&apn_uid=59197941-1565-452D-B09A-444CF6706190&apn_sauid=3CF080A9-EDA3-4159-B468-59FFD746B84C
SearchScopes: HKCU - {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {E86BADBB-F734-42FB-852B-52C41B35559C} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3297265&CUI=UN49078945308221305&UM=2
BHO: HQ-Video-Pro-1.4 - {11111111-1111-1111-1111-110511291120} - C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-bho64.dll (HQ-Video)
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HQ-Video-Pro-1.4 - {11111111-1111-1111-1111-110511291120} - C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-bho.dll (HQ-Video)
BHO-x32: DivX Browser Bar DE Toolbar - {6dad39c6-f4ac-4984-8e9b-f666269b9eb1} - C:\Program Files (x86)\DivX_Browser_Bar_DE\prxtbDiv2.dll (Conduit Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - No Name - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File
Toolbar: HKLM-x32 - DivX Browser Bar DE Toolbar - {6dad39c6-f4ac-4984-8e9b-f666269b9eb1} - C:\Program Files (x86)\DivX_Browser_Bar_DE\prxtbDiv2.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU - No Name - {6DAD39C6-F4AC-4984-8E9B-F666269B9EB1} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Filter-x32: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default
FF user.js: detected! => C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\user.js
FF Homepage: about:newtab
FF Keyword.URL: hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3297265&SearchSource=2&CUI=UN18738971062560622&UM=2&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Sebastian\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Sebastian\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\babylon1.xml
FF SearchPlugin: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\Linkury Smartbar Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Linkury Smartbar - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\helperbar@helperbar.com [2012-04-20]
FF Extension: DownloadHelper - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-03]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\adblockpopups@jessehakanen.net.xpi [2012-06-28]
FF Extension: Adblock Plus - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-04-20]
FF Extension: QuickStores-Toolbar - C:\Program Files (x86)\Mozilla Firefox\extensions\quickstores@quickstores.de [2014-02-15]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-04-15]
Chrome:
=======
CHR HomePage: hxxp://search.conduit.com/?ctid=CT3297265&SearchSource=48&CUI=UN32143947505844536&UM=2
CHR DefaultSearchKeyword: search.conduit.com
CHR DefaultSearchProvider: Conduit
CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN32143947505844536&ctid=CT3297265&UM=2
CHR DefaultNewTabURL:
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\33.0.1750.117\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\33.0.1750.117\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\33.0.1750.117\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
CHR Extension: (HQ-Video-Pro-1.4) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\apehpgkcgpefnlpfindggfdecmgihlaj [2014-03-03]
CHR Extension: (YouTube) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-13]
CHR Extension: (Google Search) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-13]
CHR Extension: (AdBlock) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-11-25]
CHR Extension: (Google Wallet) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Better Pop Up Blocker) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpeeekfhbmikbdhlpjbfmnpgcbeggic [2011-08-27]
CHR Extension: (Gmail) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-13]
CHR HKCU\...\Chrome\Extension: [hkoahcaobjbihehldfimhblmhgalcipm] - C:\Users\Sebastian\AppData\Local\CRE\hkoahcaobjbihehldfimhblmhgalcipm.crx [2013-06-02]
CHR HKLM-x32\...\Chrome\Extension: [hidjnkeodmholilgafgdlgmgggbhnigl] - C:\Users\Sebastian\AppData\Roaming\SimilarSites\similarsites.crx [2013-06-02]
CHR HKLM-x32\...\Chrome\Extension: [hkoahcaobjbihehldfimhblmhgalcipm] - C:\Users\Sebastian\AppData\Local\CRE\hkoahcaobjbihehldfimhblmhgalcipm.crx [2013-06-02]
CHR StartMenuInternet: Google Chrome - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 Active@ Disk Monitor; C:\Program Files (x86)\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe [1464328 2011-04-01] (LSoft Technologies Inc)
R2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [43624 2012-08-14] (ArcSoft, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-16] (AVAST Software)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2013-04-23] ()
S4 bgsvcgen; C:\Windows\SysWOW64\bgsvcgen.exe [139264 2011-05-15] (SOURCENEXT)
R2 DcRaidMoSrv; C:\Program Files (x86)\Dawicontrol GmbH\Dawicontrol RAID Monitor\RAIDservice.exe [336384 2011-06-29] (Dawicontrol GmbH)
R2 SATARaid5 Config Service; C:\Program Files\Silicon Image\3114-W-A64-R SATARAID5\SATARaid5ConfigService.exe [148480 2005-10-05] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-10-22] (VIA Technologies, Inc.)
==================== Drivers (Whitelisted) ====================
R3 AirDisplay; C:\Windows\System32\DRIVERS\AVVideoCard.sys [15728 2011-05-05] (Windows (R) Win 7 DDK provider)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [139352 2013-07-31] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [139352 2013-07-31] (SlySoft, Inc.)
S3 appliand; C:\Windows\System32\DRIVERS\appliand.sys [33888 2011-06-26] (Applian Technologies Inc.)
R3 appliandMP; C:\Windows\System32\DRIVERS\appliand.sys [33888 2011-06-26] (Applian Technologies Inc.)
R1 ArcCtrl; C:\Windows\System32\drivers\ArcCtrl.sys [604192 2013-03-19] ()
R1 archlp; C:\Windows\System32\drivers\archlp.sys [139840 2011-11-18] ()
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-02-16] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-15] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-15] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1038072 2014-02-16] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [421704 2014-02-16] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [80184 2014-02-16] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-07] ()
R1 cdrbsdrv; C:\Windows\System32\Drivers\cdrbsdrv.sys [38944 2011-05-15] (B.H.A Corporation)
R0 DC324e; C:\Windows\System32\DRIVERS\DC324e.sys [51256 2011-06-29] (Dawicontrol GmbH)
R1 Ext2Fsd; C:\Windows\System32\Drivers\Ext2Fsd.sys [769816 2011-07-09] (www.ext2fsd.com)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 pfc; C:\Windows\SysWOW64\drivers\pfc.sys [10368 2004-04-01] (Padus, Inc.)
R0 SI3114; C:\Windows\System32\DRIVERS\SI3114.sys [82984 2008-04-14] (Silicon Image, Inc)
R0 Si3114r5; C:\Windows\System32\DRIVERS\Si3114r5.sys [329256 2008-11-24] (Silicon Image, Inc)
R0 Si3132r5; C:\Windows\System32\DRIVERS\Si3132r5.sys [337960 2007-12-26] (Silicon Image, Inc)
R0 SiFilter; C:\Windows\System32\DRIVERS\SiWinAcc.sys [22056 2008-04-14] (Silicon Image, Inc)
R0 SiRemFil; C:\Windows\System32\DRIVERS\SiRemFil.sys [16936 2007-12-26] (Silicon Image, Inc.)
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [146928 2011-03-01] (CyberLink Corp.)
S1 ArcSec; system32\drivers\ArcSec.sys [X]
U4 SR;
U5 UnlockerDriver5; C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] ()
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-08 09:59 - 2014-03-08 10:00 - 00027095 _____ () C:\Users\Sebastian\Downloads\FRST.txt
2014-03-08 09:59 - 2014-03-08 09:59 - 00000000 ____D () C:\FRST
2014-03-08 09:57 - 2014-03-08 09:57 - 02156544 _____ (Farbar) C:\Users\Sebastian\Downloads\FRST64.exe
2014-03-08 09:56 - 2014-03-08 09:56 - 00050477 _____ () C:\Users\Sebastian\Downloads\Defogger.exe
2014-03-08 09:56 - 2014-03-08 09:56 - 00000480 _____ () C:\Users\Sebastian\Downloads\defogger_disable.log
2014-03-08 09:56 - 2014-03-08 09:56 - 00000000 _____ () C:\Users\Sebastian\defogger_reenable
2014-03-08 09:18 - 2014-03-08 09:19 - 00259584 _____ (OldTimer Tools) C:\Users\Sebastian\Desktop\OTH.scr
2014-03-08 09:17 - 2014-03-08 09:47 - 00000000 ____D () C:\mb-c
2014-03-08 09:16 - 2014-03-08 09:16 - 01440846 _____ () C:\Users\Sebastian\Downloads\mbam-chameleon-1.62.1.1000.zip
2014-03-08 09:07 - 2014-03-08 09:47 - 00000832 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-08 09:07 - 2014-03-08 09:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware1-7
2014-03-08 09:06 - 2014-03-08 09:06 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Sebastian\Desktop\mbam-setup-1.75.0.1300.exe
2014-03-08 09:04 - 2014-03-08 09:04 - 00613200 _____ (Chip Digital GmbH) C:\Users\Sebastian\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-03-03 19:44 - 2014-03-03 19:44 - 00004576 _____ () C:\Windows\System32\Tasks\HQ-Video-Pro-1.4-updater
2014-03-03 19:44 - 2014-03-03 19:44 - 00004430 _____ () C:\Windows\System32\Tasks\HQ-Video-Pro-1.4-enabler
2014-03-03 19:44 - 2014-03-03 19:44 - 00001546 _____ () C:\Windows\Tasks\HQ-Video-Pro-1.4-updater.job
2014-03-03 19:44 - 2014-03-03 19:44 - 00001400 _____ () C:\Windows\Tasks\HQ-Video-Pro-1.4-enabler.job
2014-03-03 19:43 - 2014-03-03 19:44 - 00000000 ____D () C:\Program Files (x86)\HQ-Video-Pro-1.4
2014-03-03 19:43 - 2014-03-03 19:43 - 00004532 _____ () C:\Windows\System32\Tasks\HQ-Video-Pro-1.4-codedownloader
2014-03-03 19:43 - 2014-03-03 19:43 - 00003120 _____ () C:\Windows\Tasks\HQ-Video-Pro-1.4-chromeinstaller.job
2014-03-03 19:43 - 2014-03-03 19:43 - 00002600 _____ () C:\Windows\Tasks\HQ-Video-Pro-1.4-firefoxinstaller.job
2014-03-03 19:43 - 2014-03-03 19:43 - 00001502 _____ () C:\Windows\Tasks\HQ-Video-Pro-1.4-codedownloader.job
2014-03-03 19:42 - 2014-03-03 19:42 - 00001099 _____ () C:\Users\Public\Desktop\StreamTransport.lnk
2014-03-03 19:41 - 2014-03-03 19:41 - 01951328 _____ (hxxp://www.streamtransport.com/ ) C:\Users\Sebastian\Downloads\streamtransport_setup.exe
2014-03-03 19:13 - 2014-03-03 19:14 - 00000000 ____D () C:\Users\Sebastian\.mediathek3
2014-03-03 19:13 - 2014-03-03 19:13 - 00000000 ____D () C:\mediathek
2014-03-03 19:12 - 2014-03-03 19:12 - 29640231 _____ () C:\Users\Sebastian\Downloads\MediathekView_4.zip
2014-03-03 19:02 - 2014-03-03 19:02 - 00000519 _____ () C:\Users\Sebastian\AppData\Roaming\setting.ini
2014-03-03 18:59 - 2014-03-03 19:03 - 00000000 ____D () C:\Users\Sebastian\dwhelper
2014-03-03 18:58 - 2014-03-03 18:58 - 00008655 _____ () C:\Users\Sebastian\AppData\Roaming\gui.dat
2014-03-03 18:55 - 2014-03-08 10:00 - 00284632 _____ () C:\Users\Sebastian\AppData\Roaming\msconfig.ini
2014-03-03 18:55 - 2014-03-08 09:54 - 00000000 ___HD () C:\{$7093-3599-3146-6724$}
2014-03-03 18:55 - 2014-03-03 18:55 - 07651328 _____ (GetFLV) C:\Users\Sebastian\AppData\Roaming\GetFLV.exe
2014-03-03 18:48 - 2014-03-06 20:10 - 00000000 ____D () C:\Program Files (x86)\GetFLV
2014-03-03 18:48 - 2014-02-13 01:52 - 05861376 __RSH () C:\ProgramData\575533705.exe
2014-02-26 23:02 - 2014-01-09 03:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-02-26 23:02 - 2014-01-03 23:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-02-24 21:44 - 2014-03-03 09:21 - 00003394 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2014-02-23 12:06 - 2014-03-03 22:27 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-23 12:06 - 2014-02-23 12:27 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-16 10:15 - 2014-02-24 21:15 - 00001072 _____ () C:\Windows\PFRO.log
2014-02-15 12:10 - 2014-02-15 12:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-15 09:17 - 2014-02-15 09:17 - 04822473 _____ (Tim Kosse) C:\Users\Sebastian\Downloads\FileZilla_3.7.4.1_win32-setup.exe
2014-02-12 23:13 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 23:13 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 23:11 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 23:11 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 23:11 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 23:11 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 23:11 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 23:11 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 23:11 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 23:11 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 23:11 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 23:11 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 23:11 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 23:11 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 23:11 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 23:11 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 23:11 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 23:11 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 23:11 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 23:11 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 23:11 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 23:11 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 23:11 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 23:11 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 23:11 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 23:11 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 23:11 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 23:11 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 23:11 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 23:11 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 23:11 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 23:11 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 23:11 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 23:11 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 23:11 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 23:11 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 23:11 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 23:11 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 23:11 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 23:11 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 23:11 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 13:41 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 13:41 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 13:41 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 13:41 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 13:41 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 13:41 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 13:41 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 13:41 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 13:41 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 13:41 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 13:41 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 13:41 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 13:41 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 13:41 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 13:41 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 13:41 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 13:41 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 13:41 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 13:41 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 13:41 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 13:41 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 13:41 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 13:41 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 13:41 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
==================== One Month Modified Files and Folders =======
