Windows 7 Professional: Geschwindigkeitsverlust nach Absturz, außerdem Virenbefall laut YouTube-Werbung

Solitron · 29.03.2014, 17:00

Vor zwei Wochen stürzte mein Computer beim Spielen ab, beim Neustart startete Windows eine Problemlösungssuche, die erfolglos war. Danach habe ich den Computer wie gehabt benutzt, aber ich bemerke seitdem auch, dass mein Computer (speziell in Verbindung mit YouTube, Facebook und League of Legends(Spiel)) sehr viel langsamer geworden ist, und lange braucht um diverse Dinge zu laden.
Auf YouTube sehe ich seit diesem Absturz nur noch Werbung die mich darauf hinweist, dass Windows fehlerhaft ist, dass auf meinem Computer Viren gefunden wurden usw. Außerdem werde ich andauernd darüber informiert, dass meine Java-Version nicht ausreichend ist. Dafür schließt sich zu zufälligen Momenten ein Tab im Browser und leitet mich auf eine Seite die mir die neueste Java-Version zum Download anbieten will. Auf diese Art kann ich kaum das Internet benutzen.
Über Hilfe zu meinen Problemen würde ich mich sehr freuen.
Anbei habe ich die gewünschten logfiles eingefügt.

Mit freundlichen Grüßen,
Solitron (:

Edit: Ich benutze übrigens Chrome als Internetbrowser.

schrauber · 29.03.2014, 17:51

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Solitron · 29.03.2014, 19:57

Entschuldigung, das habe ich vergessen.

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:04 on 29/03/2014 (tobi)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014  01
Ran by tobi (administrator) on TOBIAS-PC on 29-03-2014 16:08:50
Running from C:\Users\tobi\Desktop\Trojaner-Board
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\system32\PnkBstrA.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.22.5\GoogleCrashHandler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Wondershare) C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
() C:\ProgramData\dlprotect.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-18] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [WSHelperSetup.exe] - C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)
HKLM\...\Run: [Wondershare Helper Compact.exe] - C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM\...\Run: [Download Protect] - C:\ProgramData\dlprotect.exe [12800 2014-03-22] ()
HKU\S-1-5-21-1740813220-741005101-994693073-1006\...\Run: [WSHelperSetup.exe] - C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - Backup.Old.DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847}
SearchScopes: HKLM - {7430958C-CCEE-7183-F800-3D9AD98A6113} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2801937
SearchScopes: HKCU - Backup.Old.DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzuzyyEyEyEyDtBtBtAtD0F0EtD0A0E0E0AtN0D0Tzu0CtAtCyDtN1L2XzutBtFtBtFtDtFtAyEyE&cr=845114457
SearchScopes: HKCU - {7430958C-CCEE-7183-F800-3D9AD98A6113} URL = 
SearchScopes: HKCU - {BBC6C3C2-2609-4BC5-8569-3A40AD87BBED} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
BHO: addplushd - {11111111-1111-1111-1111-110511291116} - C:\Program Files\addplushd\addplushd-bho.dll (hdideo)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks:  - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [231424] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR Extension: (addplushd) - C:\Users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe [2014-03-22]
CHR Extension: (RadioTotal1) - C:\Users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfigonhgidedenkkhlilmefgodjpefna [2014-03-23]
CHR Extension: (Google Wallet) - C:\Users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-18]
CHR HKLM\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\tobi\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx [2013-11-12]
CHR HKLM\...\Chrome\Extension: [dapejillpcnbpfidhfkpidklcombbmel] - C:\Users\tobi\AppData\Local\CRE\dapejillpcnbpfidhfkpidklcombbmel.crx [2013-11-12]
CHR HKLM\...\Chrome\Extension: [ommhmgednjnodcljhlljkaiidghdmikk] - C:\Users\tobi\AppData\Local\CRE\ommhmgednjnodcljhlljkaiidghdmikk.crx [2013-11-12]
CHR HKCU\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\tobi\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx [2013-11-12]
CHR HKCU\...\Chrome\Extension: [dapejillpcnbpfidhfkpidklcombbmel] - C:\Users\tobi\AppData\Local\CRE\dapejillpcnbpfidhfkpidklcombbmel.crx [2013-11-12]
CHR HKCU\...\Chrome\Extension: [ommhmgednjnodcljhlljkaiidghdmikk] - C:\Users\tobi\AppData\Local\CRE\ommhmgednjnodcljhlljkaiidghdmikk.crx [2013-11-12]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
S3 npggsvc; C:\Windows\system32\GameMon.des [5124464 2012-12-16] (INCA Internet Co., Ltd.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2014-03-16] ()
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

==================== Drivers (Whitelisted) ====================

S3 apf003; C:\Windows\system32\apf003.sys [13232 2013-05-29] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [25280 2013-11-02] (LogMeIn, Inc.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [35560 2012-08-01] (AnchorFree Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-08-01] (AnchorFree Inc)
S3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1143920 2010-08-04] (VIA Technologies, Inc.)
S3 catchme; \??\C:\Users\tobi\AppData\Local\Temp\catchme.sys [X]
S3 cpuz134; \??\C:\Users\tobi\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 vtany; \??\C:\Windows\vtany.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files\IObit\Game Booster\Driver\WinRing0.sys [X]
S3 XDva391; \??\C:\Windows\system32\XDva391.sys [X]
S3 XDva392; \??\C:\Windows\system32\XDva392.sys [X]
S3 XDva393; \??\C:\Windows\system32\XDva393.sys [X]
S3 XDva394; \??\C:\Windows\system32\XDva394.sys [X]
S3 XDva396; \??\C:\Windows\system32\XDva396.sys [X]
S3 XDva397; \??\C:\Windows\system32\XDva397.sys [X]
S3 XDva401; \??\C:\Windows\system32\XDva401.sys [X]
S3 XDva405; \??\C:\Windows\system32\XDva405.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-29 16:01 - 2014-03-29 16:08 - 00000000 ____D () C:\Users\tobi\Desktop\Trojaner-Board
2014-03-28 22:17 - 2014-03-28 22:17 - 00208781 _____ () C:\Users\tobi\Downloads\UCgKJyJq9RKrNvMp1pgHo1Cw.htm
2014-03-26 15:39 - 2014-03-26 15:39 - 00427991 ____N () C:\Windows\Minidump\032614-18766-01.dmp
2014-03-24 18:43 - 2014-03-24 18:43 - 00000000 ____D () C:\Users\tobi\Documents\Diablo III
2014-03-24 18:04 - 2014-03-24 18:04 - 00000669 _____ () C:\Users\Public\Desktop\Diablo III.lnk
2014-03-24 18:01 - 2014-03-27 21:10 - 00000000 ____D () C:\Users\tobi\AppData\Local\Battle.net
2014-03-24 18:01 - 2014-03-24 18:15 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Battle.net
2014-03-24 18:01 - 2014-03-24 18:01 - 00000657 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-03-24 18:01 - 2014-03-24 18:01 - 00000000 ____D () C:\Users\tobi\AppData\Local\Blizzard Entertainment
2014-03-24 18:00 - 2014-03-24 18:01 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-03-24 17:58 - 2014-03-24 17:59 - 00000000 ____D () C:\ProgramData\Battle.net
2014-03-24 17:58 - 2014-03-24 17:58 - 06018744 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-Setup-deDE.exe
2014-03-24 17:55 - 2014-03-24 17:55 - 07341464 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-8370-deDE-Installer-downloader.exe
2014-03-24 17:50 - 2014-03-24 17:50 - 00000048 _____ () C:\Users\tobi\Downloads\Diablo Key.txt
2014-03-24 16:29 - 2014-03-24 16:29 - 00007306 _____ () C:\Users\tobi\AppData\Local\recently-used.xbel
2014-03-24 16:26 - 2014-03-24 16:26 - 00000000 ____D () C:\Users\tobi\AppData\Local\webkit
2014-03-23 22:54 - 2014-03-23 22:58 - 00002208 _____ () C:\Windows\system32\ASOROSet.bin
2014-03-23 22:54 - 2014-03-23 22:54 - 00000000 ____D () C:\Windows\system32\config\RCCBakup
2014-03-23 22:45 - 2014-03-23 23:04 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Systweak
2014-03-23 22:45 - 2013-02-28 16:27 - 00018776 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot.exe
2014-03-23 22:44 - 2014-03-23 22:44 - 04433440 _____ (Systweak Inc ) C:\Users\tobi\Downloads\rcpsetupg_apptvlatest-apptvlatest_2021.exe
2014-03-23 16:05 - 2014-03-23 16:05 - 00000000 ____D () C:\ProgramData\CDB
2014-03-23 16:04 - 2014-03-23 16:05 - 00000155 _____ () C:\Windows\Reimage.ini
2014-03-23 16:03 - 2014-03-23 16:03 - 00784984 _____ (Reimage®) C:\Users\tobi\Downloads\ReimageRepair.exe
2014-03-23 16:03 - 2014-03-23 16:03 - 00518816 _____ () C:\Users\tobi\Downloads\Player.exe
2014-03-23 01:38 - 2014-03-23 01:38 - 00141271 ____N () C:\Windows\Minidump\032314-49873-01.dmp
2014-03-22 23:14 - 2014-03-24 16:27 - 00000000 ____D () C:\Users\tobi\AppData\Local\gtk-2.0
2014-03-22 23:11 - 2014-03-22 23:11 - 00000000 ____D () C:\Users\tobi\.thumbnails
2014-03-22 23:09 - 2014-03-24 16:31 - 00000000 ____D () C:\Users\tobi\.gimp-2.8
2014-03-22 23:09 - 2014-03-22 23:09 - 00000000 ____D () C:\Users\tobi\AppData\Local\gegl-0.2
2014-03-22 23:08 - 2014-03-22 23:08 - 00001045 _____ () C:\Users\tobi\Desktop\GIMP 2.lnk
2014-03-22 23:04 - 2014-03-22 23:05 - 90332288 _____ (The GIMP Team ) C:\Users\tobi\Downloads\gimp-2.8.8-setup.exe
2014-03-22 23:01 - 2014-03-29 15:34 - 00002276 _____ () C:\Windows\Tasks\addplushd-firefoxinstaller.job
2014-03-22 23:01 - 2014-03-29 15:34 - 00001482 _____ () C:\Windows\Tasks\addplushd-updater.job
2014-03-22 23:01 - 2014-03-29 15:34 - 00001436 _____ () C:\Windows\Tasks\addplushd-codedownloader.job
2014-03-22 23:01 - 2014-03-29 15:34 - 00001336 _____ () C:\Windows\Tasks\addplushd-enabler.job
2014-03-22 23:01 - 2014-03-23 18:05 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Security System 2
2014-03-22 23:01 - 2014-03-22 23:03 - 00000000 ____D () C:\Program Files\GIMP 2
2014-03-22 23:01 - 2014-03-22 23:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\BupSystem
2014-03-22 23:00 - 2014-03-29 15:34 - 00003070 _____ () C:\Windows\Tasks\addplushd-chromeinstaller.job
2014-03-22 23:00 - 2014-03-23 22:30 - 00000000 ____D () C:\Program Files\ResultsAlpha
2014-03-22 23:00 - 2014-03-22 23:01 - 00000000 ____D () C:\Program Files\addplushd
2014-03-22 22:59 - 2014-03-22 22:59 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-03-22 22:57 - 2014-03-22 23:00 - 00000000 ____D () C:\Users\tobi\AppData\Local\DownloadGuide
2014-03-22 22:57 - 2014-03-22 22:57 - 00653512 _____ () C:\Users\tobi\Downloads\GIMP_Setup_Download.exe
2014-03-19 14:33 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-03-19 14:32 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-19 14:32 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-19 14:32 - 2014-03-01 05:10 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-19 14:32 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-19 14:32 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-19 14:32 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-19 14:32 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-19 14:32 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-19 14:32 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-19 14:32 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-19 14:32 - 2014-03-01 04:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-19 14:32 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-19 14:32 - 2014-03-01 04:31 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-19 14:32 - 2014-03-01 04:25 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-19 14:32 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-19 14:32 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-19 14:32 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-19 14:32 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-19 14:32 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-19 14:32 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-19 14:32 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-19 14:32 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-19 14:32 - 2014-01-09 03:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-03-18 22:14 - 2014-03-18 22:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-03-18 22:14 - 2014-03-18 22:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-03-18 22:14 - 2014-03-18 22:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-03-18 22:14 - 2014-03-18 22:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-03-18 22:14 - 2014-03-18 22:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-03-18 22:14 - 2014-03-18 22:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-03-18 22:14 - 2014-03-18 22:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-03-18 22:14 - 2014-03-18 22:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-03-18 22:12 - 2014-03-18 22:16 - 00009985 _____ () C:\Windows\IE11_main.log
2014-03-18 22:12 - 2014-03-18 22:12 - 00000020 ___SH () C:\Users\UpdatusUser\ntuser.ini
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Startmenü
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Netzwerkumgebung
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Druckumgebung
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Musik
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Bilder
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Local\Verlauf
2014-03-18 22:12 - 2012-04-12 00:39 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Microsoft Help
2014-03-18 22:12 - 2009-07-14 05:42 - 00000000 ___RD () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-03-18 22:12 - 2009-07-14 05:37 - 00000000 ___RD () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-03-18 22:08 - 2013-10-02 01:42 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-03-18 22:08 - 2013-10-02 01:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-03-18 22:08 - 2013-10-02 01:30 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-03-18 22:08 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-03-18 22:08 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-03-18 22:08 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-03-18 22:08 - 2013-10-02 00:45 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-03-18 22:08 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-03-18 22:08 - 2013-10-02 00:00 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-03-18 22:08 - 2013-10-01 23:53 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-03-18 22:08 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-03-16 22:55 - 2014-03-16 22:55 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos Entertainment
2014-03-16 22:52 - 2014-03-16 22:52 - 00291128 _____ () C:\Windows\system32\PnkBstrB.xtr
2014-03-16 22:52 - 2014-03-16 22:52 - 00000000 ____D () C:\Users\tobi\Documents\Arktos
2014-03-16 22:52 - 2014-03-16 22:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\PunkBuster
2014-03-16 22:52 - 2014-03-16 22:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\CrashRpt
2014-03-16 22:52 - 2014-03-16 22:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos
2014-03-16 22:42 - 2014-03-16 22:52 - 00291128 _____ () C:\Windows\system32\PnkBstrB.exe
2014-03-16 22:42 - 2014-03-16 22:52 - 00139528 _____ () C:\Windows\system32\Drivers\PnkBstrK.sys
2014-03-16 22:42 - 2014-03-16 22:42 - 00281872 _____ () C:\Windows\system32\PnkBstrB.ex0
2014-03-16 22:42 - 2014-03-16 22:42 - 00138904 _____ () C:\Users\tobi\AppData\Roaming\PnkBstrK.sys
2014-03-16 22:42 - 2014-03-16 22:42 - 00076888 _____ () C:\Windows\system32\PnkBstrA.exe
2014-03-11 23:25 - 2014-03-11 23:25 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe
2014-03-11 21:30 - 2014-02-07 02:07 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-11 21:30 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-11 21:30 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-11 21:30 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-11 21:30 - 2014-01-28 03:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-03 01:09 - 2014-03-03 01:09 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\steamvr
2014-03-02 22:40 - 2014-03-02 22:40 - 00000213 _____ () C:\Users\tobi\Desktop\Team Fortress 2.url
2014-03-02 18:52 - 2014-03-02 18:52 - 00002687 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-03-02 18:52 - 2014-03-02 18:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\Skype
2014-03-02 18:52 - 2014-03-02 18:52 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-02-27 15:54 - 2014-02-27 15:54 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-27 15:53 - 2014-02-27 15:54 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-02-27 15:53 - 2014-02-27 15:54 - 00000000 ____D () C:\Program Files\iTunes
2014-02-27 15:53 - 2014-02-27 15:53 - 00000000 ____D () C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