2014-03-08 10:00 - 2014-03-08 09:59 - 00027095 _____ () C:\Users\Sebastian\Downloads\FRST.txt
2014-03-08 10:00 - 2014-03-03 18:55 - 00284632 _____ () C:\Users\Sebastian\AppData\Roaming\msconfig.ini
2014-03-08 09:59 - 2014-03-08 09:59 - 00000000 ____D () C:\FRST
2014-03-08 09:57 - 2014-03-08 09:57 - 02156544 _____ (Farbar) C:\Users\Sebastian\Downloads\FRST64.exe
2014-03-08 09:57 - 2011-03-31 18:17 - 01485621 _____ () C:\Windows\WindowsUpdate.log
2014-03-08 09:56 - 2014-03-08 09:56 - 00050477 _____ () C:\Users\Sebastian\Downloads\Defogger.exe
2014-03-08 09:56 - 2014-03-08 09:56 - 00000480 _____ () C:\Users\Sebastian\Downloads\defogger_disable.log
2014-03-08 09:56 - 2014-03-08 09:56 - 00000000 _____ () C:\Users\Sebastian\defogger_reenable
2014-03-08 09:56 - 2011-03-31 18:45 - 00000000 ____D () C:\Users\Sebastian
2014-03-08 09:54 - 2014-03-03 18:55 - 00000000 ___HD () C:\{$7093-3599-3146-6724$}
2014-03-08 09:54 - 2011-03-31 18:48 - 00000000 ___RD () C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-08 09:52 - 2014-02-02 16:53 - 00001848 _____ () C:\Windows\setupact.log
2014-03-08 09:52 - 2011-03-31 19:11 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-03-08 09:47 - 2014-03-08 09:17 - 00000000 ____D () C:\mb-c
2014-03-08 09:47 - 2014-03-08 09:07 - 00000832 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-08 09:41 - 2009-07-14 05:45 - 00026064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-08 09:41 - 2009-07-14 05:45 - 00026064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-08 09:19 - 2014-03-08 09:18 - 00259584 _____ (OldTimer Tools) C:\Users\Sebastian\Desktop\OTH.scr
2014-03-08 09:16 - 2014-03-08 09:16 - 01440846 _____ () C:\Users\Sebastian\Downloads\mbam-chameleon-1.62.1.1000.zip
2014-03-08 09:14 - 2012-10-05 20:41 - 00000000 ____D () C:\tsmuxer
2014-03-08 09:07 - 2014-03-08 09:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware1-7
2014-03-08 09:06 - 2014-03-08 09:06 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Sebastian\Desktop\mbam-setup-1.75.0.1300.exe
2014-03-08 09:04 - 2014-03-08 09:04 - 00613200 _____ (Chip Digital GmbH) C:\Users\Sebastian\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-03-08 08:48 - 2011-03-31 21:12 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\DVD Profiler
2014-03-07 22:57 - 2011-03-31 20:54 - 00000000 ____D () C:\BD_Rebuilder
2014-03-07 22:23 - 2013-03-16 17:29 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\vlc
2014-03-07 21:15 - 2012-07-05 19:09 - 00000131 ___SH () C:\ProgramData\.zreglib
2014-03-07 20:59 - 2013-08-03 08:55 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\JDownloader v2.0
2014-03-07 18:32 - 2011-04-03 13:57 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\dvdcss
2014-03-07 12:18 - 2013-05-20 18:06 - 00000000 ___RD () C:\Users\Sebastian\Dropbox
2014-03-07 12:18 - 2013-04-14 16:20 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Dropbox
2014-03-06 20:10 - 2014-03-03 18:48 - 00000000 ____D () C:\Program Files (x86)\GetFLV
2014-03-03 23:02 - 2013-11-02 17:02 - 00000302 _____ () C:\Windows\Tasks\FoxTab.job
2014-03-03 22:35 - 2011-08-27 09:03 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001UA.job
2014-03-03 22:27 - 2014-02-23 12:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-03 20:35 - 2011-08-27 09:02 - 00001084 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001Core.job
2014-03-03 19:44 - 2014-03-03 19:44 - 00004576 _____ () C:\Windows\System32\Tasks\HQ-Video-Pro-1.4-updater
2014-03-03 19:44 - 2014-03-03 19:44 - 00004430 _____ () C:\Windows\System32\Tasks\HQ-Video-Pro-1.4-enabler
2014-03-03 19:44 - 2014-03-03 19:44 - 00001546 _____ () C:\Windows\Tasks\HQ-Video-Pro-1.4-updater.job
2014-03-03 19:44 - 2014-03-03 19:44 - 00001400 _____ () C:\Windows\Tasks\HQ-Video-Pro-1.4-enabler.job
2014-03-03 19:44 - 2014-03-03 19:43 - 00000000 ____D () C:\Program Files (x86)\HQ-Video-Pro-1.4
2014-03-03 19:43 - 2014-03-03 19:43 - 00004532 _____ () C:\Windows\System32\Tasks\HQ-Video-Pro-1.4-codedownloader
2014-03-03 19:43 - 2014-03-03 19:43 - 00003120 _____ () C:\Windows\Tasks\HQ-Video-Pro-1.4-chromeinstaller.job
2014-03-03 19:43 - 2014-03-03 19:43 - 00002600 _____ () C:\Windows\Tasks\HQ-Video-Pro-1.4-firefoxinstaller.job
2014-03-03 19:43 - 2014-03-03 19:43 - 00001502 _____ () C:\Windows\Tasks\HQ-Video-Pro-1.4-codedownloader.job
2014-03-03 19:42 - 2014-03-03 19:42 - 00001099 _____ () C:\Users\Public\Desktop\StreamTransport.lnk
2014-03-03 19:42 - 2012-06-28 21:07 - 00000000 ____D () C:\Program Files (x86)\StreamTransport
2014-03-03 19:41 - 2014-03-03 19:41 - 01951328 _____ (hxxp://www.streamtransport.com/ ) C:\Users\Sebastian\Downloads\streamtransport_setup.exe
2014-03-03 19:14 - 2014-03-03 19:13 - 00000000 ____D () C:\Users\Sebastian\.mediathek3
2014-03-03 19:13 - 2014-03-03 19:13 - 00000000 ____D () C:\mediathek
2014-03-03 19:12 - 2014-03-03 19:12 - 29640231 _____ () C:\Users\Sebastian\Downloads\MediathekView_4.zip
2014-03-03 19:03 - 2014-03-03 18:59 - 00000000 ____D () C:\Users\Sebastian\dwhelper
2014-03-03 19:02 - 2014-03-03 19:02 - 00000519 _____ () C:\Users\Sebastian\AppData\Roaming\setting.ini
2014-03-03 18:58 - 2014-03-03 18:58 - 00008655 _____ () C:\Users\Sebastian\AppData\Roaming\gui.dat
2014-03-03 18:55 - 2014-03-03 18:55 - 07651328 _____ (GetFLV) C:\Users\Sebastian\AppData\Roaming\GetFLV.exe
2014-03-03 10:44 - 2010-11-21 07:50 - 01816566 _____ () C:\Windows\system32\perfh007.dat
2014-03-03 10:44 - 2010-11-21 07:50 - 00496014 _____ () C:\Windows\system32\perfc007.dat
2014-03-03 10:44 - 2009-07-14 06:13 - 00006256 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-03 09:21 - 2014-02-24 21:44 - 00003394 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2014-03-03 08:32 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-03-03 08:06 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-24 21:15 - 2014-02-16 10:15 - 00001072 _____ () C:\Windows\PFRO.log
2014-02-23 12:27 - 2014-02-23 12:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-23 12:27 - 2012-05-05 00:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-23 12:27 - 2012-05-05 00:28 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-23 12:21 - 2011-03-31 20:20 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\Adobe
2014-02-16 23:33 - 2013-08-13 23:28 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-16 23:30 - 2011-04-01 12:31 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-16 17:25 - 2012-12-30 19:09 - 00004256 _____ () C:\Users\Sebastian\Desktop\Upload Template.txt
2014-02-16 16:56 - 2012-01-17 18:05 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\FileZilla
2014-02-16 10:29 - 2011-04-01 13:19 - 00000000 ___RD () C:\Users\Sebastian\Desktop\Programme
2014-02-16 10:22 - 2013-04-15 21:21 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-16 10:21 - 2014-01-07 15:59 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-02-16 10:21 - 2013-04-15 21:22 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-02-16 10:21 - 2013-04-15 21:22 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-02-16 10:21 - 2013-04-15 21:21 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-02-16 10:21 - 2013-04-15 21:21 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-02-16 10:21 - 2013-04-15 21:20 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-02-16 10:15 - 2012-04-27 16:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-15 12:10 - 2014-02-15 12:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-15 09:17 - 2014-02-15 09:17 - 04822473 _____ (Tim Kosse) C:\Users\Sebastian\Downloads\FileZilla_3.7.4.1_win32-setup.exe
2014-02-15 09:17 - 2012-01-17 18:05 - 00000000 ____D () C:\Program Files (x86)\FileZilla FTP Client
2014-02-13 16:30 - 2013-12-16 12:47 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\Deployment
2014-02-13 01:52 - 2014-03-03 18:48 - 05861376 __RSH () C:\ProgramData\575533705.exe
2014-02-12 23:20 - 2013-01-27 18:05 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-11 20:30 - 2011-08-27 09:03 - 00004118 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001UA
2014-02-11 20:30 - 2011-08-27 09:02 - 00003722 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001Core
2014-02-08 12:07 - 2011-09-10 17:30 - 00000000 ____D () C:\Users\Sebastian\Documents\ConvertXToDVD
2014-02-08 12:07 - 2011-09-10 17:24 - 00001189 _____ () C:\Users\Sebastian\AppData\Roaming\vso_ts_preview.xml
2014-02-08 12:07 - 2011-05-25 22:30 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Vso
2014-02-06 18:16 - 2012-12-30 13:50 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Media Player Classic
2014-02-06 13:16 - 2014-02-12 23:11 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-12 23:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-12 23:11 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-12 23:11 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-12 23:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-12 23:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-12 23:11 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-12 23:11 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-12 23:11 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-12 23:11 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-12 23:11 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-12 23:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-12 23:11 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-12 23:11 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-12 23:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-12 23:11 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-12 23:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-12 23:11 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-12 23:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-12 23:11 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-12 23:11 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-12 23:11 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-12 23:11 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-12 23:11 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-12 23:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-12 23:11 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-12 23:11 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-12 23:11 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-12 23:11 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-12 23:11 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-12 23:11 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-12 23:11 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-12 23:11 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-12 23:11 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-12 23:11 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-12 23:11 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-12 23:11 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-12 23:11 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-12 23:11 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
Files to move or delete:
====================
C:\ProgramData\575533705.exe
C:\Users\Sebastian\AppData\Roaming\msconfig.ini
Some content of TEMP:
====================
C:\Users\Sebastian\AppData\Local\Temp\hq-video-pro-1-4.exe
C:\Users\Sebastian\AppData\Local\Temp\vlc-2.1.3-win32.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-03 08:27
==================== End Of Log ============================
--- --- --- --- --- --- Addition.txt: FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-03-2014 01
Ran by Sebastian at 2014-03-08 10:00:32
Running from C:\Users\Sebastian\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
3114-W-A64-R SATARAID5 (HKLM\...\{6E955221-1239-4B69-A955-9EA75F6B920C}) (Version: 1.5.15.0 - Silicon Image)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
AC3File 0.6b (HKLM-x32\...\AC3File_is1) (Version: 0.6b - Alexander Vigovsky)
Active@ Hard Disk Monitor (HKLM-x32\...\{1C42D474-BDBD-4200-829D-28246879365D}) (Version: 2.1.0 - LSoft Technologies Inc)
Adobe Audition 1.5 (HKLM-x32\...\{86EF9FC4-F209-4520-B7E1-C7FF0EEBDFFF}) (Version: 1.5 - Adobe Systems)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.4.634 - Adobe Systems, Inc.)
Air Display Support (HKLM\...\{8064AB78-B852-4D74-8649-5C5A3059A942}) (Version: 1.3.4 - Avatron Software, Inc)
AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.3.1.0 - SlySoft)
Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft TotalMedia Theatre 3 (HKLM-x32\...\InstallShield_{B5F47039-9B19-4AC3-9A4A-E1CA3068E59F}) (Version: 3.0.1.195 - ArcSoft)
ArcSoft TotalMedia Theatre 3 (x32 Version: 3.0.1.120 - ArcSoft) Hidden
ArcSoft TotalMedia Theatre 6 (HKLM-x32\...\InstallShield_{5232358C-7C23-4319-8271-E43F924196AC}) (Version: 6.0.1.123 - ArcSoft)
ArcSoft TotalMedia Theatre 6 (x32 Version: 6.0.1.123 - ArcSoft) Hidden
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2013 - Avast Software)
avi.NET 3.5.1.0 (HKLM-x32\...\avi.NET 3.5.1.0) (Version: - )
Avidemux 2.6 (32-bit) (HKLM-x32\...\Avidemux 2.6) (Version: 2.6.1.8321 - )
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version: - )
Bitrix24 für Windows 2.0 (HKLM-x32\...\{F59E5FF1-199C-4267-8189-1B8CF7187971}_is1) (Version: 2.0 - Bitrix, Inc.)
Blu-ray Converter Ultimate 1.2.0.14 (HKLM-x32\...\Blu-ray Converter Ultimate_is1) (Version: - VSO-Software SARL)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.10 - Piriform)
CCVPlugin 1.6 (HKLM-x32\...\CCVPlugin_is1) (Version: - TomGaines)
CD-Autostart-Manager 2006 (HKLM-x32\...\{F8B0D4F5-03D6-4C5F-BFC8-7886176D5848}) (Version: 2.00.0000 - Wirth New Media)
Cinematic Collection Viewer 2.8 (HKLM-x32\...\CCViewer_is1) (Version: - TomGaines)
CL-Eye Driver (HKLM-x32\...\CL-Eye Driver) (Version: 5.0.1.0218 - Code Laboratories, Inc.)
CloneDVD 5.6.0.0 (HKLM-x32\...\MainApp.exe_is1) (Version: - Copyright (C) 2003-2012 Aviosoft.)
CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
CloneDVDmobile (HKLM-x32\...\CloneDVDmobile) (Version: 1.8.0.0 - SlySoft)
ConvertXtoDVD 4.1.19.365 (HKLM-x32\...\{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1) (Version: 4.1.19.365 - )
Copy Handler 1.32Final (HKLM\...\{9CF6A157-F0E8-4216-B229-C0CA8204BE2C}_is1) (Version: 1.32Final - Józef Starosczyk)
CrystalDiskInfo 4.2.0a (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 4.2.0a - Crystal Dew World)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.2701.51 - CyberLink Corp.)
CyberLink PowerDVD 10 (x32 Version: 10.0.2701.51 - CyberLink Corp.) Hidden
Data Lifeguard Diagnostic for Windows 1.24 (HKLM-x32\...\{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1) (Version: - Western Digital Corporation)
Dawicontrol RAID Monitor (HKLM-x32\...\{19C1EB85-C314-4D79-8F3D-4BE5EC17A64A}) (Version: 3.3.4 - Dawicontrol GmbH)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{81FB7C60-565A-4869-9D90-3BE1D270E8B7}) (Version: - Microsoft)
Diablo II (HKLM-x32\...\Diablo II) (Version: - Blizzard Entertainment)
DivX Browser Bar DE Toolbar (HKLM-x32\...\DivX_Browser_Bar_DE Toolbar) (Version: 6.13.3.1 - DivX Browser Bar DE) <==== ATTENTION
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.90 - DivX, LLC)
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
DVD Audio Extractor 7.0.2 (HKLM-x32\...\DVD Audio Extractor_is1) (Version: - Computer Application Studio)
DVD Decrypter (Remove Only) (HKLM-x32\...\DVD Decrypter) (Version: - )
DVD Profiler Version 3.8.2 (HKLM-x32\...\InvelosDVDProfiler_is1) (Version: - )
DVDFab 8.2.1.0 (07/09/2012) Qt (HKLM-x32\...\DVDFab 8 Qt_is1) (Version: - Fengtao Software Inc.)
Ease Audio Converter 5.27 (HKLM-x32\...\Ease Audio Converter_is1) (Version: - )
EasyBCD 2.0 (HKLM-x32\...\EasyBCD) (Version: 2.0 - NeoSmart Technologies)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 14.1.11318 - Landesfinanzdirektion Thüringen)
EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.01.02 - )
Ext2Fsd 0.51 (HKLM\...\Ext2Fsd_is1) (Version: 0.51 - Matt Wu)
ffdshow v1.3.4504 [2013-03-12] (HKLM-x32\...\ffdshow_is1) (Version: 1.3.4504.0 - )
FileZilla Client 3.7.4.1 (HKLM-x32\...\FileZilla Client) (Version: 3.7.4.1 - Tim Kosse)
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{6C5F8503-55D2-4398-858C-362B7A7AF51C}) (Version: 2.1.31.0 - MAGIX AG)
FreeCommander 2009.02b (HKLM-x32\...\FreeCommander_is1) (Version: 2009.02 - Marek Jasinski)
GaDaBaMa 3.1.2 (HKLM-x32\...\{3D2E5E45-E7DF-4376-8F43-7DEB26A8143E}_is1) (Version: - Keyser)
Google Chrome (HKCU\...\Google Chrome) (Version: 33.0.1750.117 - Google Inc.)
Google Earth Plug-in (HKLM-x32\...\{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}) (Version: 6.1.0.5001 - Google)
Google Update Helper (x32 Version: 1.3.21.123 - Google Inc.) Hidden
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version: - )
HandBrake 0.9.9.1 (HKLM-x32\...\HandBrake) (Version: 0.9.9.1 - )
Hard Disk Sentinel PRO (HKLM-x32\...\Hard Disk Sentinel_is1) (Version: - HDS)
HashCheck Shell Extension (x86-32) (HKLM-x32\...\HashCheck Shell Extension) (Version: 2.1.11.1 - Kai Liu)
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version: - EFD Software)
HD Tune Pro 5.00 (HKLM-x32\...\HD Tune Pro_is1) (Version: - EFD Software)
HQ-Video-Pro-1.4 (HKLM-x32\...\HQ-Video-Pro-1.4) (Version: 1.34.2.13 - HQ-Video) <==== ATTENTION
HyperCam 3 (HKLM-x32\...\HyperCam 3) (Version: 3.3.1109.19 - Solveig Multimedia)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.5.0 - LIGHTNING UK!)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.35 - Irfan Skiljan)
iTunes (HKLM\...\{7FCDABCC-1A1E-4D61-909D-BA9495172774}) (Version: 11.0.3.42 - Apple Inc.)
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDC (HKCU\...\15f5e573f277408d) (Version: 1.1.722.93 - Aragon IT Services)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
K-Lite Codec Pack (64-bit) v4.5.0 (HKLM\...\KLiteCodecPack64_is1) (Version: 4.5.0 - )
LoadDVD Version 2.08 (HKLM-x32\...\LoadDVD_is1) (Version: - )
LockHunter 2.0 beta 2, 64 bit (HKLM\...\LockHunter_is1) (Version: - Crystal Rich, Ltd)
MAGIX Speed burnR (MSI) (HKLM-x32\...\MAGIX_{F30AE017-6791-43F1-8591-D31EDDDDFF1A}) (Version: 7.0.2.6 - MAGIX AG)
MAGIX Speed burnR (MSI) (Version: 7.0.2.6 - MAGIX AG) Hidden
MAGIX Video deluxe 2013 Premium (HKLM-x32\...\MAGIX_{47E960B1-A285-4D31-87BA-4D2936FC8FF1}) (Version: 12.0.0.32 - MAGIX AG)
MAGIX Video deluxe 2013 Premium (Version: 12.0.0.32 - MAGIX AG) Hidden
MakeMKV v1.6.16 (HKLM-x32\...\MakeMKV) (Version: v1.6.16 - GuinpinSoft inc)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
MediaInfo 0.7.61 (HKLM\...\MediaInfo) (Version: 0.7.61 - MediaArea.net)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Access Runtime 2010 (HKLM-x32\...\Office14.AccessRT) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Access Runtime 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Runtime MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MKVToolNix 6.4.1 (HKLM-x32\...\MKVtoolnix) (Version: 6.4.1 - Moritz Bunkus)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NVIDIA 3D Vision Treiber 266.58 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 266.58 - NVIDIA Corporation)
NVIDIA Grafiktreiber 266.58 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 266.58 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.265.36.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6658 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 266.58 (Version: 266.58 - NVIDIA Corporation) Hidden
Ontrack EasyRecovery Professional (HKLM-x32\...\InstallShield_{268723B7-A994-4286-9F85-B974D5CAFC7B}) (Version: 6.21.03 - Kroll Ontrack Inc.)
Ontrack EasyRecovery Professional (x32 Version: 6.21.03 - Kroll Ontrack Inc.) Hidden
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Opera 12.15 (HKLM-x32\...\Opera 12.15.1748) (Version: 12.15.1748 - Opera Software ASA)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.2 - Frank Heindörfer, Philip Chinery)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)
Recuva (HKLM\...\Recuva) (Version: 1.43 - Piriform)
Replay Media Catcher 4 (4.3.2) (HKLM-x32\...\Replay Media Catcher 4) (Version: 4.3.2 - Applian Technologies)
RocketDock 1.3.5 (HKLM-x32\...\RocketDock_is1) (Version: - Punk Software)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{54846D1D-E5D5-4A28-AA6D-7208259007EA}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Smart Data Recovery v4.4 (HKLM-x32\...\Smart Data Recovery_is1) (Version: 4.4 - Smart PC Solutions)
SmartPack 1.20.6 (HKLM-x32\...\PlexUtil) (Version: 1.20.6 - PLDS)
Snagit 11 (HKLM-x32\...\{59F35E40-FF3C-11E0-858F-E0724824019B}) (Version: 11.0.0.323 - TechSmith Corporation)
Spdifer 0.3b (HKLM-x32\...\Spdifer_is1) (Version: 0.3b - Alexander Vigovsky)
StreamTransport version: 1.1.1.1 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
SubRip 1.20 (remove only) (HKLM-x32\...\SubRip) (Version: - )
Subtitle Edit 3.3.1 (HKLM-x32\...\SubtitleEdit_is1) (Version: 3.3.1.1593 - Nikse)
SubtitleCreator (HKLM-x32\...\SubtitleCreator) (Version: V2.2 - Erik Vullings)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TF-Addon 1.03 for Project X (HKLM-x32\...\TFADDON4PX_is1) (Version: 1.03 - Aldarin)
TMPGEnc Authoring Works 4 (HKLM-x32\...\{D7D38949-8251-4F07-BC2C-AA767308010B}) (Version: 4.0.11.39 - Pegasys Inc.)
TopfHDRead/Write V0.14 (HKLM-x32\...\TopfHDRW) (Version: - )
Total Video Converter 3.70 100621 (HKLM-x32\...\Total Video Converter 3.70_is1) (Version: - EffectMatrix Inc.)
UltraISO Premium V9.52 (HKLM-x32\...\UltraISO_is1) (Version: - )
Unlocker 1.9.1 (HKLM-x32\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.AccessRT_{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.AccessRT_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.AccessRT_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837583) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{E21274CE-CA0C-49FA-93F4-DC292A052264}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.AccessRT_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.AccessRT_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: - Elaborate Bytes)
VLC Codec Pack 2.0.5 (HKLM-x32\...\VLC - Codec Pack) (Version: 2.0.5 - VLC Codec Pack)
VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VLC Setup Helper 4.05 (HKLM-x32\...\VLC Setup Helper_is1) (Version: - )
WAV to AC3 Encoder 5.0 (HKLM-x32\...\WAV to AC3 Encoder_is1) (Version: - Wieslaw Soltes)
WAV to AC3 Encoder 5.0-AMD64 (HKLM\...\WAV to AC3 Encoder_is1) (Version: - Wieslaw Soltes)
Win7codecs (HKLM-x32\...\{8C0CAA7A-3272-4991-A808-2C7559DE3409}) (Version: 3.9.2 - Shark007)
Winamp (HKLM-x32\...\Winamp) (Version: 5.61 - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WISO Steuer 2012 (HKLM-x32\...\{0CC1DAFB-40C8-4903-953D-471E541477C7}) (Version: 19.00.7303 - Buhl Data Service GmbH)
x64 Components v3.9.2 (HKLM\...\x64 Components_is1) (Version: 3.9.2 - Shark007)
XMedia Recode 3.0.4.6 (HKLM-x32\...\XMedia Recode) (Version: 3.0.4.6 - Sebastian Dörfler)
XMedia Recode Version 3.1.4.9 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.4.9 - XMedia Recode)
XnView 1.98.2 (HKLM-x32\...\XnView_is1) (Version: 1.98.2 - Gougelet Pierre-e)
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)
Yahoo! Detect (HKLM-x32\...\YTdetect) (Version: - )
Zeugnis-Generator 12.0 (HKLM-x32\...\{6A5D6552-7645-48F4-8922-475ADA18EBD4}) (Version: 12.00.0001 - H&P Infomedia)
==================== Restore Points =========================
21-02-2014 14:00:54 Windows Update
27-02-2014 00:02:07 Windows Update
03-03-2014 22:04:59 Windows Update
07-03-2014 22:48:19 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2012-10-16 18:22 - 00001349 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {13098894-EFB5-4B86-9046-39C01221A4AA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-01-15] (Google Inc.)
Task: {1328C531-B6BD-4E07-9894-A6562E53D29B} - System32\Tasks\HQ-Video-Pro-1.4-chromeinstaller => C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-chromeinstaller.exe [2014-03-03] (HQ-Video) <==== ATTENTION
Task: {196D0FBC-1C4B-4A27-862B-A29C4C9C02D7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-01-15] (Google Inc.)
Task: {3153CCD4-09BE-4DEB-856C-053730064274} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-23] (Adobe Systems Incorporated)
Task: {5C3BF9E2-BF70-44C9-B811-CFF563E884E1} - System32\Tasks\HQ-Video-Pro-1.4-enabler => C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-enabler.exe [2014-03-03] (HQ-Video) <==== ATTENTION
Task: {6A94475B-84B7-4DB8-821C-A52044D4FFBC} - System32\Tasks\HQ-Video-Pro-1.4-updater => C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-updater.exe [2014-03-03] (HQ-Video) <==== ATTENTION
Task: {743C2D4E-5931-4594-83A5-B6921BAA1EFD} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001UA => C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-27] (Google Inc.)
Task: {884C52A8-DA1A-425E-A97E-F3FE5CB00487} - System32\Tasks\BackgroundContainer Startup Task => Rundll32.exe "C:\Users\Sebastian\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <==== ATTENTION
Task: {B4E790BF-4F47-4A57-86C2-D2B92B5DFE6F} - System32\Tasks\FoxTab => C:\Users\SEBAST~1\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {B50D529B-8863-41AC-91AA-9B4C0842C632} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2009-11-17] (ASUSTeK Computer Inc.)
Task: {B56274C7-A5BF-4A97-B0EA-8BAEF01973EA} - System32\Tasks\HQ-Video-Pro-1.4-firefoxinstaller => C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-firefoxinstaller.exe [2014-03-03] (HQ-Video) <==== ATTENTION
Task: {B7D83962-9077-4917-91BE-AEB8830042D1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {CF18DAF0-D474-47AE-951B-177B13D7DE98} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)
Task: {E7198916-0B3F-47C0-BD96-F0BDF8B92DE2} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-02-16] (AVAST Software)
Task: {FAAB5F72-8146-43C5-BF50-B3D93033B555} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001Core => C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-27] (Google Inc.)
Task: {FBF5AC7C-C0F5-490E-A623-39124A923A42} - System32\Tasks\HQ-Video-Pro-1.4-codedownloader => C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-codedownloader.exe [2014-03-03] (HQ-Video) <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FoxTab.job => C:\Users\SEBAST~1\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001Core.job => C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001UA.job => C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HQ-Video-Pro-1.4-chromeinstaller.job => C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\HQ-Video-Pro-1.4-codedownloader.job => C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\HQ-Video-Pro-1.4-enabler.job => C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\HQ-Video-Pro-1.4-firefoxinstaller.job => C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\HQ-Video-Pro-1.4-updater.job => C:\Program Files (x86)\HQ-Video-Pro-1.4\HQ-Video-Pro-1.4-updater.exe <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2011-08-21 21:10 - 2005-03-12 00:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2011-12-25 13:13 - 2010-03-07 19:05 - 00290816 _____ () C:\Program Files\Copy Handler\chext64.dll
2005-10-05 17:20 - 2005-10-05 17:20 - 00148480 _____ () C:\Program Files\Silicon Image\3114-W-A64-R SATARAID5\SATARaid5ConfigService.exe
2011-03-31 19:03 - 2012-10-25 10:26 - 00078456 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2011-03-31 19:03 - 2012-10-25 10:26 - 00386168 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2013-02-24 21:04 - 2013-02-24 21:04 - 00704008 _____ () C:\Windows\SysWOW64\C2MP\TrayMenu.exe
2014-03-03 18:48 - 2014-02-13 01:52 - 05861376 __RSH () C:\ProgramData\575533705.exe
2014-03-07 23:00 - 2014-03-07 19:45 - 02186752 _____ () C:\Program Files\AVAST Software\Avast\defs\14030701\algo.dll
2012-10-11 20:56 - 2012-10-11 20:56 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-10-11 20:56 - 2012-10-11 20:56 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-12-15 11:21 - 2013-12-15 11:21 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-02-15 12:10 - 2014-02-15 12:10 - 03578992 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-01-07 18:48 - 2011-01-07 18:48 - 00235624 _____ () C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:264B2CC4
AlternateDataStreams: C:\ProgramData\Temp:39413AC3
AlternateDataStreams: C:\ProgramData\Temp:E8BE05FA
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TotalMedia Server.lnk => C:\Windows\pss\TotalMedia Server.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WISO Mein Steuer-Sparbuch heute.lnk => C:\Windows\pss\WISO Mein Steuer-Sparbuch heute.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Copy Handler =>
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Google Update => "C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RemoteControl10 => "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
==================== Faulty Device Manager Devices =============
Name: archlp
Description: archlp
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ArcSec
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (03/08/2014 10:00:17 AM) (Source: Windows Search Service) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <4, 0x8004117f, Fehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects>.