2014-03-29 16:08 - 2014-03-29 16:01 - 00000000 ____D () C:\Users\tobi\Desktop\Trojaner-Board
2014-03-29 16:08 - 2013-10-09 16:54 - 00000000 ____D () C:\FRST
2014-03-29 15:47 - 2013-06-01 20:47 - 00001180 _____ () C:\Windows\Tasks\Plus-HD-2.6-updater.job
2014-03-29 15:47 - 2013-06-01 20:46 - 00001084 _____ () C:\Windows\Tasks\Plus-HD-2.6-enabler.job
2014-03-29 15:46 - 2013-06-01 20:46 - 00001878 _____ () C:\Windows\Tasks\Plus-HD-2.6-chromeinstaller.job
2014-03-29 15:46 - 2013-06-01 20:46 - 00001804 _____ () C:\Windows\Tasks\Plus-HD-2.6-firefoxinstaller.job
2014-03-29 15:46 - 2013-06-01 20:46 - 00001184 _____ () C:\Windows\Tasks\Plus-HD-2.6-codedownloader.job
2014-03-29 15:43 - 2012-11-03 14:02 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-29 15:42 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-29 15:42 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-29 15:34 - 2014-03-22 23:01 - 00002276 _____ () C:\Windows\Tasks\addplushd-firefoxinstaller.job
2014-03-29 15:34 - 2014-03-22 23:01 - 00001482 _____ () C:\Windows\Tasks\addplushd-updater.job
2014-03-29 15:34 - 2014-03-22 23:01 - 00001436 _____ () C:\Windows\Tasks\addplushd-codedownloader.job
2014-03-29 15:34 - 2014-03-22 23:01 - 00001336 _____ () C:\Windows\Tasks\addplushd-enabler.job
2014-03-29 15:34 - 2014-03-22 23:00 - 00003070 _____ () C:\Windows\Tasks\addplushd-chromeinstaller.job
2014-03-29 15:34 - 2013-09-01 19:09 - 00078313 _____ () C:\Windows\setupact.log
2014-03-29 15:34 - 2013-05-19 17:05 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2014-03-29 15:34 - 2012-11-03 14:02 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-29 15:34 - 2012-06-08 10:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-03-29 15:34 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-29 15:25 - 2012-08-02 02:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-29 15:01 - 2012-08-02 00:09 - 02058058 _____ () C:\Windows\WindowsUpdate.log
2014-03-29 14:56 - 2013-04-02 01:51 - 00000924 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1740813220-741005101-994693073-1006UA.job
2014-03-29 14:53 - 2012-08-12 15:41 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\TS3Client
2014-03-29 00:22 - 2012-07-02 17:45 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Skype
2014-03-28 23:14 - 2012-09-06 20:12 - 00000000 ____D () C:\Users\tobi\AppData\Local\CrashDumps
2014-03-28 22:17 - 2014-03-28 22:17 - 00208781 _____ () C:\Users\tobi\Downloads\UCgKJyJq9RKrNvMp1pgHo1Cw.htm
2014-03-27 21:10 - 2014-03-24 18:01 - 00000000 ____D () C:\Users\tobi\AppData\Local\Battle.net
2014-03-26 15:41 - 2011-07-09 16:57 - 00000000 ____D () C:\Windows\Minidump
2014-03-26 15:39 - 2014-03-26 15:39 - 00427991 ____N () C:\Windows\Minidump\032614-18766-01.dmp
2014-03-24 18:43 - 2014-03-24 18:43 - 00000000 ____D () C:\Users\tobi\Documents\Diablo III
2014-03-24 18:15 - 2014-03-24 18:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Battle.net
2014-03-24 18:04 - 2014-03-24 18:04 - 00000669 _____ () C:\Users\Public\Desktop\Diablo III.lnk
2014-03-24 18:04 - 2011-07-22 18:14 - 00000000 ____D () C:\Program Files\Common Files\Blizzard Entertainment
2014-03-24 18:01 - 2014-03-24 18:01 - 00000657 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-03-24 18:01 - 2014-03-24 18:01 - 00000000 ____D () C:\Users\tobi\AppData\Local\Blizzard Entertainment
2014-03-24 18:01 - 2014-03-24 18:00 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-03-24 17:59 - 2014-03-24 17:58 - 00000000 ____D () C:\ProgramData\Battle.net
2014-03-24 17:58 - 2014-03-24 17:58 - 06018744 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-Setup-deDE.exe
2014-03-24 17:55 - 2014-03-24 17:55 - 07341464 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-8370-deDE-Installer-downloader.exe
2014-03-24 17:50 - 2014-03-24 17:50 - 00000048 _____ () C:\Users\tobi\Downloads\Diablo Key.txt
2014-03-24 16:31 - 2014-03-22 23:09 - 00000000 ____D () C:\Users\tobi\.gimp-2.8
2014-03-24 16:29 - 2014-03-24 16:29 - 00007306 _____ () C:\Users\tobi\AppData\Local\recently-used.xbel
2014-03-24 16:27 - 2014-03-22 23:14 - 00000000 ____D () C:\Users\tobi\AppData\Local\gtk-2.0
2014-03-24 16:26 - 2014-03-24 16:26 - 00000000 ____D () C:\Users\tobi\AppData\Local\webkit
2014-03-24 13:58 - 2013-10-02 16:12 - 00000000 ____D () C:\Nexon
2014-03-24 03:03 - 2013-04-02 01:51 - 00000902 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1740813220-741005101-994693073-1006Core.job
2014-03-23 23:04 - 2014-03-23 22:45 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Systweak
2014-03-23 22:59 - 2012-07-02 17:26 - 00000000 ____D () C:\Users\tobi
2014-03-23 22:58 - 2014-03-23 22:54 - 00002208 _____ () C:\Windows\system32\ASOROSet.bin
2014-03-23 22:58 - 2013-09-09 17:40 - 00117360 _____ () C:\Windows\PFRO.log
2014-03-23 22:58 - 2009-07-14 03:03 - 43515904 _____ () C:\Windows\system32\config\software.bak
2014-03-23 22:58 - 2009-07-14 03:03 - 17563648 _____ () C:\Windows\system32\config\system.bak
2014-03-23 22:58 - 2009-07-14 03:03 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-03-23 22:55 - 2009-07-14 03:03 - 00061440 _____ () C:\Windows\system32\config\sam.bak
2014-03-23 22:54 - 2014-03-23 22:54 - 00000000 ____D () C:\Windows\system32\config\RCCBakup
2014-03-23 22:44 - 2014-03-23 22:44 - 04433440 _____ (Systweak Inc ) C:\Users\tobi\Downloads\rcpsetupg_apptvlatest-apptvlatest_2021.exe
2014-03-23 22:30 - 2014-03-22 23:00 - 00000000 ____D () C:\Program Files\ResultsAlpha
2014-03-23 18:37 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-03-23 18:36 - 2013-12-29 21:24 - 00000000 ____D () C:\Users\tobi\.android
2014-03-23 18:31 - 2014-02-12 19:47 - 00000000 ____D () C:\Users\tobi\AppData\Local\Unity
2014-03-23 18:05 - 2014-03-22 23:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Security System 2
2014-03-23 17:07 - 2013-07-05 22:55 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2014-03-23 16:05 - 2014-03-23 16:05 - 00000000 ____D () C:\ProgramData\CDB
2014-03-23 16:05 - 2014-03-23 16:04 - 00000155 _____ () C:\Windows\Reimage.ini
2014-03-23 16:03 - 2014-03-23 16:03 - 00784984 _____ (Reimage®) C:\Users\tobi\Downloads\ReimageRepair.exe
2014-03-23 16:03 - 2014-03-23 16:03 - 00518816 _____ () C:\Users\tobi\Downloads\Player.exe
2014-03-23 14:05 - 2009-07-14 03:04 - 00000489 _____ () C:\Windows\win.ini
2014-03-23 01:40 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-03-23 01:38 - 2014-03-23 01:38 - 00141271 ____N () C:\Windows\Minidump\032314-49873-01.dmp
2014-03-22 23:11 - 2014-03-22 23:11 - 00000000 ____D () C:\Users\tobi\.thumbnails
2014-03-22 23:09 - 2014-03-22 23:09 - 00000000 ____D () C:\Users\tobi\AppData\Local\gegl-0.2
2014-03-22 23:08 - 2014-03-22 23:08 - 00001045 _____ () C:\Users\tobi\Desktop\GIMP 2.lnk
2014-03-22 23:05 - 2014-03-22 23:04 - 90332288 _____ (The GIMP Team ) C:\Users\tobi\Downloads\gimp-2.8.8-setup.exe
2014-03-22 23:03 - 2014-03-22 23:01 - 00000000 ____D () C:\Program Files\GIMP 2
2014-03-22 23:01 - 2014-03-22 23:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\BupSystem
2014-03-22 23:01 - 2014-03-22 23:00 - 00000000 ____D () C:\Program Files\addplushd
2014-03-22 23:00 - 2014-03-22 22:57 - 00000000 ____D () C:\Users\tobi\AppData\Local\DownloadGuide
2014-03-22 22:59 - 2014-03-22 22:59 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-03-22 22:57 - 2014-03-22 22:57 - 00653512 _____ () C:\Users\tobi\Downloads\GIMP_Setup_Download.exe
2014-03-22 17:56 - 2011-07-07 11:15 - 00420430 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-21 22:17 - 2014-01-26 03:36 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\.minecraft
2014-03-20 15:13 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2014-03-20 00:42 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-03-19 20:56 - 2011-07-10 12:02 - 00000000 ____D () C:\Program Files\Common Files\Steam
2014-03-18 22:20 - 2009-07-14 09:49 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-03-18 22:16 - 2014-03-18 22:12 - 00009985 _____ () C:\Windows\IE11_main.log
2014-03-18 22:14 - 2014-03-18 22:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-03-18 22:14 - 2014-03-18 22:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-03-18 22:14 - 2014-03-18 22:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-03-18 22:14 - 2014-03-18 22:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-03-18 22:14 - 2014-03-18 22:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-03-18 22:14 - 2014-03-18 22:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-03-18 22:14 - 2014-03-18 22:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-03-18 22:14 - 2014-03-18 22:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-03-18 22:14 - 2014-03-18 22:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-03-18 22:14 - 2014-03-18 22:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-03-18 22:12 - 2014-03-18 22:12 - 00000020 ___SH () C:\Users\UpdatusUser\ntuser.ini
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Startmenü
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Netzwerkumgebung
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Druckumgebung
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Musik
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Bilder
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-03-18 22:12 - 2014-03-18 22:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Local\Verlauf
2014-03-18 22:12 - 2011-07-07 14:59 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-03-18 22:11 - 2011-07-07 14:59 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-03-18 22:07 - 2013-08-17 12:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-18 22:05 - 2011-07-07 14:32 - 87350280 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-16 22:55 - 2014-03-16 22:55 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos Entertainment
2014-03-16 22:52 - 2014-03-16 22:52 - 00291128 _____ () C:\Windows\system32\PnkBstrB.xtr
2014-03-16 22:52 - 2014-03-16 22:52 - 00000000 ____D () C:\Users\tobi\Documents\Arktos
2014-03-16 22:52 - 2014-03-16 22:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\PunkBuster
2014-03-16 22:52 - 2014-03-16 22:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\CrashRpt
2014-03-16 22:52 - 2014-03-16 22:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos
2014-03-16 22:52 - 2014-03-16 22:42 - 00291128 _____ () C:\Windows\system32\PnkBstrB.exe
2014-03-16 22:52 - 2014-03-16 22:42 - 00139528 _____ () C:\Windows\system32\Drivers\PnkBstrK.sys
2014-03-16 22:42 - 2014-03-16 22:42 - 00281872 _____ () C:\Windows\system32\PnkBstrB.ex0
2014-03-16 22:42 - 2014-03-16 22:42 - 00138904 _____ () C:\Users\tobi\AppData\Roaming\PnkBstrK.sys
2014-03-16 22:42 - 2014-03-16 22:42 - 00076888 _____ () C:\Windows\system32\PnkBstrA.exe
2014-03-16 22:34 - 2012-06-10 15:20 - 00000000 ____D () C:\Windows\system32\directx
2014-03-13 19:40 - 2012-08-12 15:40 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-03-12 15:40 - 2013-09-01 19:09 - 00415944 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-12 15:38 - 2012-12-08 18:30 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-11 23:25 - 2014-03-11 23:25 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe
2014-03-11 23:25 - 2012-08-02 02:33 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-03-11 23:25 - 2011-07-07 20:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-03-07 14:33 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-03 01:09 - 2014-03-03 01:09 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\steamvr
2014-03-02 22:40 - 2014-03-02 22:40 - 00000213 _____ () C:\Users\tobi\Desktop\Team Fortress 2.url
2014-03-02 19:53 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-02 18:52 - 2014-03-02 18:52 - 00002687 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-03-02 18:52 - 2014-03-02 18:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\Skype
2014-03-02 18:52 - 2014-03-02 18:52 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-03-02 18:52 - 2012-12-02 01:57 - 00000000 ___RD () C:\Program Files\Skype
2014-03-02 18:52 - 2011-08-01 11:14 - 00000000 ____D () C:\ProgramData\Skype
2014-03-01 05:30 - 2014-03-19 14:32 - 17074688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-01 05:11 - 2014-03-19 14:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-01 05:10 - 2014-03-19 14:32 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-01 04:52 - 2014-03-19 14:32 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-01 04:51 - 2014-03-19 14:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-01 04:47 - 2014-03-19 14:32 - 02168320 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-01 04:43 - 2014-03-19 14:32 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-01 04:43 - 2014-03-19 14:32 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-01 04:40 - 2014-03-19 14:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-01 04:38 - 2014-03-19 14:32 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-01 04:38 - 2014-03-19 14:32 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-01 04:37 - 2014-03-19 14:32 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-01 04:31 - 2014-03-19 14:32 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-01 04:25 - 2014-03-19 14:32 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-01 04:16 - 2014-03-19 14:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-01 04:14 - 2014-03-19 14:32 - 04244480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-01 04:03 - 2014-03-19 14:32 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-01 04:00 - 2014-03-19 14:32 - 01964032 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-01 03:57 - 2014-03-19 14:32 - 11266048 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-01 03:32 - 2014-03-19 14:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-01 03:27 - 2014-03-19 14:32 - 01156096 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-01 03:25 - 2014-03-19 14:32 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-27 15:54 - 2014-02-27 15:54 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-27 15:54 - 2014-02-27 15:53 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-02-27 15:54 - 2014-02-27 15:53 - 00000000 ____D () C:\Program Files\iTunes
2014-02-27 15:53 - 2014-02-27 15:53 - 00000000 ____D () C:\Program Files\iPod
2014-02-27 15:53 - 2014-02-18 15:48 - 00000000 ____D () C:\Program Files\Common Files\Apple