Error: (03/08/2014 10:00:17 AM) (Source: Windows Search Service) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.
Details:
0x%08x (0x8004117f - Der Inhaltsindexserver kann wegen eines Datenbankfehlers keine Daten aktualisieren oder auf sie zugreifen. Beenden Sie den Suchdienst, und starten Sie ihn erneut. Wenn das Problem weiterhin besteht, setzen Sie den Inhaltsindex zurück, und crawlen Sie ihn erneut. In manchen Fällen muss der Inhaltsindex möglicherweise gelöscht und erneut erstellt werden. (HRESULT : 0x8004117f))
Error: (03/08/2014 10:00:17 AM) (Source: ESENT) (User: )
Description: Windows (3272) Windows: Neue Protokolldatei konnte nicht erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (03/08/2014 10:00:17 AM) (Source: ESENT) (User: )
Description: Windows (3272) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log" nach "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log" zu verschieben, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Verschieben von Dateien.
Error: (03/08/2014 09:59:35 AM) (Source: Windows Search Service) (User: )
Description: Fehler beim Erstellen des neuen Suchindex durch Windows Search. Interner Fehler <4, 0x8004117f, Fehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects>.
Error: (03/08/2014 09:59:35 AM) (Source: Windows Search Service) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.
Details:
0x%08x (0x8004117f - Der Inhaltsindexserver kann wegen eines Datenbankfehlers keine Daten aktualisieren oder auf sie zugreifen. Beenden Sie den Suchdienst, und starten Sie ihn erneut. Wenn das Problem weiterhin besteht, setzen Sie den Inhaltsindex zurück, und crawlen Sie ihn erneut. In manchen Fällen muss der Inhaltsindex möglicherweise gelöscht und erneut erstellt werden. (HRESULT : 0x8004117f))
Error: (03/08/2014 09:59:35 AM) (Source: ESENT) (User: )
Description: Windows (4748) Windows: Neue Protokolldatei konnte nicht erstellt werden, weil die Datenbank nicht auf das Protokolllaufwerk schreiben kann. Das Laufwerk ist möglicherweise schreibgeschützt, falsch konfiguriert, beschädigt oder hat zu wenig freien Speicherplatz. Fehler -1032.
Error: (03/08/2014 09:59:35 AM) (Source: ESENT) (User: )
Description: Windows (4748) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log" nach "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log" zu verschieben, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Verschieben von Dateien.
Error: (03/08/2014 09:59:02 AM) (Source: ESENT) (User: )
Description: DllHost (4752) WebCacheLocal: Fehler -1032 (0xfffffbf8) beim Öffnen von Protokolldatei C:\Users\Sebastian\AppData\Local\Microsoft\Windows\WebCache\V01.log.
Error: (03/08/2014 09:59:02 AM) (Source: ESENT) (User: )
Description: DllHost (4752) WebCacheLocal: Versuch, Datei "C:\Users\Sebastian\AppData\Local\Microsoft\Windows\WebCache\V01.log" für den Lesezugriff zu öffnen, ist mit Systemfehler 5 (0x00000005): "Zugriff verweigert " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
System errors:
=============
Error: (03/08/2014 10:00:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (03/08/2014 10:00:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147217025.
Error: (03/08/2014 09:59:35 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (03/08/2014 09:59:35 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147217025.
Error: (03/08/2014 09:53:48 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (03/08/2014 09:53:16 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ArcSec
Error: (03/08/2014 09:52:11 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\pfc.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (03/08/2014 09:52:11 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\pfc.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (03/08/2014 09:52:11 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\pfc.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (03/08/2014 09:49:53 AM) (Source: DCOM) (User: )
Description: {3EB3C877-1F16-487C-9050-104DBCD66683}
Microsoft Office Sessions:
=========================
Error: (03/08/2014 10:00:17 AM) (Source: Windows Search Service)(User: )
Description: 40x8004117fFehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects
Error: (03/08/2014 10:00:17 AM) (Source: Windows Search Service)(User: )
Description:
Details:
0x%08x (0x8004117f - Der Inhaltsindexserver kann wegen eines Datenbankfehlers keine Daten aktualisieren oder auf sie zugreifen. Beenden Sie den Suchdienst, und starten Sie ihn erneut. Wenn das Problem weiterhin besteht, setzen Sie den Inhaltsindex zurück, und crawlen Sie ihn erneut. In manchen Fällen muss der Inhaltsindex möglicherweise gelöscht und erneut erstellt werden. (HRESULT : 0x8004117f))
Error: (03/08/2014 10:00:17 AM) (Source: ESENT)(User: )
Description: Windows3272Windows: -1032
Error: (03/08/2014 10:00:17 AM) (Source: ESENT)(User: )
Description: Windows3272Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.logC:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log-1032 (0xfffffbf8)5 (0x00000005)Zugriff verweigert
Error: (03/08/2014 09:59:35 AM) (Source: Windows Search Service)(User: )
Description: 40x8004117fFehler beim Hinzufügen des Projekts: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects
Error: (03/08/2014 09:59:35 AM) (Source: Windows Search Service)(User: )
Description:
Details:
0x%08x (0x8004117f - Der Inhaltsindexserver kann wegen eines Datenbankfehlers keine Daten aktualisieren oder auf sie zugreifen. Beenden Sie den Suchdienst, und starten Sie ihn erneut. Wenn das Problem weiterhin besteht, setzen Sie den Inhaltsindex zurück, und crawlen Sie ihn erneut. In manchen Fällen muss der Inhaltsindex möglicherweise gelöscht und erneut erstellt werden. (HRESULT : 0x8004117f))
Error: (03/08/2014 09:59:35 AM) (Source: ESENT)(User: )
Description: Windows4748Windows: -1032
Error: (03/08/2014 09:59:35 AM) (Source: ESENT)(User: )
Description: Windows4748Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.logC:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log-1032 (0xfffffbf8)5 (0x00000005)Zugriff verweigert
Error: (03/08/2014 09:59:02 AM) (Source: ESENT)(User: )
Description: DllHost4752WebCacheLocal: C:\Users\Sebastian\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8)
Error: (03/08/2014 09:59:02 AM) (Source: ESENT)(User: )
Description: DllHost4752WebCacheLocal: C:\Users\Sebastian\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8)5 (0x00000005)Zugriff verweigert
CodeIntegrity Errors:
===================================
Date: 2012-09-01 18:01:35.695
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume7\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-09-01 18:01:35.680
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume7\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-09-01 18:01:35.662
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume7\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-09-01 18:01:35.623
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume7\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-07-28 20:52:50.556
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume7\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-07-28 20:52:50.541
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume7\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-07-28 20:52:50.525
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume7\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-07-28 20:52:50.494
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume7\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-05-07 20:33:39.939
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume6\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-05-07 20:33:39.939
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume6\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 46%
Total physical RAM: 4087.03 MB
Available physical RAM: 2191.61 MB
Total Pagefile: 8172.24 MB
Available Pagefile: 6214.31 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (Main) (Fixed) (Total:1863.01 GB) (Free:74.61 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (E) (Fixed) (Total:1863.01 GB) (Free:0.39 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (H) (Fixed) (Total:5589.04 GB) (Free:0.8 GB) NTFS
Drive j: (J) (Fixed) (Total:5589.04 GB) (Free:7.17 GB) NTFS
Drive k: (K) (Fixed) (Total:5589.04 GB) (Free:2.24 GB) NTFS
Drive l: (L) (Fixed) (Total:5589.04 GB) (Free:0.54 GB) NTFS
Drive m: (M) (Fixed) (Total:5589.04 GB) (Free:0.71 GB) NTFS
Drive s: (S) (Fixed) (Total:1397.26 GB) (Free:4.61 GB) NTFS
Drive u: (U) (Fixed) (Total:1397.26 GB) (Free:1 GB) NTFS
Drive x: (X) (Fixed) (Total:1397.26 GB) (Free:0.69 GB) NTFS
Drive z: (Z) (Fixed) (Total:1397.27 GB) (Free:0.09 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 36B78EA7)
Partition 1: (Active) - (Size=-198626803200) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 36B78EA0)
Partition 1: (Active) - (Size=-198626803200) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: AE2B8D70)
Partition: GPT Partition Type.
========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 00000002)
Partition 1: (Not Active) - (Size=-198625402368) - (Type=42)
========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: 000E0E24)
Partition: GPT Partition Type.
========================================================
Disk: 5 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: FB0920ED)
Partition: GPT Partition Type.
========================================================
Disk: 6 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 5BBC7CAE)
Partition 1: (Not Active) - (Size=-198625402368) - (Type=42)
========================================================
Disk: 7 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: DB441FB3)
Partition: GPT Partition Type.
========================================================
Disk: 8 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: BA42A43E)
Partition: GPT Partition Type.
========================================================
Disk: 9 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: 0002DE0F)
Partition 1: (Not Active) - (Size=-198625402368) - (Type=42)
========================================================
Disk: 10 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: B919CCCA)
Partition: GPT Partition Type.
========================================================
Disk: 11 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: B919CCCC)
Partition: GPT Partition Type.
========================================================
Disk: 12 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: DB441FB2)
Partition: GPT Partition Type.
========================================================
Disk: 13 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: B919CCCD)
Partition: GPT Partition Type.
========================================================
Disk: 14 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: B919CCCB)
Partition: GPT Partition Type.
========================================================
Disk: 15 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: DB441FB0)
Partition: GPT Partition Type.
========================================================
Disk: 16 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 1C16DB7E)
Partition 1: (Not Active) - (Size=-198625402368) - (Type=42)
========================================================
Disk: 17 (MBR Code: Windows XP) (Size: 1397 GB) (Disk ID: 000343D7)
Partition 1: (Not Active) - (Size=-698721378304) - (Type=07 NTFS)
========================================================
Disk: 18 (Size: 1397 GB) (Disk ID: 98501EC4)
Partition 1: (Not Active) - (Size=-698727006208) - (Type=07 NTFS)
========================================================
Disk: 19 (MBR Code: Windows XP) (Size: 1397 GB) (Disk ID: 000E2EC0)
Partition: GPT Partition Type.
========================================================
Disk: 20 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: BC37B8A4)
Partition: GPT Partition Type.
==================== End Of Log ============================
GMER.log GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-08 10:14:42
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 WDC_WD20EARS-00MVWB0 rev.51.0AB51 1863,02GB
Running: Gmer-19357.exe; Driver: C:\Users\SEBAST~1\AppData\Local\Temp\fxlyauoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[572] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\system32\services.exe[632] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\system32\winlogon.exe[692] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[804] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\system32\nvvsvc.exe[900] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[1012] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[444] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[468] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1072] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1252] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\system32\nvvsvc.exe[1264] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1388] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1596] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1624] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Program Files (x86)\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1736] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1760] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075861465 2 bytes [86, 75]
.text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758614bb 2 bytes [86, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1908] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1968] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\Program Files (x86)\Dawicontrol GmbH\Dawicontrol RAID Monitor\RAIDservice.exe[1644] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\Windows\system32\svchost.exe[1800] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe[1828] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\Explorer.EXE[2164] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Program Files\Silicon Image\3114-W-A64-R SATARAID5\SATARaid5ConfigService.exe[2524] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[2560] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\Windows\system32\svchost.exe[2588] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\SysWOW64\C2MP\TrayMenu.exe[2948] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\Windows\SysWOW64\C2MP\TrayMenu.exe[2948] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075861465 2 bytes [86, 75]
.text C:\Windows\SysWOW64\C2MP\TrayMenu.exe[2948] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758614bb 2 bytes [86, 75]
.text ... * 2
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[3020] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\ProgramData\575533705.exe[3048] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\ProgramData\575533705.exe[3048] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075861465 2 bytes [86, 75]
.text C:\ProgramData\575533705.exe[3048] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000758614bb 2 bytes [86, 75]
.text ... * 2
.text C:\Windows\system32\wbem\wmiprvse.exe[116] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3644] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Windows\SysWOW64\WScript.exe[4960] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\Windows\SysWOW64\WScript.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075861465 2 bytes [86, 75]
.text C:\Windows\SysWOW64\WScript.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758614bb 2 bytes [86, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe[1720] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
.text C:\Windows\system32\AUDIODG.EXE[2336] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 000000007773eecd 1 byte [62]
.text C:\Users\Sebastian\Downloads\Gmer-19357.exe[4168] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000759ba2ba 1 byte [62]
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [2624:4008] 000007feea8e9688
---- EOF - GMER 2.1 ----
Ich send jetzt mal ein paar Stoßgebete dafür, dass mir da wer helfen kann. Es wäre das pure Grauen, wenn ich diesen Rechner neu aufsetzen müsste... Thx HerbieH Geändert von HerbieH (08.03.2014 um 10:57 Uhr) |
|
08.03.2014, 11:26
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Langsam, MBam startet nicht, auch im abgesicherten Modus hi,
__________________Scan mit Combofix
__________________ |
|
08.03.2014, 17:15
| #3 |
| | Windows 7: Langsam, MBam startet nicht, auch im abgesicherten Modus Danke, nur leider...
__________________auch Combofix läßt sich nicht starten, gleiche "Kann die Datei nicht finden"-Fehlermeldung wie bei Mbam.  Keine Ahnung wie ich es gemacht hab, hab aber Chamäleon grad zum Laufen bekommen. Malewarebytes ist dann auch gestartet...und direkt abgestürzt. Hab alle Chamäleon-Buttons ausprobiert, Ergebnis war immer das gleiche. Hier noch das Absturz-Log von Windows dazu: Code:
ATTFilter Problemsignatur:
Problemereignisname: APPCRASH
Anwendungsname: mbam.exe
Anwendungsversion: 1.75.0.1
Anwendungszeitstempel: 511f8eb2
Fehlermodulname: OLEAUT32.dll
Fehlermodulversion: 6.1.7601.17676
Fehlermodulzeitstempel: 4e58702a
Ausnahmecode: c0000005
Ausnahmeoffset: 0001604c
Betriebsystemversion: 6.1.7601.2.1.0.256.1
Gebietsschema-ID: 1031
Zusatzinformation 1: 57dc
Zusatzinformation 2: 57dc1304986dca9230289ffa64901279
Zusatzinformation 3: 28cc
Zusatzinformation 4: 28cc6621fb6c2ab10f1972c10dd0ed81
Malwarebytes hab ich auch dazu bekommen nicht gleich abzuschmieren, beim Start des Scans kommt jedoch sofort der Laufzeitfehler 13. Und weg isses wieder... Hab mir die Beta von Malwarebytes 2 aus deren Forum geladen, die krieg ich nicht mal installiert. Update 17 Uhr: Es geht alles wieder! Die hässlichen Einträge aus dem Task Manager sind weg und es läßt sich auch alles starten. Ich kann das Programm UnHackMe empfehlen, der hat das Teil gegrillt, was übrig blieb war anscheinend eine Dateien-Blacklist, welche den Start von mbam und co verhinderte. Combofix umbenannt, durchlaufen lassen, danach war auch das Geschichte und es scheint alles wieder zu laufen. Malwarebytes bleibt noch immer hängen beim Scan-Start, das scheint aber an was anderem zu liegen. Der Windows Defender läuft auch wieder und das Virendatenbankupdate von Avast tut auch wieder Dienst. Danke für die Hilfe.  Hab jetzt erstmal den Kanal dicht, Thread kann geschloßen werden. Geändert von HerbieH (08.03.2014 um 12:34 Uhr) |
|
09.03.2014, 08:57
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Langsam, MBam startet nicht, auch im abgesicherten Modus Poste bitte ein frisches FRST log, ich glaub nicht dass alles runter is.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.03.2014, 12:13
| #5 |
| | Windows 7: Langsam, MBam startet nicht, auch im abgesicherten Modus Ok: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-03-2014 01
Ran by Sebastian (administrator) on SEBASTIAN-PC on 09-03-2014 12:06:19
Running from C:\Users\Sebastian\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe
(Dawicontrol GmbH) C:\Program Files (x86)\Dawicontrol GmbH\Dawicontrol RAID Monitor\RAIDservice.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
() C:\Program Files\Silicon Image\3114-W-A64-R SATARAID5\SATARaid5ConfigService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(VIA Technologies, Inc.) C:\Windows\system32\viakaraokesrv.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
() C:\Windows\SysWOW64\C2MP\TrayMenu.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Invelos Software) C:\Program Files (x86)\DVD Profiler\dvdpro.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5299320 2012-10-25] (VIA)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-02-16] (AVAST Software)
HKU\.DEFAULT\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\.DEFAULT\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\.DEFAULT\...\Policies\Explorer: [NoResolveSearch] 1
HKU\.DEFAULT\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-3146263950-3329543529-1817725048-1001\...\Policies\Explorer: [DisableThumbnails] 1
HKU\S-1-5-21-3146263950-3329543529-1817725048-1001\...\Policies\Explorer: [ThumbnailsOnNetworkFolders] 1
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3297265&octid=CT3297265&SearchSource=61&CUI=UN49078945308221305&UM=2&UP=SP2A9BDED2-EA9C-47CD-A3F3-15B6B72E88EC
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3631C9849CFBCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKLM-x32 - Default Value = {FE69C007-C452-4d3e-86D2-1730DF8BC871}
URLSearchHook: HKLM-x32 - (No Name) - {FE69C007-C452-4d3e-86D2-1730DF8BC871} - No File
URLSearchHook: HKCU - Default Value = {FE69C007-C452-4d3e-86D2-1730DF8BC871}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKLM-x32 - DefaultScope {E86BADBB-F734-42FB-852B-52C41B35559C} URL =
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKCU - DefaultScope {E86BADBB-F734-42FB-852B-52C41B35559C} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3297265&CUI=UN49078945308221305&UM=2
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=116295&tt=5012_8&babsrc=SP_ss&mntrId=2048d3ca000000000000bcaec5cbc100
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ANT&o=102823&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=4P&apn_dtid=YYYYYYYYDE&apn_uid=59197941-1565-452D-B09A-444CF6706190&apn_sauid=3CF080A9-EDA3-4159-B468-59FFD746B84C
SearchScopes: HKCU - {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {E86BADBB-F734-42FB-852B-52C41B35559C} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3297265&CUI=UN49078945308221305&UM=2
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - No Name - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Filter-x32: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default
FF user.js: detected! => C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\user.js
FF Homepage: about:newtab
FF Keyword.URL: hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3297265&SearchSource=2&CUI=UN18738971062560622&UM=2&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Sebastian\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Sebastian\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\babylon1.xml
FF SearchPlugin: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\Linkury Smartbar Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Linkury Smartbar - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\helperbar@helperbar.com [2012-04-20]
FF Extension: DownloadHelper - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-03]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\adblockpopups@jessehakanen.net.xpi [2012-06-28]
FF Extension: Adblock Plus - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-04-20]
FF Extension: QuickStores-Toolbar - C:\Program Files (x86)\Mozilla Firefox\extensions\quickstores@quickstores.de [2014-02-15]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-04-15]
Chrome:
=======
CHR HomePage: hxxp://search.conduit.com/?ctid=CT3297265&SearchSource=48&CUI=UN32143947505844536&UM=2
CHR DefaultSearchKeyword: search.conduit.com
CHR DefaultSearchProvider: Conduit
CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN32143947505844536&ctid=CT3297265&UM=2
CHR DefaultNewTabURL:
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\33.0.1750.117\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\33.0.1750.117\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\33.0.1750.117\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
CHR Extension: (YouTube) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-13]
CHR Extension: (Google Search) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-13]
CHR Extension: (AdBlock) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-11-25]
CHR Extension: (Google Wallet) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Better Pop Up Blocker) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpeeekfhbmikbdhlpjbfmnpgcbeggic [2011-08-27]
CHR Extension: (Gmail) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-13]
CHR HKCU\...\Chrome\Extension: [hkoahcaobjbihehldfimhblmhgalcipm] - C:\Users\Sebastian\AppData\Local\CRE\hkoahcaobjbihehldfimhblmhgalcipm.crx [2013-06-02]
CHR HKLM-x32\...\Chrome\Extension: [hidjnkeodmholilgafgdlgmgggbhnigl] - C:\Users\Sebastian\AppData\Roaming\SimilarSites\similarsites.crx [2013-06-02]
CHR HKLM-x32\...\Chrome\Extension: [hkoahcaobjbihehldfimhblmhgalcipm] - C:\Users\Sebastian\AppData\Local\CRE\hkoahcaobjbihehldfimhblmhgalcipm.crx [2013-06-02]
CHR StartMenuInternet: Google Chrome - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [43624 2012-08-14] (ArcSoft, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-16] (AVAST Software)
S4 bgsvcgen; C:\Windows\SysWOW64\bgsvcgen.exe [139264 2011-05-15] (SOURCENEXT)
R2 DcRaidMoSrv; C:\Program Files (x86)\Dawicontrol GmbH\Dawicontrol RAID Monitor\RAIDservice.exe [336384 2011-06-29] (Dawicontrol GmbH)
R2 SATARaid5 Config Service; C:\Program Files\Silicon Image\3114-W-A64-R SATARAID5\SATARaid5ConfigService.exe [148480 2005-10-05] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-10-22] (VIA Technologies, Inc.)
==================== Drivers (Whitelisted) ====================
R3 AirDisplay; C:\Windows\System32\DRIVERS\AVVideoCard.sys [15728 2011-05-05] (Windows (R) Win 7 DDK provider)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [139352 2013-07-31] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [139352 2013-07-31] (SlySoft, Inc.)
S3 appliand; C:\Windows\System32\DRIVERS\appliand.sys [33888 2011-06-26] (Applian Technologies Inc.)
R3 appliandMP; C:\Windows\System32\DRIVERS\appliand.sys [33888 2011-06-26] (Applian Technologies Inc.)
R1 ArcCtrl; C:\Windows\System32\drivers\ArcCtrl.sys [604192 2013-03-19] ()
R1 archlp; C:\Windows\System32\drivers\archlp.sys [139840 2011-11-18] ()
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-02-16] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-15] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-15] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1038072 2014-02-16] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [421704 2014-02-16] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [80184 2014-02-16] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-07] ()
R1 cdrbsdrv; C:\Windows\System32\Drivers\cdrbsdrv.sys [38944 2011-05-15] (B.H.A Corporation)
R0 DC324e; C:\Windows\System32\DRIVERS\DC324e.sys [51256 2011-06-29] (Dawicontrol GmbH)
R1 Ext2Fsd; C:\Windows\System32\Drivers\Ext2Fsd.sys [769816 2011-07-09] (www.ext2fsd.com)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S0 Partizan; C:\Windows\SysWOW64\drivers\Partizan.sys [35816 2014-03-08] (Greatis Software)
S3 pfc; C:\Windows\SysWOW64\drivers\pfc.sys [10368 2004-04-01] (Padus, Inc.)
S3 RegGuard; C:\Windows\SysWOW64\Drivers\regguard.sys [24416 2014-03-08] (Greatis Software)
R0 SI3114; C:\Windows\System32\DRIVERS\SI3114.sys [82984 2008-04-14] (Silicon Image, Inc)
R0 Si3114r5; C:\Windows\System32\DRIVERS\Si3114r5.sys [329256 2008-11-24] (Silicon Image, Inc)
R0 Si3132r5; C:\Windows\System32\DRIVERS\Si3132r5.sys [337960 2007-12-26] (Silicon Image, Inc)
R0 SiFilter; C:\Windows\System32\DRIVERS\SiWinAcc.sys [22056 2008-04-14] (Silicon Image, Inc)
R0 SiRemFil; C:\Windows\System32\DRIVERS\SiRemFil.sys [16936 2007-12-26] (Silicon Image, Inc.)
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [146928 2011-03-01] (CyberLink Corp.)
S1 ArcSec; system32\drivers\ArcSec.sys [X]
S3 catchme; \??\C:\baller\catchme.sys [X]
U4 SR;
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-09 12:06 - 2014-03-09 12:06 - 00022936 _____ () C:\Users\Sebastian\Downloads\FRST.txt
2014-03-09 12:05 - 2014-03-09 12:06 - 02156544 _____ (Farbar) C:\Users\Sebastian\Downloads\FRST64.exe
2014-03-09 09:39 - 2014-03-09 09:39 - 00001870 _____ () C:\Users\Public\Desktop\mkvmerge GUI.lnk
2014-03-08 22:44 - 2014-03-08 22:44 - 00291664 _____ () C:\Windows\Minidump\030814-138060-01.dmp
2014-03-08 22:07 - 2014-03-09 09:31 - 00000368 _____ () C:\Windows\SysWOW64\PARTIZAN.TXT
2014-03-08 22:07 - 2014-03-08 22:44 - 466328751 _____ () C:\Windows\MEMORY.DMP
2014-03-08 22:07 - 2014-03-08 22:07 - 00291864 _____ () C:\Windows\Minidump\030814-139667-01.dmp
2014-03-08 16:58 - 2014-03-08 16:58 - 00025524 _____ () C:\ComboFix.txt
2014-03-08 16:43 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-03-08 16:43 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-03-08 16:43 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-03-08 16:43 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-03-08 16:43 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-03-08 16:43 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-03-08 16:43 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-03-08 16:43 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-03-08 16:42 - 2014-03-08 16:58 - 00000000 ____D () C:\Qoobox
2014-03-08 16:42 - 2014-03-08 16:56 - 00000000 ____D () C:\Windows\erdnt
2014-03-08 16:33 - 2014-03-08 16:33 - 00037600 _____ (Greatis Software) C:\Windows\SysWOW64\Partizan.exe
2014-03-08 15:39 - 2014-03-08 16:20 - 00024416 _____ (Greatis Software) C:\Windows\SysWOW64\Drivers\regguard.sys
2014-03-08 15:39 - 2014-03-08 15:39 - 00037600 _____ (Greatis Software) C:\Windows\system32\Partizan.exe
2014-03-08 15:36 - 2014-03-08 15:36 - 00035816 _____ (Greatis Software) C:\Windows\SysWOW64\Drivers\Partizan.sys
2014-03-08 15:35 - 2014-03-08 16:10 - 00000000 ____D () C:\Users\Public\Documents\regruninfo
2014-03-08 15:35 - 2014-03-08 16:08 - 00000000 ____D () C:\Users\Sebastian\Documents\RegRun2
2014-03-08 15:35 - 2014-03-08 15:36 - 00000000 ____D () C:\Program Files (x86)\UnHackMe
2014-03-08 15:35 - 2014-03-08 15:35 - 00000418 _____ () C:\Windows\Tasks\UnHackMe Task Scheduler.job
2014-03-08 15:35 - 2014-03-08 15:35 - 00000002 RSHOT () C:\Windows\winstart.bat
2014-03-08 15:35 - 2014-03-08 15:35 - 00000002 RSHOT () C:\Windows\SysWOW64\AUTOEXEC.NT
2014-03-08 15:35 - 2010-11-11 12:44 - 00012808 _____ (Greatis Software, LLC.) C:\Windows\SysWOW64\Drivers\UnHackMeDrv.sys
2014-03-08 11:52 - 2014-03-09 09:31 - 00000728 _____ () C:\Windows\setupact.log
2014-03-08 11:52 - 2014-03-08 22:07 - 00005770 _____ () C:\Windows\PFRO.log
2014-03-08 11:52 - 2014-03-08 11:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-08 10:14 - 2014-03-08 10:14 - 00009447 _____ () C:\Users\Sebastian\Desktop\gmer.log
2014-03-08 10:03 - 2014-03-08 10:03 - 00054257 _____ () C:\Users\Sebastian\Desktop\FRST.txt
2014-03-08 10:03 - 2014-03-08 10:03 - 00048585 _____ () C:\Users\Sebastian\Desktop\Addition.txt
2014-03-08 09:59 - 2014-03-09 12:06 - 00000000 ____D () C:\FRST
2014-03-08 09:56 - 2014-03-08 09:56 - 00000480 _____ () C:\Users\Sebastian\Desktop\defogger_disable.log
2014-03-08 09:56 - 2014-03-08 09:56 - 00000000 _____ () C:\Users\Sebastian\defogger_reenable
2014-03-08 09:17 - 2014-03-08 16:38 - 00000000 ____D () C:\mb-c
2014-03-08 09:07 - 2014-03-08 17:00 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware1-7
2014-03-03 19:02 - 2014-03-03 19:02 - 00000519 _____ () C:\Users\Sebastian\AppData\Roaming\setting.ini
2014-03-03 18:59 - 2014-03-03 19:03 - 00000000 ____D () C:\Users\Sebastian\dwhelper
2014-03-03 18:58 - 2014-03-03 18:58 - 00008655 _____ () C:\Users\Sebastian\AppData\Roaming\gui.dat
2014-03-03 18:48 - 2014-03-06 20:10 - 00000000 ____D () C:\Program Files (x86)\GetFLV
2014-02-26 23:02 - 2014-01-09 03:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-02-26 23:02 - 2014-01-03 23:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-02-24 21:44 - 2014-03-03 09:21 - 00003394 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2014-02-23 12:06 - 2014-03-03 22:27 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-23 12:06 - 2014-02-23 12:27 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-15 12:10 - 2014-02-15 12:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-15 09:17 - 2014-02-15 09:17 - 04822473 _____ (Tim Kosse) C:\Users\Sebastian\Downloads\FileZilla_3.7.4.1_win32-setup.exe