Files to move or delete:
====================
C:\ProgramData\dlprotect.exe


Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\temp\NGM.exe
C:\Users\Administrator\AppData\Local\temp\NGMDll.dll
C:\Users\Administrator\AppData\Local\temp\NGMResource.dll
C:\Users\tobi\AppData\Local\temp\avgnt.exe
C:\Users\tobi\AppData\Local\temp\jre-7u51-windows-i586-iftw.exe
C:\Users\tobi\AppData\Local\temp\ReimagePackage.exe
C:\Users\tobi\AppData\Local\temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-20 13:24

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-29 16:20:22
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 ST3500418AS rev.CC38 465,76GB
Running: yrcnm1o9.exe; Driver: C:\Users\tobi\AppData\Local\Temp\uwdiipod.sys


---- Registry - GMER 2.1 ----

Reg  HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{29B04883-A87D-11E0-9C15-806E6F6E6963}                                                                         11239289008
Reg  HKLM\SOFTWARE\Classes\CLSID\{722b3793-5367-4446-b6bb-db89b05c1f24}\LocalServer32@                                                                                                              %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {722b3793-5367-4446-b6bb-db89b05c1f24}
Reg  HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\tobi\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe  1

---- EOF - GMER 2.1 ----

schrauber · 30.03.2014, 12:45

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Solitron · 30.03.2014, 13:27

Laut Combofix waren 'Microsoft Security Essentials' antivirus und antispyware noch aktiv. Diese konnte ich allerdings nicht ausfindig machen, dafür habe ich aber 'Microsoft Antimalware Service' gefunden, was sich jedoch nicht beenden lies (Zugriff verweigert).
Was soll ich nun tun?

Edit: Ich habe übrigens Combofix danach nicht ausgeführt. Ich hielt es nach der Warnung von Combofix für falsch.

schrauber · 31.03.2014, 10:34

Führe es einfach aus

Solitron · 31.03.2014, 11:53

Hier die gewünschte C:\ComboFix.txt

Code:

ATTFilter

ComboFix 14-03-24.01 - tobi 31.03.2014  12:38:18.2.4 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3327.2213 [GMT 2:00]
ausgeführt von:: c:\users\tobi\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\addplushd\adDPlushd-bho.dll
c:\programdata\dlprotect.exe
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_aaipilfmheplbcghignccoiiebekkdhe_0
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_aaipilfmheplbcghignccoiiebekkdhe_0\51
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\background.html
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\chromeCoreFilesIndex.txt
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\crossriderManifest.json
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\manifest.xml
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins.json
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\1_base.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\102_dealply_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\103_intext_5_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\104_jollywallet_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\123_intext_adv_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\14_CrossriderUtils.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\155_ibario_pops_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\17_jQuery.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\177_crossriderDashboard.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\179_revizer_p_dynamic_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\180_bpo_serp_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\182_openUrl.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\183_tabsWrapper.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\184_noproblemppc_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\19_CHAppAPIWrapper.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\190_pops_5_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\191_ciuvo_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\207_dbWrapper.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\21_debug.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\22_resources.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\220_icm_base_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\221_icm_downloads_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\223_imonomy_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\231_revizer_ws_dynamic_2_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\246_setup.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\28_initializer.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\4_jquery_1_7_1.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\47_resources_background.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\64_appApiMessage.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\7_hooks.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\72_appApiValidation.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\78_CrossriderInfo.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\80_CHPopupAppAPI.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\9_search_engine_hook.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\91_monetizationLoader.js.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\plugins\97_resourceApiWrapper.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\userCode\background.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\extensionData\userCode\extension.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\icons\actions\1.png
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\icons\icon128.png
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\icons\icon16.png
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\icons\icon48.png
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\api\chrome.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\api\cookie.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\api\message.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\api\monitor.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\api\pageAction.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\api\pageActionBG.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\background.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\app_api.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\bg_app_api.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\consts.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\cookie_store.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\crossriderAPI.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\delegate.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\events.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\extensionDataStore.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\installer.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\logFile.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\logging.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\onBGDocumentLoad.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\popupResource\newPopup.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\popupResource\popup.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\reports.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\storageWrapper.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\updateManager.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\util.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\lib\xhr.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\main.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\js\platformVersion.js
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\manifest.json
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe\1.26.20_0\popup.html
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe\000162.ldb
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe\000167.ldb
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe\000173.ldb
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe\000176.ldb
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe\000177.log
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe\CURRENT
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe\LOCK
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe\LOG
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe\LOG.old
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aaipilfmheplbcghignccoiiebekkdhe\MANIFEST-000175
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_aaipilfmheplbcghignccoiiebekkdhe_0.localstorage-journal
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_aaipilfmheplbcghignccoiiebekkdhe_0.localstorage
c:\users\tobi\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\tobi\AppData\Roaming\load_winupd.exe
c:\users\tobi\AppData\Roaming\youtube downloader.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-02-28 bis 2014-03-31  ))))))))))))))))))))))))))))))
.
.
2014-03-31 10:47 . 2014-03-31 10:47	--------	d-----w-	c:\users\tobi\AppData\Local\temp
2014-03-31 10:47 . 2014-03-31 10:47	--------	d-----w-	c:\users\Public\AppData\Local\temp
2014-03-31 10:47 . 2014-03-31 10:47	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-03-31 10:36 . 2014-03-31 10:36	39464	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{71C05A62-9400-44B8-98E1-58EECA801114}\MpKsl24076ebc.sys
2014-03-30 21:35 . 2014-03-07 04:35	7969936	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{71C05A62-9400-44B8-98E1-58EECA801114}\mpengine.dll
2014-03-30 00:59 . 2014-03-30 01:16	107736	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-03-30 00:58 . 2014-03-05 08:26	51416	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-03-30 00:58 . 2014-03-05 08:26	73432	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-03-30 00:58 . 2014-03-05 08:26	23256	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-03-29 19:53 . 2014-02-17 12:30	765968	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3DC107DD-C63E-488D-B619-97DA21A5239C}\gapaengine.dll
2014-03-29 19:53 . 2014-03-07 04:35	7969936	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-03-24 17:01 . 2014-03-24 17:01	--------	d-----w-	c:\users\tobi\AppData\Local\Blizzard Entertainment
2014-03-24 17:01 . 2014-03-30 17:09	--------	d-----w-	c:\users\tobi\AppData\Local\Battle.net
2014-03-24 17:01 . 2014-03-24 17:15	--------	d-----w-	c:\users\tobi\AppData\Roaming\Battle.net
2014-03-24 17:00 . 2014-03-24 17:01	--------	d-----w-	c:\programdata\Blizzard Entertainment
2014-03-24 16:58 . 2014-03-24 16:59	--------	d-----w-	c:\programdata\Battle.net
2014-03-24 15:26 . 2014-03-24 15:26	--------	d-----w-	c:\users\tobi\AppData\Local\webkit
2014-03-23 21:54 . 2014-03-23 21:58	2208	----a-w-	c:\windows\system32\ASOROSet.bin
2014-03-23 21:45 . 2014-03-23 22:04	--------	d-----w-	c:\users\tobi\AppData\Roaming\Systweak
2014-03-23 21:45 . 2013-02-28 15:27	18776	----a-w-	c:\windows\system32\roboot.exe
2014-03-23 15:05 . 2014-03-23 15:05	--------	d-----w-	c:\programdata\CDB
2014-03-22 22:14 . 2014-03-24 15:27	--------	d-----w-	c:\users\tobi\AppData\Local\gtk-2.0
2014-03-22 22:11 . 2014-03-22 22:11	--------	d-----w-	c:\users\tobi\.thumbnails
2014-03-22 22:09 . 2014-03-22 22:09	--------	d-----w-	c:\users\tobi\AppData\Local\fontconfig
2014-03-22 22:09 . 2014-03-24 15:31	--------	d-----w-	c:\users\tobi\.gimp-2.8
2014-03-22 22:09 . 2014-03-22 22:09	--------	d-----w-	c:\users\tobi\AppData\Local\gegl-0.2
2014-03-22 22:01 . 2014-03-22 22:03	--------	d-----w-	c:\program files\GIMP 2
2014-03-22 22:01 . 2014-03-22 22:01	--------	d-----w-	c:\users\tobi\AppData\Roaming\BupSystem
2014-03-22 22:01 . 2014-03-23 17:05	--------	d-----w-	c:\users\tobi\AppData\Roaming\Security System 2
2014-03-22 22:00 . 2014-03-31 10:46	--------	d-----w-	c:\program files\addplushd
2014-03-22 22:00 . 2014-03-23 21:30	--------	d-----w-	c:\program files\ResultsAlpha
2014-03-22 21:57 . 2014-03-22 22:00	--------	d-----w-	c:\users\tobi\AppData\Local\DownloadGuide
2014-03-19 13:33 . 2013-12-21 08:56	454656	----a-w-	c:\windows\system32\vbscript.dll
2014-03-18 21:14 . 2014-03-18 21:14	71680	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2014-03-18 21:12 . 2014-03-30 22:39	--------	d-----w-	c:\users\UpdatusUser
2014-03-18 21:08 . 2013-10-01 23:45	32256	----a-w-	c:\windows\system32\TsUsbGDCoInstaller.dll
2014-03-18 21:08 . 2013-10-02 00:32	12800	----a-w-	c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-03-18 21:08 . 2013-10-02 00:42	49152	----a-w-	c:\windows\system32\drivers\TsUsbFlt.sys
2014-03-18 21:08 . 2013-10-02 00:30	14336	----a-w-	c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-03-18 21:08 . 2013-10-02 00:14	50176	----a-w-	c:\windows\system32\MsRdpWebAccess.dll
2014-03-18 21:08 . 2013-10-02 00:14	17920	----a-w-	c:\windows\system32\wksprtPS.dll
2014-03-18 21:08 . 2013-10-01 23:58	53248	----a-w-	c:\windows\system32\tsgqec.dll
2014-03-18 21:08 . 2013-10-01 23:08	855552	----a-w-	c:\windows\system32\rdvidcrl.dll
2014-03-18 21:08 . 2013-10-01 23:00	76288	----a-w-	c:\windows\system32\TSWbPrxy.exe
2014-03-18 21:08 . 2013-10-01 22:53	350208	----a-w-	c:\windows\system32\wksprt.exe
2014-03-18 21:08 . 2013-10-01 22:34	1068544	----a-w-	c:\windows\system32\mstsc.exe
2014-03-16 21:55 . 2014-03-16 21:55	--------	d-----w-	c:\users\tobi\AppData\Local\Arktos Entertainment
2014-03-16 21:52 . 2014-03-16 21:52	291128	----a-w-	c:\windows\system32\PnkBstrB.xtr
2014-03-16 21:52 . 2014-03-16 21:52	--------	d-----w-	c:\users\tobi\AppData\Local\PunkBuster
2014-03-16 21:52 . 2014-03-16 21:52	--------	d-----w-	c:\users\tobi\AppData\Local\Arktos
2014-03-16 21:52 . 2014-03-16 21:52	--------	d-----w-	c:\users\tobi\AppData\Local\CrashRpt
2014-03-16 21:42 . 2014-03-16 21:52	139528	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2014-03-16 21:42 . 2014-03-16 21:42	138904	----a-w-	c:\users\tobi\AppData\Roaming\PnkBstrK.sys
2014-03-16 21:42 . 2014-03-16 21:52	291128	----a-w-	c:\windows\system32\PnkBstrB.exe
2014-03-16 21:42 . 2014-03-16 21:42	281872	----a-w-	c:\windows\system32\PnkBstrB.ex0
2014-03-16 21:42 . 2014-03-16 21:42	76888	----a-w-	c:\windows\system32\PnkBstrA.exe
2014-03-11 22:25 . 2014-03-11 22:25	5777288	----a-w-	c:\windows\system32\FlashPlayerInstaller.exe
2014-03-11 20:30 . 2014-02-04 02:04	509440	----a-w-	c:\windows\system32\qedit.dll
2014-03-11 20:30 . 2014-01-28 02:07	185344	----a-w-	c:\windows\system32\wwansvc.dll
2014-03-11 20:30 . 2014-02-07 01:07	2349056	----a-w-	c:\windows\system32\win32k.sys
2014-03-11 20:30 . 2014-02-04 02:04	1230336	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-03-11 20:30 . 2014-01-29 02:06	381440	----a-w-	c:\windows\system32\wer.dll
2014-03-03 00:09 . 2014-03-03 00:09	--------	d-----w-	c:\users\tobi\AppData\Roaming\steamvr
2014-03-02 17:52 . 2014-03-02 17:52	--------	d-----w-	c:\users\tobi\AppData\Local\Skype
2014-03-02 17:52 . 2014-03-02 17:52	--------	d-----w-	c:\program files\Common Files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-11 22:25 . 2012-08-02 01:33	692616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-03-11 22:25 . 2011-07-07 19:03	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-02-18 14:52 . 2014-02-18 14:52	851176	----a-w-	c:\windows\system32\WinUSBCoInstaller2.dll
2014-02-18 14:52 . 2014-02-18 14:52	1461992	----a-w-	c:\windows\system32\WdfCoInstaller01009.dll
2014-02-17 12:30 . 2014-02-28 19:35	765968	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-02-06 07:08 . 2014-02-21 14:43	7947048	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C0B26EA4-B0DB-4251-8F7A-B6B8C2E2383D}\mpengine.dll
2014-01-19 07:32 . 2011-07-07 12:54	231584	------w-	c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WSHelperSetup.exe"="c:\program files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" [2013-07-25 1985824]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-02-18 689744]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"WSHelperSetup.exe"="c:\program files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" [2013-07-25 1985824]
"Wondershare Helper Compact.exe"="c:\program files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" [2013-07-25 1985824]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-02-21 152392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LOLRecorder.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk
backup=c:\windows\pss\LOLRecorder.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Tobi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\Tobi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApplePhotoStreams]
2013-11-20 14:43	59720	----a-w-	d:\apple\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2014-02-05 23:52	43848	----a-w-	c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVSSkypeRecorder]
2013-08-27 11:40	821416	----a-w-	c:\program files\DVDVideoSoft\Free Video Call Recorder for Skype\skyui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2013-04-02 00:50	138096	----atw-	c:\users\tobi\AppData\Local\Facebook\Update\FacebookUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlyForHeroInstaller]
2012-10-12 15:22	5856256	----a-w-	c:\users\tobi\AppData\Roaming\FlyForHeroInstaller\FlyForHeroInstaller.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iCloudServices]
2013-11-20 14:43	59720	----a-w-	d:\apple\Common Files\Apple\Internet Services\iCloudServices.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2014-02-21 02:54	152392	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2011-11-11 12:08	205336	----a-w-	c:\program files\Logitech\LWS\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2014-02-10 16:46	20922016	----a-r-	c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Speech Recognition]
2009-07-14 01:14	51712	----a-w-	c:\windows\Speech\Common\sapisvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-07-02 08:16	254336	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R3 apf003;apf003;c:\windows\system32\apf003.sys [2013-05-29 13232]
R3 cpuz134;cpuz134;c:\users\tobi\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-01 108032]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-11-19 37352]
S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys [2012-08-01 35560]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-02-18 440400]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MPKSL24076EBC
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-03-15 19:46	1150280	----a-w-	c:\program files\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-03-31 c:\windows\Tasks\addplushd-chromeinstaller.job
- c:\program files\addplushd\addplushd-chromeinstaller.exe [2014-03-22 22:00]
.
2014-03-31 c:\windows\Tasks\addplushd-codedownloader.job
- c:\program files\addplushd\addplushd-codedownloader.exe [2014-03-22 22:01]
.
2014-03-31 c:\windows\Tasks\addplushd-enabler.job
- c:\program files\addplushd\addplushd-enabler.exe [2014-03-22 22:01]
.
2014-03-31 c:\windows\Tasks\addplushd-firefoxinstaller.job
- c:\program files\addplushd\addplushd-firefoxinstaller.exe [2014-03-22 22:01]
.
2014-03-31 c:\windows\Tasks\addplushd-updater.job
- c:\program files\addplushd\addplushd-updater.exe [2014-03-22 22:01]
.
2014-03-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-02 22:25]
.
2014-03-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1740813220-741005101-994693073-1006Core.job
- c:\users\tobi\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-04-02 00:50]
.
2014-03-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1740813220-741005101-994693073-1006UA.job
- c:\users\tobi\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-04-02 00:50]
.
2014-03-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-11-03 13:02]
.
2014-03-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-11-03 13:02]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>;*.local
uSearchAssistant = hxxp://www.bing.com/search?q={searchTerms}
Trusted Zone: aeriagames.com
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-Download Protect - c:\programdata\dlprotect.exe
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
MSConfigStartUp-HDAudDeck - c:\program files\VIA\VIAudioi\VDeck\VDeck.exe
MSConfigStartUp-KPeerNexonEU - c:\nexon\NEXON_EU_Downloader\nxEULauncher.exe
MSConfigStartUp-LogMeIn Hamachi Ui - c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
MSConfigStartUp-Overwolf - c:\program files\Overwolf\Overwolf.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:00,cb,2c,17,77,54,ce,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ee,eb,06,df,6d,58,42,41,95,c6,ff,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ee,eb,06,df,6d,58,42,41,95,c6,ff,\
.
[HKEY_USERS\S-1-5-21-1740813220-741005101-994693073-1006\Software\SecuROM\License information*]
"datasecu"=hex:ca,27,64,1b,9d,aa,9b,0c,bb,16,3d,0f,c4,6f,15,8b,89,61,58,a9,42,
   f8,0e,e3,e9,6f,d8,f6,07,b6,a3,dc,4a,c2,16,cc,e9,c8,b0,cd,6c,97,86,8f,8a,9b,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{722b3793-5367-4446-b6bb-db89b05c1f24}\LocalServer32]
@DACL=(02 0000)
@=expand:"%SystemRoot%\\System32\\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {722b3793-5367-4446-b6bb-db89b05c1f24}"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-03-31  12:49:33
ComboFix-quarantined-files.txt  2014-03-31 10:49
ComboFix2.txt  2012-10-11 23:45
.
Vor Suchlauf: 12 Verzeichnis(se), 29.377.298.432 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 30.953.422.848 Bytes frei
.
- - End Of File - - A8F5332750A704052AED3335127B74E1
A36C5E4F47E84449FF07ED3517B43A31

schrauber · 01.04.2014, 09:01

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Solitron · 01.04.2014, 11:13

Es ist mir eine Freude mit Ihnen zusammenzuarbeiten Herr schrauber

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org


Protection, 01.04.2014 11:34:57, SYSTEM, TOBIAS-PC, Protection, Malware Protection, Starting, 
Protection, 01.04.2014 11:34:57, SYSTEM, TOBIAS-PC, Protection, Malware Protection, Started, 
Protection, 01.04.2014 11:34:57, SYSTEM, TOBIAS-PC, Protection, Malicious Website Protection, Starting, 
Update, 01.04.2014 11:35:13, SYSTEM, TOBIAS-PC, Manual, Rootkit Database, 2014.2.20.1, 2014.3.27.1, 
Protection, 01.04.2014 11:35:15, SYSTEM, TOBIAS-PC, Protection, Refresh, Starting, 
Protection, 01.04.2014 11:35:28, SYSTEM, TOBIAS-PC, Protection, Malicious Website Protection, Started, 
Protection, 01.04.2014 11:35:28, SYSTEM, TOBIAS-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 01.04.2014 11:35:28, SYSTEM, TOBIAS-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 01.04.2014 11:35:32, SYSTEM, TOBIAS-PC, Protection, Refresh, Success, 
Protection, 01.04.2014 11:35:32, SYSTEM, TOBIAS-PC, Protection, Malicious Website Protection, Starting, 
Protection, 01.04.2014 11:35:32, SYSTEM, TOBIAS-PC, Protection, Malicious Website Protection, Started, 

(end)

--- --- ---

Code:

ATTFilter

# AdwCleaner v3.023 - Bericht erstellt am 01/04/2014 um 11:57:47
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : tobi - TOBIAS-PC
# Gestartet von : C:\Users\tobi\Desktop\adwcleaner0.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\AI_RecycleBin
Ordner Gelöscht : C:\Program Files\addplushd
Ordner Gelöscht : C:\Windows\system32\AI_RecycleBin
Ordner Gelöscht : C:\Users\tobi\AppData\Local\CrashRpt
Ordner Gelöscht : C:\Users\tobi\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\tobi\AppData\Local\genienext
Ordner Gelöscht : C:\Users\tobi\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfcbmgbfdbijmjgjihagbomfbjfjmgon
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde
Ordner Gelöscht : C:\Users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe
Ordner Gelöscht : C:\Users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfigonhgidedenkkhlilmefgodjpefna
Datei Gelöscht : C:\Windows\Tasks\addplushd-chromeinstaller.job
Datei Gelöscht : C:\Windows\System32\Tasks\addplushd-chromeinstaller
Datei Gelöscht : C:\Windows\Tasks\addplushd-codedownloader.job
Datei Gelöscht : C:\Windows\System32\Tasks\addplushd-codedownloader
Datei Gelöscht : C:\Windows\Tasks\addplushd-enabler.job
Datei Gelöscht : C:\Windows\System32\Tasks\addplushd-enabler
Datei Gelöscht : C:\Windows\Tasks\addplushd-firefoxinstaller.job
Datei Gelöscht : C:\Windows\System32\Tasks\addplushd-firefoxinstaller
Datei Gelöscht : C:\Windows\Tasks\addplushd-updater.job
Datei Gelöscht : C:\Windows\System32\Tasks\addplushd-updater

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\cfigonhgidedenkkhlilmefgodjpefna
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\cfigonhgidedenkkhlilmefgodjpefna
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0BDA3037-61AC-4901-BD3D-62D18C1D7C27}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0BDA3037-61AC-4901-BD3D-62D18C1D7C27}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D11118D4-A456-42D6-9BCB-AAE16CF08A43}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D11118D4-A456-42D6-9BCB-AAE16CF08A43}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{58608D03-E6B6-4CEE-A945-E884EFAE0DF6}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{58608D03-E6B6-4CEE-A945-E884EFAE0DF6}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{602A5652-6D8F-430D-98EF-0CB9EEE6B2C6}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{602A5652-6D8F-430D-98EF-0CB9EEE6B2C6}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4F30F87B-21B8-4288-A6F3-FAF29954BB72}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4F30F87B-21B8-4288-A6F3-FAF29954BB72}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522292216}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555295516}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566296616}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ae784383-e931-4eaf-b533-dac05f1ff24a}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e3fc603d-6d5b-43ca-9d84-49a918c9e9a9}
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\addplushd
Schlüssel Gelöscht : HKLM\Software\installedbrowserextensions
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\addplushd
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\addplushd