2014-02-12 23:13 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 23:13 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 23:11 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 23:11 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 23:11 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 23:11 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 23:11 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 23:11 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 23:11 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 23:11 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 23:11 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 23:11 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 23:11 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 23:11 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 23:11 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 23:11 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 23:11 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 23:11 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 23:11 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 23:11 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 23:11 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 23:11 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 23:11 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 23:11 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 23:11 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 23:11 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 23:11 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 23:11 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 23:11 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 23:11 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 23:11 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 23:11 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 23:11 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 23:11 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 23:11 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 23:11 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 23:11 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 23:11 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 23:11 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 23:11 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 23:11 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 13:41 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 13:41 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 13:41 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 13:41 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 13:41 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 13:41 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 13:41 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 13:41 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 13:41 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 13:41 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 13:41 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 13:41 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 13:41 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 13:41 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 13:41 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 13:41 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 13:41 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 13:41 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 13:41 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 13:41 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 13:41 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 13:41 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 13:41 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 13:41 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
==================== One Month Modified Files and Folders =======
2014-03-09 12:06 - 2014-03-09 12:06 - 00022936 _____ () C:\Users\Sebastian\Downloads\FRST.txt
2014-03-09 12:06 - 2014-03-09 12:05 - 02156544 _____ (Farbar) C:\Users\Sebastian\Downloads\FRST64.exe
2014-03-09 12:06 - 2014-03-08 09:59 - 00000000 ____D () C:\FRST
2014-03-09 11:36 - 2013-03-16 17:29 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\vlc
2014-03-09 09:39 - 2014-03-09 09:39 - 00001870 _____ () C:\Users\Public\Desktop\mkvmerge GUI.lnk
2014-03-09 09:39 - 2009-07-14 05:45 - 00026064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-09 09:39 - 2009-07-14 05:45 - 00026064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-09 09:36 - 2011-03-31 21:12 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\DVD Profiler
2014-03-09 09:32 - 2011-04-01 13:19 - 00000000 ___RD () C:\Users\Sebastian\Desktop\Programme
2014-03-09 09:32 - 2011-03-31 19:11 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-03-09 09:31 - 2014-03-08 22:07 - 00000368 _____ () C:\Windows\SysWOW64\PARTIZAN.TXT
2014-03-09 09:31 - 2014-03-08 11:52 - 00000728 _____ () C:\Windows\setupact.log
2014-03-08 23:58 - 2011-03-31 18:17 - 01576329 _____ () C:\Windows\WindowsUpdate.log
2014-03-08 22:48 - 2012-07-05 19:09 - 00000131 ___SH () C:\ProgramData\.zreglib
2014-03-08 22:47 - 2011-04-03 13:57 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\dvdcss
2014-03-08 22:44 - 2014-03-08 22:44 - 00291664 _____ () C:\Windows\Minidump\030814-138060-01.dmp
2014-03-08 22:44 - 2014-03-08 22:07 - 466328751 _____ () C:\Windows\MEMORY.DMP
2014-03-08 22:44 - 2011-07-22 10:30 - 00000000 ____D () C:\Windows\Minidump
2014-03-08 22:07 - 2014-03-08 22:07 - 00291864 _____ () C:\Windows\Minidump\030814-139667-01.dmp
2014-03-08 22:07 - 2014-03-08 11:52 - 00005770 _____ () C:\Windows\PFRO.log
2014-03-08 21:17 - 2013-08-03 08:55 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\JDownloader v2.0
2014-03-08 17:09 - 2012-06-15 17:13 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\CrashDumps
2014-03-08 17:00 - 2014-03-08 09:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware1-7
2014-03-08 16:58 - 2014-03-08 16:58 - 00025524 _____ () C:\ComboFix.txt
2014-03-08 16:58 - 2014-03-08 16:42 - 00000000 ____D () C:\Qoobox
2014-03-08 16:56 - 2014-03-08 16:42 - 00000000 ____D () C:\Windows\erdnt
2014-03-08 16:56 - 2011-03-31 18:48 - 00000000 ___RD () C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-08 16:55 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-03-08 16:38 - 2014-03-08 09:17 - 00000000 ____D () C:\mb-c
2014-03-08 16:33 - 2014-03-08 16:33 - 00037600 _____ (Greatis Software) C:\Windows\SysWOW64\Partizan.exe
2014-03-08 16:32 - 2011-03-31 18:45 - 00000000 ____D () C:\Users\Sebastian
2014-03-08 16:20 - 2014-03-08 15:39 - 00024416 _____ (Greatis Software) C:\Windows\SysWOW64\Drivers\regguard.sys
2014-03-08 16:10 - 2014-03-08 15:35 - 00000000 ____D () C:\Users\Public\Documents\regruninfo
2014-03-08 16:08 - 2014-03-08 15:35 - 00000000 ____D () C:\Users\Sebastian\Documents\RegRun2
2014-03-08 15:39 - 2014-03-08 15:39 - 00037600 _____ (Greatis Software) C:\Windows\system32\Partizan.exe
2014-03-08 15:36 - 2014-03-08 15:36 - 00035816 _____ (Greatis Software) C:\Windows\SysWOW64\Drivers\Partizan.sys
2014-03-08 15:36 - 2014-03-08 15:35 - 00000000 ____D () C:\Program Files (x86)\UnHackMe
2014-03-08 15:35 - 2014-03-08 15:35 - 00000418 _____ () C:\Windows\Tasks\UnHackMe Task Scheduler.job
2014-03-08 15:35 - 2014-03-08 15:35 - 00000002 RSHOT () C:\Windows\winstart.bat
2014-03-08 15:35 - 2014-03-08 15:35 - 00000002 RSHOT () C:\Windows\SysWOW64\AUTOEXEC.NT
2014-03-08 13:45 - 2011-03-31 21:37 - 00000000 ___RD () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-08 13:43 - 2012-08-12 07:50 - 00000000 ____D () C:\javare
2014-03-08 13:27 - 2011-12-04 16:36 - 00072796 _____ () C:\Users\Sebastian\Desktop\Neues Textdokument.txt
2014-03-08 11:52 - 2014-03-08 11:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-08 11:52 - 2011-03-31 18:24 - 00000000 ____D () C:\Windows\SysWOW64\ShellExt
2014-03-08 11:39 - 2012-12-30 13:50 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Media Player Classic
2014-03-08 11:39 - 2011-05-25 22:30 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Vso
2014-03-08 11:28 - 2012-12-10 18:25 - 00000000 ____D () C:\Program Files (x86)\Zeugnis-Generator
2014-03-08 11:26 - 2011-04-18 19:04 - 00000000 ____D () C:\Program Files (x86)\Kroll Ontrack
2014-03-08 11:20 - 2013-05-27 17:42 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-03-08 11:02 - 2011-03-31 18:30 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-03-08 10:14 - 2014-03-08 10:14 - 00009447 _____ () C:\Users\Sebastian\Desktop\gmer.log
2014-03-08 10:03 - 2014-03-08 10:03 - 00054257 _____ () C:\Users\Sebastian\Desktop\FRST.txt
2014-03-08 10:03 - 2014-03-08 10:03 - 00048585 _____ () C:\Users\Sebastian\Desktop\Addition.txt
2014-03-08 09:56 - 2014-03-08 09:56 - 00000480 _____ () C:\Users\Sebastian\Desktop\defogger_disable.log
2014-03-08 09:56 - 2014-03-08 09:56 - 00000000 _____ () C:\Users\Sebastian\defogger_reenable
2014-03-08 09:14 - 2012-10-05 20:41 - 00000000 ____D () C:\tsmuxer
2014-03-07 22:57 - 2011-03-31 20:54 - 00000000 ____D () C:\BD_Rebuilder
2014-03-07 12:18 - 2013-05-20 18:06 - 00000000 ___RD () C:\Users\Sebastian\Dropbox
2014-03-07 12:18 - 2013-04-14 16:20 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Dropbox
2014-03-06 20:10 - 2014-03-03 18:48 - 00000000 ____D () C:\Program Files (x86)\GetFLV
2014-03-03 22:35 - 2011-08-27 09:03 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001UA.job
2014-03-03 22:27 - 2014-02-23 12:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-03 20:35 - 2011-08-27 09:02 - 00001084 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001Core.job
2014-03-03 19:03 - 2014-03-03 18:59 - 00000000 ____D () C:\Users\Sebastian\dwhelper
2014-03-03 19:02 - 2014-03-03 19:02 - 00000519 _____ () C:\Users\Sebastian\AppData\Roaming\setting.ini
2014-03-03 18:58 - 2014-03-03 18:58 - 00008655 _____ () C:\Users\Sebastian\AppData\Roaming\gui.dat
2014-03-03 10:44 - 2010-11-21 07:50 - 01816566 _____ () C:\Windows\system32\perfh007.dat
2014-03-03 10:44 - 2010-11-21 07:50 - 00496014 _____ () C:\Windows\system32\perfc007.dat
2014-03-03 10:44 - 2009-07-14 06:13 - 00006256 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-03 09:21 - 2014-02-24 21:44 - 00003394 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2014-03-03 08:32 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-03-03 08:06 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-23 12:27 - 2014-02-23 12:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-23 12:27 - 2012-05-05 00:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-23 12:27 - 2012-05-05 00:28 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-23 12:21 - 2011-03-31 20:20 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\Adobe
2014-02-16 23:33 - 2013-08-13 23:28 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-16 23:30 - 2011-04-01 12:31 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-16 17:25 - 2012-12-30 19:09 - 00004256 _____ () C:\Users\Sebastian\Desktop\Upload Template.txt
2014-02-16 16:56 - 2012-01-17 18:05 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\FileZilla
2014-02-16 10:22 - 2013-04-15 21:21 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-16 10:21 - 2014-01-07 15:59 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-02-16 10:21 - 2013-04-15 21:22 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-02-16 10:21 - 2013-04-15 21:22 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-02-16 10:21 - 2013-04-15 21:21 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-02-16 10:21 - 2013-04-15 21:21 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-02-16 10:21 - 2013-04-15 21:20 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-02-16 10:15 - 2012-04-27 16:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-15 12:10 - 2014-02-15 12:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-15 09:17 - 2014-02-15 09:17 - 04822473 _____ (Tim Kosse) C:\Users\Sebastian\Downloads\FileZilla_3.7.4.1_win32-setup.exe
2014-02-15 09:17 - 2012-01-17 18:05 - 00000000 ____D () C:\Program Files (x86)\FileZilla FTP Client
2014-02-13 16:30 - 2013-12-16 12:47 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\Deployment
2014-02-12 23:20 - 2013-01-27 18:05 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-11 20:30 - 2011-08-27 09:03 - 00004118 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001UA
2014-02-11 20:30 - 2011-08-27 09:02 - 00003722 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001Core
2014-02-08 12:07 - 2011-09-10 17:30 - 00000000 ____D () C:\Users\Sebastian\Documents\ConvertXToDVD
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-03 08:27
==================== End Of Log ============================
|
|
10.03.2014, 12:52
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Langsam, MBam startet nicht, auch im abgesicherten Modus Wie vermutet  Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Windows 7: Langsam, MBam startet nicht, auch im abgesicherten Modus |
|
10.03.2014, 21:45
| #7 |
| | Windows 7: Langsam, MBam startet nicht, auch im abgesicherten Modus Auf gehts Code:
ATTFilter # AdwCleaner v3.021 - Bericht erstellt am 10/03/2014 um 21:27:14
# Aktualisiert 10/03/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : Sebastian - SEBASTIAN-PC
# Gestartet von : C:\Users\Sebastian\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\SearchProtect
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Conduit
Ordner Gelöscht : C:\ProgramData\simplitec
Ordner Gelöscht : C:\ProgramData\VisualBee
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\DAEMON Tools Toolbar
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
Ordner Gelöscht : C:\Users\Sebastian\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Sebastian\AppData\Local\Linkury
Ordner Gelöscht : C:\Users\Sebastian\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Sebastian\AppData\Local\visualbeeexe
Ordner Gelöscht : C:\Users\Sebastian\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\Sebastian\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Sebastian\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Sebastian\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Sebastian\AppData\Roaming\FoxTab
Ordner Gelöscht : C:\Users\Sebastian\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Sebastian\AppData\Roaming\simplitec
Ordner Gelöscht : C:\Users\Sebastian\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\helperbar@helperbar.com
Ordner Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\quickstores@quickstores.de
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Sebastian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
Datei Gelöscht : C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url
Datei Gelöscht : C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\babylon1.xml
Datei Gelöscht : C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\Conduit.xml
Datei Gelöscht : C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\searchplugins\Linkury Smartbar Search.xml
Datei Gelöscht : C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\BackgroundContainer Startup Task
Datei Gelöscht : C:\Windows\System32\Tasks\FoxTab
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\hidjnkeodmholilgafgdlgmgggbhnigl
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\LinkurySmartBar.DockingPanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\LinkurySmartBar.LinkuryMenuForm
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\LinkurySmartBar.LinkurySmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\LinkurySmartBar.LinkurySmartBarBandObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pricegong_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pricegong_rasmancs
Schlüssel Gelöscht : HKCU\Software\596dad1e03fbf10