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16521


-\\ Google Chrome v33.0.1750.154

[ Datei : C:\Users\tobi\AppData\Local\Google\Chrome\User Data\Default\preferences ]


[ Datei : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [25211 octets] - [30/12/2013 18:52:06]
AdwCleaner[R1].txt - [5467 octets] - [01/04/2014 11:56:16]
AdwCleaner[S0].txt - [23565 octets] - [30/12/2013 18:56:54]
AdwCleaner[S1].txt - [5263 octets] - [01/04/2014 11:57:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [5323 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Professional x86
Ran by tobi on 01.04.2014 at 12:02:51,74
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211181106}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211181110}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Deals Plugin Extension-InternalInstaller_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Deals Plugin Extension-InternalInstaller_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Deals Plugin Extension_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Deals Plugin Extension_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BBC6C3C2-2609-4BC5-8569-3A40AD87BBED}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{7430958C-CCEE-7183-F800-3D9AD98A6113}



~~~ Files

Successfully deleted: [File] "C:\Users\tobi\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"



~~~ Folders

Successfully deleted: [Folder] "C:\Users\tobi\appdata\local\cre"
Successfully deleted: [Folder] "C:\Program Files\resultsalpha"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.04.2014 at 12:04:39,76
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014  01
Ran by tobi (administrator) on TOBIAS-PC on 01-04-2014 12:05:46
Running from C:\Users\tobi\Desktop\Trojaner-Board
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\system32\PnkBstrA.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Wondershare) C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-18] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [WSHelperSetup.exe] - C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)
HKLM\...\Run: [Wondershare Helper Compact.exe] - C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKU\S-1-5-21-1740813220-741005101-994693073-1006\...\Run: [WSHelperSetup.exe] - C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - Backup.Old.DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847}
SearchScopes: HKCU - Backup.Old.DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search
SearchScopes: HKCU - {7430958C-CCEE-7183-F800-3D9AD98A6113} URL = 
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [231424] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR Extension: (addplushd) - C:\Users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe [2014-03-31]
CHR Extension: (Google Wallet) - C:\Users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-18]
CHR HKLM\...\Chrome\Extension: [dapejillpcnbpfidhfkpidklcombbmel] - C:\Users\tobi\AppData\Local\CRE\dapejillpcnbpfidhfkpidklcombbmel.crx [2014-01-18]
CHR HKLM\...\Chrome\Extension: [ommhmgednjnodcljhlljkaiidghdmikk] - C:\Users\tobi\AppData\Local\CRE\ommhmgednjnodcljhlljkaiidghdmikk.crx [2014-01-18]
CHR HKCU\...\Chrome\Extension: [dapejillpcnbpfidhfkpidklcombbmel] - C:\Users\tobi\AppData\Local\CRE\dapejillpcnbpfidhfkpidklcombbmel.crx [2014-01-18]
CHR HKCU\...\Chrome\Extension: [ommhmgednjnodcljhlljkaiidghdmikk] - C:\Users\tobi\AppData\Local\CRE\ommhmgednjnodcljhlljkaiidghdmikk.crx [2014-01-18]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
S4 MBAMScheduler; D:\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-03-05] (Malwarebytes Corporation)
S2 MBAMService; D:\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-03-05] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
S3 npggsvc; C:\Windows\system32\GameMon.des [5124464 2012-12-16] (INCA Internet Co., Ltd.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2014-03-16] ()
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

==================== Drivers (Whitelisted) ====================

S3 apf003; C:\Windows\system32\apf003.sys [13232 2013-05-29] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [25280 2013-11-03] (LogMeIn, Inc.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [35560 2012-08-01] (AnchorFree Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-03-05] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-08-01] (AnchorFree Inc)
S3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1143920 2010-08-04] (VIA Technologies, Inc.)
S3 catchme; \??\C:\Users\tobi\AppData\Local\Temp\catchme.sys [X]
S3 cpuz134; \??\C:\Users\tobi\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 vtany; \??\C:\Windows\vtany.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files\IObit\Game Booster\Driver\WinRing0.sys [X]
S3 XDva391; \??\C:\Windows\system32\XDva391.sys [X]
S3 XDva392; \??\C:\Windows\system32\XDva392.sys [X]
S3 XDva393; \??\C:\Windows\system32\XDva393.sys [X]
S3 XDva394; \??\C:\Windows\system32\XDva394.sys [X]
S3 XDva396; \??\C:\Windows\system32\XDva396.sys [X]
S3 XDva397; \??\C:\Windows\system32\XDva397.sys [X]
S3 XDva401; \??\C:\Windows\system32\XDva401.sys [X]
S3 XDva405; \??\C:\Windows\system32\XDva405.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-01 12:04 - 2014-04-01 12:04 - 00002308 _____ () C:\Users\tobi\Desktop\JRT.txt
2014-04-01 12:02 - 2014-04-01 12:02 - 01038974 _____ (Thisisu) C:\Users\tobi\Desktop\JRT.exe
2014-04-01 12:02 - 2014-04-01 12:02 - 00000000 ____D () C:\Windows\ERUNT
2014-04-01 11:54 - 2014-04-01 11:54 - 01953280 _____ () C:\Users\tobi\Desktop\adwcleaner0.exe
2014-04-01 11:49 - 2014-04-01 11:49 - 00001155 _____ () C:\Users\tobi\Desktop\mbam.txt
2014-04-01 11:34 - 2014-04-01 11:34 - 00000613 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-01 11:31 - 2014-04-01 11:32 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\tobi\Desktop\mbam-setup-2.0.0.1000.exe
2014-03-31 22:24 - 2014-03-31 22:24 - 00346915 ____N () C:\Windows\Minidump\033114-16426-01.dmp
2014-03-31 12:49 - 2014-03-31 12:49 - 00032703 _____ () C:\Users\tobi\Desktop\ComboFix.txt
2014-03-31 12:49 - 2014-03-31 12:49 - 00000000 ____D () C:\Users\Tobias
2014-03-30 14:14 - 2014-03-30 14:15 - 05192353 ____R (Swearware) C:\Users\tobi\Desktop\ComboFix.exe
2014-03-30 02:59 - 2014-04-01 11:53 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-30 02:58 - 2014-03-05 09:26 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-30 02:58 - 2014-03-05 09:26 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-03-30 02:58 - 2014-03-05 09:26 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-29 20:52 - 2014-03-30 12:37 - 00003104 _____ () C:\Users\tobi\Desktop\Websites.txt
2014-03-29 17:01 - 2014-04-01 12:05 - 00000000 ____D () C:\Users\tobi\Desktop\Trojaner-Board
2014-03-28 23:17 - 2014-03-28 23:17 - 00208781 _____ () C:\Users\tobi\Downloads\UCgKJyJq9RKrNvMp1pgHo1Cw.htm
2014-03-26 16:39 - 2014-03-26 16:39 - 00427991 ____N () C:\Windows\Minidump\032614-18766-01.dmp
2014-03-24 19:43 - 2014-03-24 19:43 - 00000000 ____D () C:\Users\tobi\Documents\Diablo III
2014-03-24 19:04 - 2014-03-24 19:04 - 00000669 _____ () C:\Users\Public\Desktop\Diablo III.lnk
2014-03-24 19:01 - 2014-03-30 19:09 - 00000000 ____D () C:\Users\tobi\AppData\Local\Battle.net
2014-03-24 19:01 - 2014-03-24 19:15 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Battle.net
2014-03-24 19:01 - 2014-03-24 19:01 - 00000657 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-03-24 19:01 - 2014-03-24 19:01 - 00000000 ____D () C:\Users\tobi\AppData\Local\Blizzard Entertainment
2014-03-24 19:00 - 2014-03-24 19:01 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-03-24 18:58 - 2014-03-24 18:59 - 00000000 ____D () C:\ProgramData\Battle.net
2014-03-24 18:58 - 2014-03-24 18:58 - 06018744 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-Setup-deDE.exe
2014-03-24 18:55 - 2014-03-24 18:55 - 07341464 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-8370-deDE-Installer-downloader.exe
2014-03-24 18:50 - 2014-03-24 18:50 - 00000048 _____ () C:\Users\tobi\Downloads\Diablo Key.txt
2014-03-24 17:29 - 2014-03-24 17:29 - 00007306 _____ () C:\Users\tobi\AppData\Local\recently-used.xbel
2014-03-24 17:26 - 2014-03-24 17:26 - 00000000 ____D () C:\Users\tobi\AppData\Local\webkit
2014-03-23 23:54 - 2014-03-23 23:58 - 00002208 _____ () C:\Windows\system32\ASOROSet.bin
2014-03-23 23:54 - 2014-03-23 23:54 - 00000000 ____D () C:\Windows\system32\config\RCCBakup
2014-03-23 17:05 - 2014-03-23 17:05 - 00000000 ____D () C:\ProgramData\CDB
2014-03-23 17:04 - 2014-03-23 17:05 - 00000155 _____ () C:\Windows\Reimage.ini
2014-03-23 17:03 - 2014-03-23 17:03 - 00784984 _____ (Reimage®) C:\Users\tobi\Downloads\ReimageRepair.exe
2014-03-23 02:38 - 2014-03-23 02:38 - 00141271 ____N () C:\Windows\Minidump\032314-49873-01.dmp
2014-03-23 00:14 - 2014-03-24 17:27 - 00000000 ____D () C:\Users\tobi\AppData\Local\gtk-2.0
2014-03-23 00:11 - 2014-03-23 00:11 - 00000000 ____D () C:\Users\tobi\.thumbnails
2014-03-23 00:09 - 2014-03-24 17:31 - 00000000 ____D () C:\Users\tobi\.gimp-2.8
2014-03-23 00:09 - 2014-03-23 00:09 - 00000000 ____D () C:\Users\tobi\AppData\Local\gegl-0.2
2014-03-23 00:08 - 2014-03-23 00:08 - 00001045 _____ () C:\Users\tobi\Desktop\GIMP 2.lnk
2014-03-23 00:04 - 2014-03-23 00:05 - 90332288 _____ (The GIMP Team ) C:\Users\tobi\Downloads\gimp-2.8.8-setup.exe
2014-03-23 00:01 - 2014-03-23 19:05 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Security System 2
2014-03-23 00:01 - 2014-03-23 00:03 - 00000000 ____D () C:\Program Files\GIMP 2
2014-03-23 00:01 - 2014-03-23 00:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\BupSystem
2014-03-22 23:57 - 2014-03-22 23:57 - 00653512 _____ () C:\Users\tobi\Downloads\GIMP_Setup_Download.exe
2014-03-19 15:33 - 2013-12-21 10:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-03-19 15:32 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-19 15:32 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-19 15:32 - 2014-03-01 06:10 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-19 15:32 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-19 15:32 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-19 15:32 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-19 15:32 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-19 15:32 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-19 15:32 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-19 15:32 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-19 15:32 - 2014-03-01 05:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-19 15:32 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-19 15:32 - 2014-03-01 05:31 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-19 15:32 - 2014-03-01 05:25 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-19 15:32 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-19 15:32 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-19 15:32 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-19 15:32 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-19 15:32 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-19 15:32 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-19 15:32 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-19 15:32 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-19 15:32 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-03-18 23:14 - 2014-03-18 23:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-03-18 23:14 - 2014-03-18 23:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-03-18 23:14 - 2014-03-18 23:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-03-18 23:12 - 2014-03-18 23:16 - 00009985 _____ () C:\Windows\IE11_main.log
2014-03-18 23:12 - 2014-03-18 23:12 - 00000020 ___SH () C:\Users\UpdatusUser\ntuser.ini
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Startmenü
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Netzwerkumgebung
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Druckumgebung
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Musik
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Bilder
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Local\Verlauf
2014-03-18 23:12 - 2012-04-12 01:39 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Microsoft Help
2014-03-18 23:12 - 2009-07-14 06:42 - 00000000 ___RD () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-03-18 23:12 - 2009-07-14 06:37 - 00000000 ___RD () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-03-18 23:08 - 2013-10-02 02:42 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-03-18 23:08 - 2013-10-02 02:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-03-18 23:08 - 2013-10-02 02:30 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-03-18 23:08 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-03-18 23:08 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-03-18 23:08 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-03-18 23:08 - 2013-10-02 01:45 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-03-18 23:08 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-03-18 23:08 - 2013-10-02 01:00 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-03-18 23:08 - 2013-10-02 00:53 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-03-18 23:08 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-03-16 23:55 - 2014-03-16 23:55 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos Entertainment
2014-03-16 23:52 - 2014-03-16 23:52 - 00291128 _____ () C:\Windows\system32\PnkBstrB.xtr
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\Documents\Arktos
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\PunkBuster
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos
2014-03-16 23:42 - 2014-03-16 23:52 - 00291128 _____ () C:\Windows\system32\PnkBstrB.exe
2014-03-16 23:42 - 2014-03-16 23:52 - 00139528 _____ () C:\Windows\system32\Drivers\PnkBstrK.sys
2014-03-16 23:42 - 2014-03-16 23:42 - 00281872 _____ () C:\Windows\system32\PnkBstrB.ex0
2014-03-16 23:42 - 2014-03-16 23:42 - 00138904 _____ () C:\Users\tobi\AppData\Roaming\PnkBstrK.sys
2014-03-16 23:42 - 2014-03-16 23:42 - 00076888 _____ () C:\Windows\system32\PnkBstrA.exe
2014-03-12 00:25 - 2014-03-12 00:25 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe
2014-03-11 22:30 - 2014-02-07 03:07 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-11 22:30 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-11 22:30 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-11 22:30 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-11 22:30 - 2014-01-28 04:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-03 02:09 - 2014-03-03 02:09 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\steamvr
2014-03-02 23:40 - 2014-03-02 23:40 - 00000213 _____ () C:\Users\tobi\Desktop\Team Fortress 2.url
2014-03-02 19:52 - 2014-03-02 19:52 - 00002687 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-03-02 19:52 - 2014-03-02 19:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\Skype
2014-03-02 19:52 - 2014-03-02 19:52 - 00000000 ____D () C:\Program Files\Common Files\Skype

==================== One Month Modified Files and Folders =======

2014-04-01 12:05 - 2014-03-29 17:01 - 00000000 ____D () C:\Users\tobi\Desktop\Trojaner-Board
2014-04-01 12:05 - 2013-10-09 17:54 - 00000000 ____D () C:\FRST
2014-04-01 12:04 - 2014-04-01 12:04 - 00002308 _____ () C:\Users\tobi\Desktop\JRT.txt
2014-04-01 12:04 - 2011-07-07 12:15 - 00420430 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-01 12:02 - 2014-04-01 12:02 - 01038974 _____ (Thisisu) C:\Users\tobi\Desktop\JRT.exe
2014-04-01 12:02 - 2014-04-01 12:02 - 00000000 ____D () C:\Windows\ERUNT
2014-04-01 12:00 - 2012-11-03 15:02 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-01 11:59 - 2013-09-09 18:40 - 00121626 _____ () C:\Windows\PFRO.log
2014-04-01 11:59 - 2013-09-01 20:09 - 00079489 _____ () C:\Windows\setupact.log
2014-04-01 11:59 - 2013-05-19 18:05 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2014-04-01 11:59 - 2012-08-02 01:09 - 01290052 _____ () C:\Windows\WindowsUpdate.log
2014-04-01 11:59 - 2012-06-08 11:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-04-01 11:59 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-01 11:59 - 2009-07-14 06:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-01 11:59 - 2009-07-14 06:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-01 11:57 - 2013-12-30 18:51 - 00000000 ____D () C:\AdwCleaner
2014-04-01 11:56 - 2013-04-02 02:51 - 00000924 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1740813220-741005101-994693073-1006UA.job
2014-04-01 11:54 - 2014-04-01 11:54 - 01953280 _____ () C:\Users\tobi\Desktop\adwcleaner0.exe
2014-04-01 11:53 - 2014-03-30 02:59 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-01 11:53 - 2012-11-03 15:02 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-01 11:49 - 2014-04-01 11:49 - 00001155 _____ () C:\Users\tobi\Desktop\mbam.txt
2014-04-01 11:49 - 2014-01-27 09:41 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\52e60e48e56da19d58034c98
2014-04-01 11:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Vss
2014-04-01 11:34 - 2014-04-01 11:34 - 00000613 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-01 11:32 - 2014-04-01 11:31 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\tobi\Desktop\mbam-setup-2.0.0.1000.exe
2014-04-01 00:25 - 2012-08-02 03:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-31 22:25 - 2011-07-09 17:57 - 00000000 ____D () C:\Windows\Minidump
2014-03-31 22:24 - 2014-03-31 22:24 - 00346915 ____N () C:\Windows\Minidump\033114-16426-01.dmp
2014-03-31 12:49 - 2014-03-31 12:49 - 00032703 _____ () C:\Users\tobi\Desktop\ComboFix.txt
2014-03-31 12:49 - 2014-03-31 12:49 - 00000000 ____D () C:\Users\Tobias
2014-03-31 12:49 - 2012-10-12 01:19 - 00000000 ____D () C:\Qoobox
2014-03-31 12:47 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-03-30 23:06 - 2012-07-02 18:45 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Skype
2014-03-30 23:04 - 2012-08-12 16:41 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\TS3Client
2014-03-30 19:09 - 2014-03-24 19:01 - 00000000 ____D () C:\Users\tobi\AppData\Local\Battle.net
2014-03-30 14:15 - 2014-03-30 14:14 - 05192353 ____R (Swearware) C:\Users\tobi\Desktop\ComboFix.exe
2014-03-30 12:37 - 2014-03-29 20:52 - 00003104 _____ () C:\Users\tobi\Desktop\Websites.txt
2014-03-30 03:16 - 2012-09-06 21:12 - 00000000 ____D () C:\Users\tobi\AppData\Local\CrashDumps
2014-03-30 02:57 - 2012-10-07 00:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-30 02:56 - 2013-04-02 02:51 - 00000902 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1740813220-741005101-994693073-1006Core.job
2014-03-28 23:17 - 2014-03-28 23:17 - 00208781 _____ () C:\Users\tobi\Downloads\UCgKJyJq9RKrNvMp1pgHo1Cw.htm
2014-03-26 16:39 - 2014-03-26 16:39 - 00427991 ____N () C:\Windows\Minidump\032614-18766-01.dmp
2014-03-24 19:43 - 2014-03-24 19:43 - 00000000 ____D () C:\Users\tobi\Documents\Diablo III
2014-03-24 19:15 - 2014-03-24 19:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Battle.net
2014-03-24 19:04 - 2014-03-24 19:04 - 00000669 _____ () C:\Users\Public\Desktop\Diablo III.lnk
2014-03-24 19:04 - 2011-07-22 19:14 - 00000000 ____D () C:\Program Files\Common Files\Blizzard Entertainment
2014-03-24 19:01 - 2014-03-24 19:01 - 00000657 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-03-24 19:01 - 2014-03-24 19:01 - 00000000 ____D () C:\Users\tobi\AppData\Local\Blizzard Entertainment
2014-03-24 19:01 - 2014-03-24 19:00 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-03-24 18:59 - 2014-03-24 18:58 - 00000000 ____D () C:\ProgramData\Battle.net
2014-03-24 18:58 - 2014-03-24 18:58 - 06018744 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-Setup-deDE.exe
2014-03-24 18:55 - 2014-03-24 18:55 - 07341464 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-8370-deDE-Installer-downloader.exe
2014-03-24 18:50 - 2014-03-24 18:50 - 00000048 _____ () C:\Users\tobi\Downloads\Diablo Key.txt
2014-03-24 17:31 - 2014-03-23 00:09 - 00000000 ____D () C:\Users\tobi\.gimp-2.8
2014-03-24 17:29 - 2014-03-24 17:29 - 00007306 _____ () C:\Users\tobi\AppData\Local\recently-used.xbel
2014-03-24 17:27 - 2014-03-23 00:14 - 00000000 ____D () C:\Users\tobi\AppData\Local\gtk-2.0
2014-03-24 17:26 - 2014-03-24 17:26 - 00000000 ____D () C:\Users\tobi\AppData\Local\webkit
2014-03-24 14:58 - 2013-10-02 17:12 - 00000000 ____D () C:\Nexon
2014-03-23 23:59 - 2012-07-02 18:26 - 00000000 ____D () C:\Users\tobi
2014-03-23 23:58 - 2014-03-23 23:54 - 00002208 _____ () C:\Windows\system32\ASOROSet.bin
2014-03-23 23:58 - 2009-07-14 04:03 - 43515904 _____ () C:\Windows\system32\config\software.bak
2014-03-23 23:58 - 2009-07-14 04:03 - 17563648 _____ () C:\Windows\system32\config\system.bak
2014-03-23 23:58 - 2009-07-14 04:03 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-03-23 23:55 - 2009-07-14 04:03 - 00061440 _____ () C:\Windows\system32\config\sam.bak
2014-03-23 23:54 - 2014-03-23 23:54 - 00000000 ____D () C:\Windows\system32\config\RCCBakup
2014-03-23 19:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-03-23 19:36 - 2013-12-29 22:24 - 00000000 ____D () C:\Users\tobi\.android
2014-03-23 19:31 - 2014-02-12 20:47 - 00000000 ____D () C:\Users\tobi\AppData\Local\Unity
2014-03-23 19:05 - 2014-03-23 00:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Security System 2
2014-03-23 18:07 - 2013-07-05 23:55 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2014-03-23 17:05 - 2014-03-23 17:05 - 00000000 ____D () C:\ProgramData\CDB
2014-03-23 17:05 - 2014-03-23 17:04 - 00000155 _____ () C:\Windows\Reimage.ini
2014-03-23 17:03 - 2014-03-23 17:03 - 00784984 _____ (Reimage®) C:\Users\tobi\Downloads\ReimageRepair.exe
2014-03-23 15:05 - 2009-07-14 04:04 - 00000489 _____ () C:\Windows\win.ini
2014-03-23 02:40 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-03-23 02:38 - 2014-03-23 02:38 - 00141271 ____N () C:\Windows\Minidump\032314-49873-01.dmp
2014-03-23 00:11 - 2014-03-23 00:11 - 00000000 ____D () C:\Users\tobi\.thumbnails
2014-03-23 00:09 - 2014-03-23 00:09 - 00000000 ____D () C:\Users\tobi\AppData\Local\gegl-0.2
2014-03-23 00:08 - 2014-03-23 00:08 - 00001045 _____ () C:\Users\tobi\Desktop\GIMP 2.lnk
2014-03-23 00:05 - 2014-03-23 00:04 - 90332288 _____ (The GIMP Team ) C:\Users\tobi\Downloads\gimp-2.8.8-setup.exe
2014-03-23 00:03 - 2014-03-23 00:01 - 00000000 ____D () C:\Program Files\GIMP 2
2014-03-23 00:01 - 2014-03-23 00:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\BupSystem
2014-03-22 23:57 - 2014-03-22 23:57 - 00653512 _____ () C:\Users\tobi\Downloads\GIMP_Setup_Download.exe
2014-03-21 23:17 - 2014-01-26 04:36 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\.minecraft
2014-03-20 16:13 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-03-20 01:42 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-03-19 21:56 - 2011-07-10 13:02 - 00000000 ____D () C:\Program Files\Common Files\Steam
2014-03-18 23:20 - 2009-07-14 10:49 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-03-18 23:16 - 2014-03-18 23:12 - 00009985 _____ () C:\Windows\IE11_main.log
2014-03-18 23:14 - 2014-03-18 23:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-03-18 23:14 - 2014-03-18 23:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-03-18 23:14 - 2014-03-18 23:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-03-18 23:14 - 2014-03-18 23:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-03-18 23:12 - 2014-03-18 23:12 - 00000020 ___SH () C:\Users\UpdatusUser\ntuser.ini
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Startmenü
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Netzwerkumgebung
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Druckumgebung
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Musik
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Bilder
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Local\Verlauf
2014-03-18 23:12 - 2011-07-07 15:59 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-03-18 23:11 - 2011-07-07 15:59 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-03-18 23:07 - 2013-08-17 13:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-18 23:05 - 2011-07-07 15:32 - 87350280 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-16 23:55 - 2014-03-16 23:55 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos Entertainment
2014-03-16 23:52 - 2014-03-16 23:52 - 00291128 _____ () C:\Windows\system32\PnkBstrB.xtr
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\Documents\Arktos
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\PunkBuster
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos
2014-03-16 23:52 - 2014-03-16 23:42 - 00291128 _____ () C:\Windows\system32\PnkBstrB.exe
2014-03-16 23:52 - 2014-03-16 23:42 - 00139528 _____ () C:\Windows\system32\Drivers\PnkBstrK.sys
2014-03-16 23:42 - 2014-03-16 23:42 - 00281872 _____ () C:\Windows\system32\PnkBstrB.ex0
2014-03-16 23:42 - 2014-03-16 23:42 - 00138904 _____ () C:\Users\tobi\AppData\Roaming\PnkBstrK.sys
2014-03-16 23:42 - 2014-03-16 23:42 - 00076888 _____ () C:\Windows\system32\PnkBstrA.exe
2014-03-16 23:34 - 2012-06-10 16:20 - 00000000 ____D () C:\Windows\system32\directx
2014-03-13 20:40 - 2012-08-12 16:40 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-03-12 16:40 - 2013-09-01 20:09 - 00415944 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-12 16:38 - 2012-12-08 19:30 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-12 00:25 - 2014-03-12 00:25 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe
2014-03-12 00:25 - 2012-08-02 03:33 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-03-12 00:25 - 2011-07-07 21:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-03-07 15:33 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-05 09:26 - 2014-03-30 02:58 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-05 09:26 - 2014-03-30 02:58 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-03-05 09:26 - 2014-03-30 02:58 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-03 02:09 - 2014-03-03 02:09 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\steamvr
2014-03-02 23:40 - 2014-03-02 23:40 - 00000213 _____ () C:\Users\tobi\Desktop\Team Fortress 2.url
2014-03-02 20:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-02 19:52 - 2014-03-02 19:52 - 00002687 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-03-02 19:52 - 2014-03-02 19:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\Skype
2014-03-02 19:52 - 2014-03-02 19:52 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-03-02 19:52 - 2012-12-02 02:57 - 00000000 ___RD () C:\Program Files\Skype
2014-03-02 19:52 - 2011-08-01 12:14 - 00000000 ____D () C:\ProgramData\Skype

Some content of TEMP:
====================
C:\Users\tobi\AppData\Local\temp\avgnt.exe
C:\Users\tobi\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-31 21:16

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

schrauber · 02.04.2014, 08:50

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Solitron · 02.04.2014, 20:55

Bei der ersten Ausführung von ESET ist der Computer leider abgestürzt. Nichts weiter ist passiert. Die zweite Ausführung verlief fehlerfrei. Hier die gewünschten logs!

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=c685ceeb50d99545bbe946cd0c78abbd
# engine=17724
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-02 07:01:22
# local_time=2014-04-02 09:01:22 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 97 21031 261888572 13801 0
# compatibility_mode=5893 16776574 100 94 3471468 148096473 0 0
# scanned=175276
# found=1
# cleaned=0
# scan_time=19107
sh=07B43A941EEBF77CE10676BA10605EC22CE8678B ft=0 fh=0000000000000000 vn="möglicherweise unbekannter Virus NewHeur_PE Virus" ac=I fn="D:\TOBIAS-PC\Backup Set 2013-04-14 230133\Backup Files 2013-04-14 230133\Backup files 29.zip"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.80  
 Windows 7 Service Pack 1 x86   
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop                   
Microsoft Security Essentials   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 CCleaner     
 Java 7 Update 51  
 Adobe Flash Player 	12.0.0.77  A
 Adobe Reader 10.1.0 Adobe Reader out of Date!  
 Google Chrome 33.0.1750.146  
 Google Chrome 33.0.1750.154  
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe 
 Microsoft Security Essentials msseces.exe 
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014  01
Ran by tobi (administrator) on TOBIAS-PC on 02-04-2014 21:34:41
Running from C:\Users\tobi\Desktop\Trojaner-Board
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\system32\PnkBstrA.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Wondershare) C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
() C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.205\deploy\LoLLauncher.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.78\deploy\LolClient.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-18] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [WSHelperSetup.exe] - C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)
HKLM\...\Run: [Wondershare Helper Compact.exe] - C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKU\S-1-5-21-1740813220-741005101-994693073-1006\...\Run: [WSHelperSetup.exe] - C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1985824 2013-07-25] (Wondershare)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - Backup.Old.DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847}
SearchScopes: HKCU - Backup.Old.DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search
SearchScopes: HKCU - {7430958C-CCEE-7183-F800-3D9AD98A6113} URL = 
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [231424] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR Extension: (addplushd) - C:\Users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaipilfmheplbcghignccoiiebekkdhe [2014-03-31]
CHR Extension: (Google Wallet) - C:\Users\tobi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-18]
CHR HKLM\...\Chrome\Extension: [dapejillpcnbpfidhfkpidklcombbmel] - C:\Users\tobi\AppData\Local\CRE\dapejillpcnbpfidhfkpidklcombbmel.crx [2014-01-18]
CHR HKLM\...\Chrome\Extension: [ommhmgednjnodcljhlljkaiidghdmikk] - C:\Users\tobi\AppData\Local\CRE\ommhmgednjnodcljhlljkaiidghdmikk.crx [2014-01-18]
CHR HKCU\...\Chrome\Extension: [dapejillpcnbpfidhfkpidklcombbmel] - C:\Users\tobi\AppData\Local\CRE\dapejillpcnbpfidhfkpidklcombbmel.crx [2014-01-18]
CHR HKCU\...\Chrome\Extension: [ommhmgednjnodcljhlljkaiidghdmikk] - C:\Users\tobi\AppData\Local\CRE\ommhmgednjnodcljhlljkaiidghdmikk.crx [2014-01-18]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
S4 MBAMScheduler; D:\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-03-05] (Malwarebytes Corporation)
S2 MBAMService; D:\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-03-05] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
S3 npggsvc; C:\Windows\system32\GameMon.des [5124464 2012-12-16] (INCA Internet Co., Ltd.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2014-03-16] ()
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

==================== Drivers (Whitelisted) ====================

S3 apf003; C:\Windows\system32\apf003.sys [13232 2013-05-29] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [25280 2013-11-03] (LogMeIn, Inc.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [35560 2012-08-01] (AnchorFree Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-03-05] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-08-01] (AnchorFree Inc)
S3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1143920 2010-08-04] (VIA Technologies, Inc.)
S3 catchme; \??\C:\Users\tobi\AppData\Local\Temp\catchme.sys [X]
S3 cpuz134; \??\C:\Users\tobi\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 vtany; \??\C:\Windows\vtany.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files\IObit\Game Booster\Driver\WinRing0.sys [X]
S3 XDva391; \??\C:\Windows\system32\XDva391.sys [X]
S3 XDva392; \??\C:\Windows\system32\XDva392.sys [X]
S3 XDva393; \??\C:\Windows\system32\XDva393.sys [X]
S3 XDva394; \??\C:\Windows\system32\XDva394.sys [X]
S3 XDva396; \??\C:\Windows\system32\XDva396.sys [X]
S3 XDva397; \??\C:\Windows\system32\XDva397.sys [X]
S3 XDva401; \??\C:\Windows\system32\XDva401.sys [X]
S3 XDva405; \??\C:\Windows\system32\XDva405.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-02 21:34 - 2014-04-02 21:34 - 00000993 _____ () C:\Users\tobi\Desktop\Neues Textdokument.txt
2014-04-02 21:31 - 2014-04-02 21:31 - 00987442 _____ () C:\Users\tobi\Desktop\SecurityCheck.exe
2014-04-02 15:08 - 2014-04-02 15:08 - 02347384 _____ (ESET) C:\Users\tobi\Downloads\esetsmartinstaller_enu.exe
2014-04-01 12:02 - 2014-04-01 12:02 - 00000000 ____D () C:\Windows\ERUNT
2014-03-31 22:24 - 2014-03-31 22:24 - 00346915 ____N () C:\Windows\Minidump\033114-16426-01.dmp
2014-03-31 12:49 - 2014-03-31 12:49 - 00032703 _____ () C:\Users\tobi\Desktop\ComboFix.txt
2014-03-31 12:49 - 2014-03-31 12:49 - 00000000 ____D () C:\Users\Tobias
2014-03-30 14:14 - 2014-03-30 14:15 - 05192353 ____R (Swearware) C:\Users\tobi\Desktop\ComboFix.exe
2014-03-30 02:59 - 2014-04-01 11:53 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-30 02:58 - 2014-03-05 09:26 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-30 02:58 - 2014-03-05 09:26 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-03-30 02:58 - 2014-03-05 09:26 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-29 20:52 - 2014-03-30 12:37 - 00003104 _____ () C:\Users\tobi\Desktop\Websites.txt
2014-03-29 17:01 - 2014-04-02 21:34 - 00000000 ____D () C:\Users\tobi\Desktop\Trojaner-Board
2014-03-28 23:17 - 2014-03-28 23:17 - 00208781 _____ () C:\Users\tobi\Downloads\UCgKJyJq9RKrNvMp1pgHo1Cw.htm
2014-03-26 16:39 - 2014-03-26 16:39 - 00427991 ____N () C:\Windows\Minidump\032614-18766-01.dmp
2014-03-24 19:43 - 2014-03-24 19:43 - 00000000 ____D () C:\Users\tobi\Documents\Diablo III
2014-03-24 19:04 - 2014-03-24 19:04 - 00000669 _____ () C:\Users\Public\Desktop\Diablo III.lnk
2014-03-24 19:01 - 2014-03-30 19:09 - 00000000 ____D () C:\Users\tobi\AppData\Local\Battle.net
2014-03-24 19:01 - 2014-03-24 19:15 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Battle.net
2014-03-24 19:01 - 2014-03-24 19:01 - 00000657 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-03-24 19:01 - 2014-03-24 19:01 - 00000000 ____D () C:\Users\tobi\AppData\Local\Blizzard Entertainment
2014-03-24 19:00 - 2014-03-24 19:01 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-03-24 18:58 - 2014-03-24 18:59 - 00000000 ____D () C:\ProgramData\Battle.net
2014-03-24 18:58 - 2014-03-24 18:58 - 06018744 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-Setup-deDE.exe
2014-03-24 18:55 - 2014-03-24 18:55 - 07341464 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-8370-deDE-Installer-downloader.exe
2014-03-24 18:50 - 2014-03-24 18:50 - 00000048 _____ () C:\Users\tobi\Downloads\Diablo Key.txt
2014-03-24 17:29 - 2014-03-24 17:29 - 00007306 _____ () C:\Users\tobi\AppData\Local\recently-used.xbel
2014-03-24 17:26 - 2014-03-24 17:26 - 00000000 ____D () C:\Users\tobi\AppData\Local\webkit
2014-03-23 23:54 - 2014-03-23 23:58 - 00002208 _____ () C:\Windows\system32\ASOROSet.bin
2014-03-23 23:54 - 2014-03-23 23:54 - 00000000 ____D () C:\Windows\system32\config\RCCBakup
2014-03-23 17:05 - 2014-03-23 17:05 - 00000000 ____D () C:\ProgramData\CDB
2014-03-23 17:04 - 2014-03-23 17:05 - 00000155 _____ () C:\Windows\Reimage.ini
2014-03-23 17:03 - 2014-03-23 17:03 - 00784984 _____ (Reimage®) C:\Users\tobi\Downloads\ReimageRepair.exe
2014-03-23 02:38 - 2014-03-23 02:38 - 00141271 ____N () C:\Windows\Minidump\032314-49873-01.dmp
2014-03-23 00:14 - 2014-03-24 17:27 - 00000000 ____D () C:\Users\tobi\AppData\Local\gtk-2.0
2014-03-23 00:11 - 2014-03-23 00:11 - 00000000 ____D () C:\Users\tobi\.thumbnails
2014-03-23 00:09 - 2014-03-24 17:31 - 00000000 ____D () C:\Users\tobi\.gimp-2.8
2014-03-23 00:09 - 2014-03-23 00:09 - 00000000 ____D () C:\Users\tobi\AppData\Local\gegl-0.2
2014-03-23 00:08 - 2014-03-23 00:08 - 00001045 _____ () C:\Users\tobi\Desktop\GIMP 2.lnk
2014-03-23 00:04 - 2014-03-23 00:05 - 90332288 _____ (The GIMP Team ) C:\Users\tobi\Downloads\gimp-2.8.8-setup.exe
2014-03-23 00:01 - 2014-03-23 19:05 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Security System 2
2014-03-23 00:01 - 2014-03-23 00:03 - 00000000 ____D () C:\Program Files\GIMP 2
2014-03-23 00:01 - 2014-03-23 00:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\BupSystem
2014-03-22 23:57 - 2014-03-22 23:57 - 00653512 _____ () C:\Users\tobi\Downloads\GIMP_Setup_Download.exe
2014-03-19 15:33 - 2013-12-21 10:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-03-19 15:32 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-19 15:32 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-19 15:32 - 2014-03-01 06:10 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-19 15:32 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-19 15:32 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-19 15:32 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-19 15:32 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-19 15:32 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-19 15:32 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-19 15:32 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-19 15:32 - 2014-03-01 05:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-19 15:32 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-19 15:32 - 2014-03-01 05:31 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-19 15:32 - 2014-03-01 05:25 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-19 15:32 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-19 15:32 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-19 15:32 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-19 15:32 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-19 15:32 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-19 15:32 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-19 15:32 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-19 15:32 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-19 15:32 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-03-18 23:14 - 2014-03-18 23:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-03-18 23:14 - 2014-03-18 23:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-03-18 23:14 - 2014-03-18 23:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-03-18 23:12 - 2014-03-18 23:16 - 00009985 _____ () C:\Windows\IE11_main.log
2014-03-18 23:12 - 2014-03-18 23:12 - 00000020 ___SH () C:\Users\UpdatusUser\ntuser.ini
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Startmenü
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Netzwerkumgebung
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Druckumgebung
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Musik
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Bilder
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Local\Verlauf
2014-03-18 23:12 - 2012-04-12 01:39 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Microsoft Help
2014-03-18 23:12 - 2009-07-14 06:42 - 00000000 ___RD () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-03-18 23:12 - 2009-07-14 06:37 - 00000000 ___RD () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-03-18 23:08 - 2013-10-02 02:42 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-03-18 23:08 - 2013-10-02 02:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-03-18 23:08 - 2013-10-02 02:30 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-03-18 23:08 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-03-18 23:08 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-03-18 23:08 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-03-18 23:08 - 2013-10-02 01:45 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-03-18 23:08 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-03-18 23:08 - 2013-10-02 01:00 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-03-18 23:08 - 2013-10-02 00:53 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-03-18 23:08 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-03-16 23:55 - 2014-03-16 23:55 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos Entertainment
2014-03-16 23:52 - 2014-03-16 23:52 - 00291128 _____ () C:\Windows\system32\PnkBstrB.xtr
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\Documents\Arktos
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\PunkBuster
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos
2014-03-16 23:42 - 2014-03-16 23:52 - 00291128 _____ () C:\Windows\system32\PnkBstrB.exe
2014-03-16 23:42 - 2014-03-16 23:52 - 00139528 _____ () C:\Windows\system32\Drivers\PnkBstrK.sys
2014-03-16 23:42 - 2014-03-16 23:42 - 00281872 _____ () C:\Windows\system32\PnkBstrB.ex0
2014-03-16 23:42 - 2014-03-16 23:42 - 00138904 _____ () C:\Users\tobi\AppData\Roaming\PnkBstrK.sys
2014-03-16 23:42 - 2014-03-16 23:42 - 00076888 _____ () C:\Windows\system32\PnkBstrA.exe
2014-03-12 00:25 - 2014-03-12 00:25 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe
2014-03-11 22:30 - 2014-02-07 03:07 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-11 22:30 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-11 22:30 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-11 22:30 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-11 22:30 - 2014-01-28 04:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-03 02:09 - 2014-03-03 02:09 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\steamvr

==================== One Month Modified Files and Folders =======

2014-04-02 21:34 - 2014-04-02 21:34 - 00000993 _____ () C:\Users\tobi\Desktop\Neues Textdokument.txt
2014-04-02 21:34 - 2014-03-29 17:01 - 00000000 ____D () C:\Users\tobi\Desktop\Trojaner-Board
2014-04-02 21:34 - 2013-10-09 17:54 - 00000000 ____D () C:\FRST
2014-04-02 21:31 - 2014-04-02 21:31 - 00987442 _____ () C:\Users\tobi\Desktop\SecurityCheck.exe
2014-04-02 21:25 - 2012-08-02 03:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-02 21:03 - 2012-08-02 01:09 - 01383403 _____ () C:\Windows\WindowsUpdate.log
2014-04-02 20:56 - 2013-04-02 02:51 - 00000924 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1740813220-741005101-994693073-1006UA.job
2014-04-02 20:52 - 2012-11-03 15:02 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-02 18:27 - 2011-07-07 12:15 - 00420430 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-02 18:25 - 2013-09-01 20:09 - 00082233 _____ () C:\Windows\setupact.log
2014-04-02 18:25 - 2013-05-19 18:05 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2014-04-02 17:49 - 2012-07-02 18:45 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Skype
2014-04-02 15:35 - 2009-07-14 06:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-02 15:35 - 2009-07-14 06:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-02 15:28 - 2012-11-03 15:02 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-02 15:27 - 2012-06-08 11:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-04-02 15:27 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-02 15:08 - 2014-04-02 15:08 - 02347384 _____ (ESET) C:\Users\tobi\Downloads\esetsmartinstaller_enu.exe
2014-04-01 19:51 - 2012-08-12 16:41 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\TS3Client
2014-04-01 19:50 - 2012-09-06 21:12 - 00000000 ____D () C:\Users\tobi\AppData\Local\CrashDumps
2014-04-01 12:02 - 2014-04-01 12:02 - 00000000 ____D () C:\Windows\ERUNT
2014-04-01 11:59 - 2013-09-09 18:40 - 00121626 _____ () C:\Windows\PFRO.log
2014-04-01 11:57 - 2013-12-30 18:51 - 00000000 ____D () C:\AdwCleaner
2014-04-01 11:53 - 2014-03-30 02:59 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-01 11:51 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Vss
2014-04-01 11:49 - 2014-01-27 09:41 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\52e60e48e56da19d58034c98
2014-03-31 22:25 - 2011-07-09 17:57 - 00000000 ____D () C:\Windows\Minidump
2014-03-31 22:24 - 2014-03-31 22:24 - 00346915 ____N () C:\Windows\Minidump\033114-16426-01.dmp
2014-03-31 12:49 - 2014-03-31 12:49 - 00032703 _____ () C:\Users\tobi\Desktop\ComboFix.txt
2014-03-31 12:49 - 2014-03-31 12:49 - 00000000 ____D () C:\Users\Tobias
2014-03-31 12:49 - 2012-10-12 01:19 - 00000000 ____D () C:\Qoobox
2014-03-31 12:47 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-03-30 19:09 - 2014-03-24 19:01 - 00000000 ____D () C:\Users\tobi\AppData\Local\Battle.net
2014-03-30 14:15 - 2014-03-30 14:14 - 05192353 ____R (Swearware) C:\Users\tobi\Desktop\ComboFix.exe
2014-03-30 12:37 - 2014-03-29 20:52 - 00003104 _____ () C:\Users\tobi\Desktop\Websites.txt
2014-03-30 02:57 - 2012-10-07 00:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-30 02:56 - 2013-04-02 02:51 - 00000902 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1740813220-741005101-994693073-1006Core.job
2014-03-28 23:17 - 2014-03-28 23:17 - 00208781 _____ () C:\Users\tobi\Downloads\UCgKJyJq9RKrNvMp1pgHo1Cw.htm
2014-03-26 16:39 - 2014-03-26 16:39 - 00427991 ____N () C:\Windows\Minidump\032614-18766-01.dmp
2014-03-24 19:43 - 2014-03-24 19:43 - 00000000 ____D () C:\Users\tobi\Documents\Diablo III
2014-03-24 19:15 - 2014-03-24 19:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Battle.net
2014-03-24 19:04 - 2014-03-24 19:04 - 00000669 _____ () C:\Users\Public\Desktop\Diablo III.lnk
2014-03-24 19:04 - 2011-07-22 19:14 - 00000000 ____D () C:\Program Files\Common Files\Blizzard Entertainment
2014-03-24 19:01 - 2014-03-24 19:01 - 00000657 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-03-24 19:01 - 2014-03-24 19:01 - 00000000 ____D () C:\Users\tobi\AppData\Local\Blizzard Entertainment
2014-03-24 19:01 - 2014-03-24 19:00 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-03-24 18:59 - 2014-03-24 18:58 - 00000000 ____D () C:\ProgramData\Battle.net
2014-03-24 18:58 - 2014-03-24 18:58 - 06018744 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-Setup-deDE.exe
2014-03-24 18:55 - 2014-03-24 18:55 - 07341464 _____ (Blizzard Entertainment) C:\Users\tobi\Downloads\Diablo-III-8370-deDE-Installer-downloader.exe
2014-03-24 18:50 - 2014-03-24 18:50 - 00000048 _____ () C:\Users\tobi\Downloads\Diablo Key.txt
2014-03-24 17:31 - 2014-03-23 00:09 - 00000000 ____D () C:\Users\tobi\.gimp-2.8
2014-03-24 17:29 - 2014-03-24 17:29 - 00007306 _____ () C:\Users\tobi\AppData\Local\recently-used.xbel
2014-03-24 17:27 - 2014-03-23 00:14 - 00000000 ____D () C:\Users\tobi\AppData\Local\gtk-2.0
2014-03-24 17:26 - 2014-03-24 17:26 - 00000000 ____D () C:\Users\tobi\AppData\Local\webkit
2014-03-24 14:58 - 2013-10-02 17:12 - 00000000 ____D () C:\Nexon
2014-03-23 23:59 - 2012-07-02 18:26 - 00000000 ____D () C:\Users\tobi
2014-03-23 23:58 - 2014-03-23 23:54 - 00002208 _____ () C:\Windows\system32\ASOROSet.bin
2014-03-23 23:58 - 2009-07-14 04:03 - 43515904 _____ () C:\Windows\system32\config\software.bak
2014-03-23 23:58 - 2009-07-14 04:03 - 17563648 _____ () C:\Windows\system32\config\system.bak
2014-03-23 23:58 - 2009-07-14 04:03 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-03-23 23:55 - 2009-07-14 04:03 - 00061440 _____ () C:\Windows\system32\config\sam.bak
2014-03-23 23:54 - 2014-03-23 23:54 - 00000000 ____D () C:\Windows\system32\config\RCCBakup
2014-03-23 19:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-03-23 19:36 - 2013-12-29 22:24 - 00000000 ____D () C:\Users\tobi\.android
2014-03-23 19:31 - 2014-02-12 20:47 - 00000000 ____D () C:\Users\tobi\AppData\Local\Unity
2014-03-23 19:05 - 2014-03-23 00:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\Security System 2
2014-03-23 18:07 - 2013-07-05 23:55 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2014-03-23 17:05 - 2014-03-23 17:05 - 00000000 ____D () C:\ProgramData\CDB
2014-03-23 17:05 - 2014-03-23 17:04 - 00000155 _____ () C:\Windows\Reimage.ini
2014-03-23 17:03 - 2014-03-23 17:03 - 00784984 _____ (Reimage®) C:\Users\tobi\Downloads\ReimageRepair.exe
2014-03-23 15:05 - 2009-07-14 04:04 - 00000489 _____ () C:\Windows\win.ini
2014-03-23 02:40 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-03-23 02:38 - 2014-03-23 02:38 - 00141271 ____N () C:\Windows\Minidump\032314-49873-01.dmp
2014-03-23 00:11 - 2014-03-23 00:11 - 00000000 ____D () C:\Users\tobi\.thumbnails
2014-03-23 00:09 - 2014-03-23 00:09 - 00000000 ____D () C:\Users\tobi\AppData\Local\gegl-0.2
2014-03-23 00:08 - 2014-03-23 00:08 - 00001045 _____ () C:\Users\tobi\Desktop\GIMP 2.lnk
2014-03-23 00:05 - 2014-03-23 00:04 - 90332288 _____ (The GIMP Team ) C:\Users\tobi\Downloads\gimp-2.8.8-setup.exe
2014-03-23 00:03 - 2014-03-23 00:01 - 00000000 ____D () C:\Program Files\GIMP 2
2014-03-23 00:01 - 2014-03-23 00:01 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\BupSystem
2014-03-22 23:57 - 2014-03-22 23:57 - 00653512 _____ () C:\Users\tobi\Downloads\GIMP_Setup_Download.exe
2014-03-21 23:17 - 2014-01-26 04:36 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\.minecraft
2014-03-20 16:13 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-03-20 01:42 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-03-19 21:56 - 2011-07-10 13:02 - 00000000 ____D () C:\Program Files\Common Files\Steam
2014-03-18 23:20 - 2009-07-14 10:49 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-03-18 23:16 - 2014-03-18 23:12 - 00009985 _____ () C:\Windows\IE11_main.log
2014-03-18 23:14 - 2014-03-18 23:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-03-18 23:14 - 2014-03-18 23:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-03-18 23:14 - 2014-03-18 23:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-03-18 23:14 - 2014-03-18 23:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-03-18 23:14 - 2014-03-18 23:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-03-18 23:14 - 2014-03-18 23:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-03-18 23:12 - 2014-03-18 23:12 - 00000020 ___SH () C:\Users\UpdatusUser\ntuser.ini
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Startmenü
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Netzwerkumgebung
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Druckumgebung
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Musik
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\Documents\Eigene Bilder
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-03-18 23:12 - 2014-03-18 23:12 - 00000000 _SHDL () C:\Users\UpdatusUser\AppData\Local\Verlauf
2014-03-18 23:12 - 2011-07-07 15:59 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-03-18 23:11 - 2011-07-07 15:59 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-03-18 23:07 - 2013-08-17 13:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-18 23:05 - 2011-07-07 15:32 - 87350280 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-16 23:55 - 2014-03-16 23:55 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos Entertainment
2014-03-16 23:52 - 2014-03-16 23:52 - 00291128 _____ () C:\Windows\system32\PnkBstrB.xtr
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\Documents\Arktos
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\PunkBuster
2014-03-16 23:52 - 2014-03-16 23:52 - 00000000 ____D () C:\Users\tobi\AppData\Local\Arktos
2014-03-16 23:52 - 2014-03-16 23:42 - 00291128 _____ () C:\Windows\system32\PnkBstrB.exe
2014-03-16 23:52 - 2014-03-16 23:42 - 00139528 _____ () C:\Windows\system32\Drivers\PnkBstrK.sys
2014-03-16 23:42 - 2014-03-16 23:42 - 00281872 _____ () C:\Windows\system32\PnkBstrB.ex0
2014-03-16 23:42 - 2014-03-16 23:42 - 00138904 _____ () C:\Users\tobi\AppData\Roaming\PnkBstrK.sys
2014-03-16 23:42 - 2014-03-16 23:42 - 00076888 _____ () C:\Windows\system32\PnkBstrA.exe
2014-03-16 23:34 - 2012-06-10 16:20 - 00000000 ____D () C:\Windows\system32\directx
2014-03-13 20:40 - 2012-08-12 16:40 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-03-12 16:40 - 2013-09-01 20:09 - 00415944 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-12 16:38 - 2012-12-08 19:30 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-12 00:25 - 2014-03-12 00:25 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe
2014-03-12 00:25 - 2012-08-02 03:33 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-03-12 00:25 - 2011-07-07 21:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-03-07 15:33 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-05 09:26 - 2014-03-30 02:58 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-05 09:26 - 2014-03-30 02:58 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-03-05 09:26 - 2014-03-30 02:58 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-03 02:09 - 2014-03-03 02:09 - 00000000 ____D () C:\Users\tobi\AppData\Roaming\steamvr

Some content of TEMP:
====================
C:\Users\tobi\AppData\Local\temp\avgnt.exe
C:\Users\tobi\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-31 21:16

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Soweit ich sehe, ist alles in Ordnung. Falls ich etwas sehe, kann ich dann hier wieder antworten oder muss ich mein Problem neu posten?

Vielen Dank schrauber! Sie haben gute Arbeit geleistet! :-DD Leider ist der PC noch immer recht langsam...

schrauber · 03.04.2014, 12:02

Adobe udpaten. Backup auf D löschen.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Zitat:

Leider ist der PC noch immer recht langsam...

wann genau?

Solitron · 03.04.2014, 14:40

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 13-03-2014  01
Ran by tobi at 2014-04-03 15:33:43 Run:1
Running from C:\Users\tobi\Desktop\Trojaner-Board
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
*****************

HKLM\SOFTWARE\Policies\Google => Key deleted successfully.

==== End of Fixlog ====

TFC ausgeführt. 220 MB entfernt.

Der Computer ist immer dann langsam, wenn ich ein Video lade (YouTube), manchmal wenn ich spiele (auch wenn im Spiel nichts Weltbewegendes passiert), wenn ich ein