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_divx-plus-web-player_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_divx-plus-web-player_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_media-player-codec-pack_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_media-player-codec-pack_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_recuva-portable_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_recuva-portable_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_super_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_super_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{63E471BB-23F1-3A92-8D43-4079E7B7FA8E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B397BC55-576C-39E6-BF64-9E2A96317447}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B973AB12-952F-31C4-A321-E8FA6FE4421E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EC5983DF-8DE2-31B5-989F-850F265E7F3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36BCB13-778D-4A40-99C1-D686086D268F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{CCA8F2AB-BE4E-41F0-A289-4D960CEA58EA}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE69C007-C452-4D3E-86D2-1730DF8BC871}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{FE69C007-C452-4D3E-86D2-1730DF8BC871}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{63E471BB-23F1-3A92-8D43-4079E7B7FA8E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{B397BC55-576C-39E6-BF64-9E2A96317447}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{B973AB12-952F-31C4-A321-E8FA6FE4421E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EC5983DF-8DE2-31B5-989F-850F265E7F3C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A36BCB13-778D-4A40-99C1-D686086D268F}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BackgroundContainer
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\SimilarSites
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16518
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
-\\ Mozilla Firefox v27.0.1 (de)
[ Datei : C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\prefs.js ]
Zeile gelöscht : user_pref("CT3297265_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1372008231119,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3297265&octid=CT3297265&SearchSource=61&CUI=UN18738971062560622&UM=2&UP=SP2A9BDED2-EA9C-47CD-A3F3-15B6B72E88EC");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "DivX Browser Bar DE Customized Web Search");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3297265&SearchSource=2&CUI=UN18738971062560622&UM=2&q=");
Zeile gelöscht : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Zeile gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT3297265");
Zeile gelöscht : user_pref("avg.install.userHPSettings", "hxxp://search.babylon.com/?affID=116295&tt=5012_8&babsrc=HP_ss&mntrId=2048d3ca000000000000bcaec5cbc100");
Zeile gelöscht : user_pref("avg.install.userSPSettings", "Search the web (Babylon)");
Zeile gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Zeile gelöscht : user_pref("browser.search.defaultthis.engineName", "DivX Browser Bar DE Customized Web Search");
Zeile gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3297265&CUI=UN18738971062560622&UM=2&SearchSource=3&q={searchTerms}");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.bbDpng", 22);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.cntry", "");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.dpkLst", "");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.firstRun", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.hdrMd5", "65E3154258FDB7F51858777DDF62FD17");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.id", "2048d3ca000000000000bcaec5cbc100");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15688");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.lastActv", "22");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.lastDP", 22);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.4.31.222:00:31");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.pnu_base", "{\"newVrsn\":\"59\",\"lastVrsn\":\"59\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"false\",\"msgTs\":0,\"lstMsgTs\":\"0\"}");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.rvrt", "false");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.sg", "azb");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "azb");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=2048d3ca000000000000bcaec5cbc100&q=");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.8.4.9");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.8.4.9");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=116295&tt=5012_8");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.excTlbr", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.4.912:41:10");
Zeile gelöscht : user_pref("extensions.helperbar@helperbar.com.install-event-fired", true);
Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3297265&SearchSource=2&CUI=UN18738971062560622&UM=2&q=");
Zeile gelöscht : user_pref("show.CT3297265", false);
Zeile gelöscht : user_pref("smartbar.machineId", "EEMBNQYCRRSRYQIALRRM/4HATTK9VJTT6QEUVOGWRJXOLRWK84JOF5NKS9MGGANGMINPEDTCMVTP66ZPDMCOQQ");
-\\ Google Chrome v
[ Datei : C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht : homepage
Gelöscht : icon_url
Gelöscht : search_url
Gelöscht : suggest_url
Gelöscht : keyword
*************************
AdwCleaner[R0].txt - [16811 octets] - [10/03/2014 21:22:36]
AdwCleaner[S0].txt - [15173 octets] - [10/03/2014 21:27:14]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15234 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Ultimate x64
Ran by Sebastian on 10.03.2014 at 21:35:28,76
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3146263950-3329543529-1817725048-1001\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\linkurysmartbar.bandobjectattribute
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E86BADBB-F734-42FB-852B-52C41B35559C}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Sebastian\AppData\Roaming\getrighttogo"
Successfully deleted: [Folder] "C:\Users\Sebastian\appdata\local\cre"
~~~ FireFox
Emptied folder: C:\Users\Sebastian\AppData\Roaming\mozilla\firefox\profiles\vjtpjci0.default\minidumps [279 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.03.2014 at 21:41:37,93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-03-2014 01
Ran by Sebastian (administrator) on SEBASTIAN-PC on 10-03-2014 21:47:04
Running from C:\Users\Sebastian\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe
(Dawicontrol GmbH) C:\Program Files (x86)\Dawicontrol GmbH\Dawicontrol RAID Monitor\RAIDservice.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
() C:\Program Files\Silicon Image\3114-W-A64-R SATARAID5\SATARaid5ConfigService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(VIA Technologies, Inc.) C:\Windows\system32\viakaraokesrv.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
() C:\Windows\SysWOW64\C2MP\TrayMenu.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5299320 2012-10-25] (VIA)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-02-16] (AVAST Software)
HKU\.DEFAULT\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\.DEFAULT\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\.DEFAULT\...\Policies\Explorer: [NoResolveSearch] 1
HKU\.DEFAULT\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-3146263950-3329543529-1817725048-1001\...\Policies\Explorer: [DisableThumbnails] 1
HKU\S-1-5-21-3146263950-3329543529-1817725048-1001\...\Policies\Explorer: [ThumbnailsOnNetworkFolders] 1
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3631C9849CFBCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKLM-x32 - Default Value = {FE69C007-C452-4d3e-86D2-1730DF8BC871}
URLSearchHook: HKCU - Default Value = {FE69C007-C452-4d3e-86D2-1730DF8BC871}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Filter-x32: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default
FF Homepage: about:newtab
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Sebastian\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Sebastian\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-03]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\adblockpopups@jessehakanen.net.xpi [2012-06-28]
FF Extension: Adblock Plus - C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\vjtpjci0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-04-20]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-04-15]
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR DefaultSearchProvider: Conduit
CHR DefaultSearchURL: hxxp://www.google.com
CHR DefaultNewTabURL:
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\33.0.1750.117\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\33.0.1750.117\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\33.0.1750.117\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
CHR Extension: (YouTube) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-13]
CHR Extension: (Google Search) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-13]
CHR Extension: (AdBlock) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-11-25]
CHR Extension: (Google Wallet) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Better Pop Up Blocker) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpeeekfhbmikbdhlpjbfmnpgcbeggic [2011-08-27]
CHR Extension: (Gmail) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-13]
CHR HKCU\...\Chrome\Extension: [hkoahcaobjbihehldfimhblmhgalcipm] - C:\Users\Sebastian\AppData\Local\CRE\hkoahcaobjbihehldfimhblmhgalcipm.crx [2011-12-13]
CHR HKLM-x32\...\Chrome\Extension: [hkoahcaobjbihehldfimhblmhgalcipm] - C:\Users\Sebastian\AppData\Local\CRE\hkoahcaobjbihehldfimhblmhgalcipm.crx [2011-12-13]
CHR StartMenuInternet: Google Chrome - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [44064 2013-07-08] (ArcSoft, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-16] (AVAST Software)
S4 bgsvcgen; C:\Windows\SysWOW64\bgsvcgen.exe [139264 2011-05-15] (SOURCENEXT)
R2 DcRaidMoSrv; C:\Program Files (x86)\Dawicontrol GmbH\Dawicontrol RAID Monitor\RAIDservice.exe [336384 2011-06-29] (Dawicontrol GmbH)
R2 SATARaid5 Config Service; C:\Program Files\Silicon Image\3114-W-A64-R SATARAID5\SATARaid5ConfigService.exe [148480 2005-10-05] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-10-22] (VIA Technologies, Inc.)
==================== Drivers (Whitelisted) ====================
R3 AirDisplay; C:\Windows\System32\DRIVERS\AVVideoCard.sys [15728 2011-05-05] (Windows (R) Win 7 DDK provider)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [139352 2013-07-31] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [139352 2013-07-31] (SlySoft, Inc.)
S3 appliand; C:\Windows\System32\DRIVERS\appliand.sys [33888 2011-06-26] (Applian Technologies Inc.)
R3 appliandMP; C:\Windows\System32\DRIVERS\appliand.sys [33888 2011-06-26] (Applian Technologies Inc.)
R1 ArcCtrl; C:\Windows\System32\drivers\ArcCtrl.sys [604192 2013-03-19] ()
R1 archlp; C:\Windows\System32\drivers\archlp.sys [139840 2011-11-18] ()
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-02-16] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-15] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-15] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1038072 2014-02-16] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [421704 2014-02-16] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [80184 2014-02-16] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-07] ()
R1 cdrbsdrv; C:\Windows\System32\Drivers\cdrbsdrv.sys [38944 2011-05-15] (B.H.A Corporation)
R0 DC324e; C:\Windows\System32\DRIVERS\DC324e.sys [51256 2011-06-29] (Dawicontrol GmbH)
R1 Ext2Fsd; C:\Windows\System32\Drivers\Ext2Fsd.sys [769816 2011-07-09] (www.ext2fsd.com)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S0 Partizan; C:\Windows\SysWOW64\drivers\Partizan.sys [35816 2014-03-08] (Greatis Software)
S3 pfc; C:\Windows\SysWOW64\drivers\pfc.sys [10368 2004-04-01] (Padus, Inc.)
S3 RegGuard; C:\Windows\SysWOW64\Drivers\regguard.sys [24416 2014-03-08] (Greatis Software)
R0 SI3114; C:\Windows\System32\DRIVERS\SI3114.sys [82984 2008-04-14] (Silicon Image, Inc)
R0 Si3114r5; C:\Windows\System32\DRIVERS\Si3114r5.sys [329256 2008-11-24] (Silicon Image, Inc)
R0 Si3132r5; C:\Windows\System32\DRIVERS\Si3132r5.sys [337960 2007-12-26] (Silicon Image, Inc)
R0 SiFilter; C:\Windows\System32\DRIVERS\SiWinAcc.sys [22056 2008-04-14] (Silicon Image, Inc)
R0 SiRemFil; C:\Windows\System32\DRIVERS\SiRemFil.sys [16936 2007-12-26] (Silicon Image, Inc.)
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [146928 2011-03-01] (CyberLink Corp.)
S1 ArcSec; system32\drivers\ArcSec.sys [X]
S3 catchme; \??\C:\baller\catchme.sys [X]
U4 SR;
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-10 21:41 - 2014-03-10 21:41 - 00001362 _____ () C:\Users\Sebastian\Desktop\JRT.txt
2014-03-10 21:35 - 2014-03-10 21:35 - 00000000 ____D () C:\Windows\ERUNT
2014-03-10 21:33 - 2014-03-10 21:33 - 01037734 _____ (Thisisu) C:\Users\Sebastian\Downloads\JRT.exe
2014-03-10 21:22 - 2014-03-10 21:33 - 00000000 ____D () C:\AdwCleaner
2014-03-10 21:21 - 2014-03-10 21:21 - 01949184 _____ () C:\Users\Sebastian\Downloads\adwcleaner.exe
2014-03-09 12:06 - 2014-03-10 21:47 - 00019417 _____ () C:\Users\Sebastian\Downloads\FRST.txt
2014-03-09 12:05 - 2014-03-09 12:06 - 02156544 _____ (Farbar) C:\Users\Sebastian\Downloads\FRST64.exe
2014-03-09 09:39 - 2014-03-09 09:39 - 00001870 _____ () C:\Users\Public\Desktop\mkvmerge GUI.lnk
2014-03-08 22:44 - 2014-03-08 22:44 - 00291664 _____ () C:\Windows\Minidump\030814-138060-01.dmp
2014-03-08 22:07 - 2014-03-10 21:31 - 00000370 _____ () C:\Windows\SysWOW64\PARTIZAN.TXT
2014-03-08 22:07 - 2014-03-08 22:44 - 466328751 _____ () C:\Windows\MEMORY.DMP
2014-03-08 22:07 - 2014-03-08 22:07 - 00291864 _____ () C:\Windows\Minidump\030814-139667-01.dmp
2014-03-08 16:58 - 2014-03-08 16:58 - 00025524 _____ () C:\ComboFix.txt
2014-03-08 16:43 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-03-08 16:43 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-03-08 16:43 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-03-08 16:43 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-03-08 16:43 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-03-08 16:43 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-03-08 16:43 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-03-08 16:43 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-03-08 16:42 - 2014-03-08 16:58 - 00000000 ____D () C:\Qoobox
2014-03-08 16:42 - 2014-03-08 16:56 - 00000000 ____D () C:\Windows\erdnt
2014-03-08 16:33 - 2014-03-08 16:33 - 00037600 _____ (Greatis Software) C:\Windows\SysWOW64\Partizan.exe
2014-03-08 15:39 - 2014-03-08 16:20 - 00024416 _____ (Greatis Software) C:\Windows\SysWOW64\Drivers\regguard.sys
2014-03-08 15:39 - 2014-03-08 15:39 - 00037600 _____ (Greatis Software) C:\Windows\system32\Partizan.exe
2014-03-08 15:36 - 2014-03-08 15:36 - 00035816 _____ (Greatis Software) C:\Windows\SysWOW64\Drivers\Partizan.sys
2014-03-08 15:35 - 2014-03-08 16:10 - 00000000 ____D () C:\Users\Public\Documents\regruninfo
2014-03-08 15:35 - 2014-03-08 16:08 - 00000000 ____D () C:\Users\Sebastian\Documents\RegRun2
2014-03-08 15:35 - 2014-03-08 15:36 - 00000000 ____D () C:\Program Files (x86)\UnHackMe
2014-03-08 15:35 - 2014-03-08 15:35 - 00000418 _____ () C:\Windows\Tasks\UnHackMe Task Scheduler.job
2014-03-08 15:35 - 2014-03-08 15:35 - 00000002 RSHOT () C:\Windows\winstart.bat
2014-03-08 15:35 - 2014-03-08 15:35 - 00000002 RSHOT () C:\Windows\SysWOW64\AUTOEXEC.NT
2014-03-08 15:35 - 2010-11-11 12:44 - 00012808 _____ (Greatis Software, LLC.) C:\Windows\SysWOW64\Drivers\UnHackMeDrv.sys
2014-03-08 11:52 - 2014-03-10 21:31 - 00000840 _____ () C:\Windows\setupact.log
2014-03-08 11:52 - 2014-03-08 22:07 - 00005770 _____ () C:\Windows\PFRO.log
2014-03-08 11:52 - 2014-03-08 11:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-08 10:14 - 2014-03-08 10:14 - 00009447 _____ () C:\Users\Sebastian\Desktop\gmer.log
2014-03-08 10:03 - 2014-03-08 10:03 - 00054257 _____ () C:\Users\Sebastian\Desktop\FRST.txt
2014-03-08 10:03 - 2014-03-08 10:03 - 00048585 _____ () C:\Users\Sebastian\Desktop\Addition.txt
2014-03-08 09:59 - 2014-03-10 21:47 - 00000000 ____D () C:\FRST
2014-03-08 09:56 - 2014-03-08 09:56 - 00000480 _____ () C:\Users\Sebastian\Desktop\defogger_disable.log
2014-03-08 09:56 - 2014-03-08 09:56 - 00000000 _____ () C:\Users\Sebastian\defogger_reenable
2014-03-08 09:17 - 2014-03-08 16:38 - 00000000 ____D () C:\mb-c
2014-03-08 09:07 - 2014-03-08 17:00 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware1-7
2014-03-03 19:02 - 2014-03-03 19:02 - 00000519 _____ () C:\Users\Sebastian\AppData\Roaming\setting.ini
2014-03-03 18:59 - 2014-03-03 19:03 - 00000000 ____D () C:\Users\Sebastian\dwhelper
2014-03-03 18:58 - 2014-03-03 18:58 - 00008655 _____ () C:\Users\Sebastian\AppData\Roaming\gui.dat
2014-02-26 23:02 - 2014-01-09 03:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-02-26 23:02 - 2014-01-03 23:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-02-23 12:06 - 2014-03-03 22:27 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-23 12:06 - 2014-02-23 12:27 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-15 12:10 - 2014-02-15 12:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-15 09:17 - 2014-02-15 09:17 - 04822473 _____ (Tim Kosse) C:\Users\Sebastian\Downloads\FileZilla_3.7.4.1_win32-setup.exe
2014-02-12 23:13 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 23:13 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 23:11 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 23:11 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 23:11 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 23:11 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 23:11 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 23:11 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 23:11 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 23:11 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 23:11 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 23:11 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 23:11 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 23:11 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 23:11 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 23:11 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 23:11 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 23:11 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 23:11 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 23:11 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 23:11 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 23:11 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 23:11 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 23:11 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 23:11 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 23:11 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 23:11 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 23:11 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 23:11 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 23:11 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 23:11 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 23:11 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 23:11 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 23:11 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 23:11 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 23:11 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 23:11 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 23:11 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 23:11 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 23:11 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 23:11 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 13:41 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 13:41 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 13:41 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 13:41 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 13:41 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 13:41 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 13:41 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 13:41 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 13:41 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 13:41 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 13:41 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 13:41 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 13:41 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 13:41 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 13:41 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 13:41 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 13:41 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 13:41 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 13:41 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 13:41 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 13:41 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 13:41 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 13:41 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 13:41 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 13:41 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
==================== One Month Modified Files and Folders =======
2014-03-10 21:47 - 2014-03-09 12:06 - 00019417 _____ () C:\Users\Sebastian\Downloads\FRST.txt
2014-03-10 21:47 - 2014-03-08 09:59 - 00000000 ____D () C:\FRST
2014-03-10 21:41 - 2014-03-10 21:41 - 00001362 _____ () C:\Users\Sebastian\Desktop\JRT.txt
2014-03-10 21:38 - 2009-07-14 05:45 - 00026064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-10 21:38 - 2009-07-14 05:45 - 00026064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-10 21:35 - 2014-03-10 21:35 - 00000000 ____D () C:\Windows\ERUNT
2014-03-10 21:33 - 2014-03-10 21:33 - 01037734 _____ (Thisisu) C:\Users\Sebastian\Downloads\JRT.exe
2014-03-10 21:33 - 2014-03-10 21:22 - 00000000 ____D () C:\AdwCleaner
2014-03-10 21:31 - 2014-03-08 22:07 - 00000370 _____ () C:\Windows\SysWOW64\PARTIZAN.TXT
2014-03-10 21:31 - 2014-03-08 11:52 - 00000840 _____ () C:\Windows\setupact.log
2014-03-10 21:31 - 2011-03-31 19:11 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-03-10 21:27 - 2011-03-31 18:17 - 01610801 _____ () C:\Windows\WindowsUpdate.log
2014-03-10 21:21 - 2014-03-10 21:21 - 01949184 _____ () C:\Users\Sebastian\Downloads\adwcleaner.exe
2014-03-09 23:11 - 2011-03-31 21:12 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\DVD Profiler
2014-03-09 22:50 - 2013-08-03 08:55 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\JDownloader v2.0
2014-03-09 21:40 - 2012-07-05 19:09 - 00000131 ___SH () C:\ProgramData\.zreglib
2014-03-09 17:34 - 2011-04-03 13:57 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\dvdcss
2014-03-09 12:06 - 2014-03-09 12:05 - 02156544 _____ (Farbar) C:\Users\Sebastian\Downloads\FRST64.exe
2014-03-09 11:36 - 2013-03-16 17:29 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\vlc
2014-03-09 09:39 - 2014-03-09 09:39 - 00001870 _____ () C:\Users\Public\Desktop\mkvmerge GUI.lnk
2014-03-09 09:32 - 2011-04-01 13:19 - 00000000 ___RD () C:\Users\Sebastian\Desktop\Programme
2014-03-08 22:44 - 2014-03-08 22:44 - 00291664 _____ () C:\Windows\Minidump\030814-138060-01.dmp
2014-03-08 22:44 - 2014-03-08 22:07 - 466328751 _____ () C:\Windows\MEMORY.DMP
2014-03-08 22:44 - 2011-07-22 10:30 - 00000000 ____D () C:\Windows\Minidump
2014-03-08 22:07 - 2014-03-08 22:07 - 00291864 _____ () C:\Windows\Minidump\030814-139667-01.dmp
2014-03-08 22:07 - 2014-03-08 11:52 - 00005770 _____ () C:\Windows\PFRO.log
2014-03-08 17:09 - 2012-06-15 17:13 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\CrashDumps
2014-03-08 17:00 - 2014-03-08 09:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware1-7
2014-03-08 16:58 - 2014-03-08 16:58 - 00025524 _____ () C:\ComboFix.txt
2014-03-08 16:58 - 2014-03-08 16:42 - 00000000 ____D () C:\Qoobox
2014-03-08 16:56 - 2014-03-08 16:42 - 00000000 ____D () C:\Windows\erdnt
2014-03-08 16:56 - 2011-03-31 18:48 - 00000000 ___RD () C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-08 16:55 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-03-08 16:38 - 2014-03-08 09:17 - 00000000 ____D () C:\mb-c
2014-03-08 16:33 - 2014-03-08 16:33 - 00037600 _____ (Greatis Software) C:\Windows\SysWOW64\Partizan.exe
2014-03-08 16:32 - 2011-03-31 18:45 - 00000000 ____D () C:\Users\Sebastian
2014-03-08 16:20 - 2014-03-08 15:39 - 00024416 _____ (Greatis Software) C:\Windows\SysWOW64\Drivers\regguard.sys
2014-03-08 16:10 - 2014-03-08 15:35 - 00000000 ____D () C:\Users\Public\Documents\regruninfo
2014-03-08 16:08 - 2014-03-08 15:35 - 00000000 ____D () C:\Users\Sebastian\Documents\RegRun2
2014-03-08 15:39 - 2014-03-08 15:39 - 00037600 _____ (Greatis Software) C:\Windows\system32\Partizan.exe
2014-03-08 15:36 - 2014-03-08 15:36 - 00035816 _____ (Greatis Software) C:\Windows\SysWOW64\Drivers\Partizan.sys
2014-03-08 15:36 - 2014-03-08 15:35 - 00000000 ____D () C:\Program Files (x86)\UnHackMe
2014-03-08 15:35 - 2014-03-08 15:35 - 00000418 _____ () C:\Windows\Tasks\UnHackMe Task Scheduler.job
2014-03-08 15:35 - 2014-03-08 15:35 - 00000002 RSHOT () C:\Windows\winstart.bat
2014-03-08 15:35 - 2014-03-08 15:35 - 00000002 RSHOT () C:\Windows\SysWOW64\AUTOEXEC.NT
2014-03-08 13:45 - 2011-03-31 21:37 - 00000000 ___RD () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-08 13:43 - 2012-08-12 07:50 - 00000000 ____D () C:\javare
2014-03-08 13:27 - 2011-12-04 16:36 - 00072796 _____ () C:\Users\Sebastian\Desktop\Neues Textdokument.txt
2014-03-08 12:51 - 2014-03-08 12:51 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-03-08 11:52 - 2014-03-08 11:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-08 11:52 - 2011-03-31 18:24 - 00000000 ____D () C:\Windows\SysWOW64\ShellExt
2014-03-08 11:39 - 2012-12-30 13:50 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Media Player Classic
2014-03-08 11:39 - 2011-05-25 22:30 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Vso
2014-03-08 11:28 - 2012-12-10 18:25 - 00000000 ____D () C:\Program Files (x86)\Zeugnis-Generator
2014-03-08 11:26 - 2011-04-18 19:04 - 00000000 ____D () C:\Program Files (x86)\Kroll Ontrack
2014-03-08 11:24 - 2013-01-26 16:29 - 00000000 ____D () C:\ProgramData\MAGIX
2014-03-08 11:20 - 2013-05-27 17:42 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-03-08 11:18 - 2012-02-17 19:07 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Solveig Multimedia
2014-03-08 11:12 - 2011-04-07 06:49 - 00000000 ____D () C:\Program Files (x86)\NeoSmart Technologies
2014-03-08 11:09 - 2012-02-18 23:49 - 00000000 ____D () C:\Program Files (x86)\CloneDVD5
2014-03-08 11:09 - 2011-05-25 22:30 - 00082816 _____ (VSO Software) C:\Users\Sebastian\AppData\Roaming\pcouffin.sys
2014-03-08 11:09 - 2011-05-25 22:30 - 00007859 _____ () C:\Users\Sebastian\AppData\Roaming\pcouffin.cat
2014-03-08 11:09 - 2011-05-25 22:30 - 00000055 _____ () C:\Users\Sebastian\AppData\Roaming\pcouffin.log
2014-03-08 11:09 - 2011-05-25 22:29 - 00000000 ____D () C:\Program Files (x86)\vso
2014-03-08 11:03 - 2011-08-21 08:15 - 00000000 ____D () C:\Users\Sebastian\Documents\Any DVD Shrink
2014-03-08 11:02 - 2011-03-31 18:30 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-03-08 10:14 - 2014-03-08 10:14 - 00009447 _____ () C:\Users\Sebastian\Desktop\gmer.log
2014-03-08 10:03 - 2014-03-08 10:03 - 00054257 _____ () C:\Users\Sebastian\Desktop\FRST.txt
2014-03-08 10:03 - 2014-03-08 10:03 - 00048585 _____ () C:\Users\Sebastian\Desktop\Addition.txt
2014-03-08 09:56 - 2014-03-08 09:56 - 00000480 _____ () C:\Users\Sebastian\Desktop\defogger_disable.log
2014-03-08 09:56 - 2014-03-08 09:56 - 00000000 _____ () C:\Users\Sebastian\defogger_reenable
2014-03-08 09:14 - 2012-10-05 20:41 - 00000000 ____D () C:\tsmuxer
2014-03-07 22:57 - 2011-03-31 20:54 - 00000000 ____D () C:\BD_Rebuilder
2014-03-07 12:18 - 2013-05-20 18:06 - 00000000 ___RD () C:\Users\Sebastian\Dropbox
2014-03-07 12:18 - 2013-04-14 16:20 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Dropbox
2014-03-06 20:10 - 2014-03-03 18:48 - 00000000 ____D () C:\Program Files (x86)\GetFLV
2014-03-03 22:35 - 2011-08-27 09:03 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001UA.job
2014-03-03 22:27 - 2014-02-23 12:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-03 20:35 - 2011-08-27 09:02 - 00001084 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001Core.job
2014-03-03 19:03 - 2014-03-03 18:59 - 00000000 ____D () C:\Users\Sebastian\dwhelper
2014-03-03 19:02 - 2014-03-03 19:02 - 00000519 _____ () C:\Users\Sebastian\AppData\Roaming\setting.ini
2014-03-03 18:58 - 2014-03-03 18:58 - 00008655 _____ () C:\Users\Sebastian\AppData\Roaming\gui.dat
2014-03-03 10:44 - 2010-11-21 07:50 - 01816566 _____ () C:\Windows\system32\perfh007.dat
2014-03-03 10:44 - 2010-11-21 07:50 - 00496014 _____ () C:\Windows\system32\perfc007.dat
2014-03-03 10:44 - 2009-07-14 06:13 - 00006256 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-03 08:32 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-03-03 08:06 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-23 12:27 - 2014-02-23 12:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-23 12:27 - 2012-05-05 00:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-23 12:27 - 2012-05-05 00:28 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-23 12:21 - 2011-03-31 20:20 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\Adobe
2014-02-16 23:33 - 2013-08-13 23:28 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-16 23:30 - 2011-04-01 12:31 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-16 17:25 - 2012-12-30 19:09 - 00004256 _____ () C:\Users\Sebastian\Desktop\Upload Template.txt
2014-02-16 16:56 - 2012-01-17 18:05 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\FileZilla
2014-02-16 10:22 - 2013-04-15 21:21 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-16 10:21 - 2014-01-07 15:59 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-02-16 10:21 - 2013-04-15 21:22 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-02-16 10:21 - 2013-04-15 21:22 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-02-16 10:21 - 2013-04-15 21:21 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-02-16 10:21 - 2013-04-15 21:21 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-02-16 10:21 - 2013-04-15 21:20 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-02-16 10:15 - 2012-04-27 16:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-15 12:10 - 2014-02-15 12:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-15 09:17 - 2014-02-15 09:17 - 04822473 _____ (Tim Kosse) C:\Users\Sebastian\Downloads\FileZilla_3.7.4.1_win32-setup.exe
2014-02-15 09:17 - 2012-01-17 18:05 - 00000000 ____D () C:\Program Files (x86)\FileZilla FTP Client
2014-02-13 16:30 - 2013-12-16 12:47 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\Deployment
2014-02-12 23:20 - 2013-01-27 18:05 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-11 20:30 - 2011-08-27 09:03 - 00004118 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001UA
2014-02-11 20:30 - 2011-08-27 09:02 - 00003722 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3146263950-3329543529-1817725048-1001Core
2014-02-08 12:07 - 2011-09-10 17:30 - 00000000 ____D () C:\Users\Sebastian\Documents\ConvertXToDVD
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-03 08:27
==================== End Of Log ============================
Geändert von HerbieH (10.03.2014 um 21:51 Uhr) |
|
11.03.2014, 13:51
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Langsam, MBam startet nicht, auch im abgesicherten ModusESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: Langsam, MBam startet nicht, auch im abgesicherten Modus |
| antivirus, bonjour, browser, converter, desktop, error, fehler, firefox, flash player, helper, hijack, homepage, langsam, lightning, mozilla, registry, scan, security, smartbar, software, starten, system, taskmanager, vista, windows, windows xp, windows32, zugriff verweigert |
WARNUNG an die MITLESER: 
Linear-Darstellung
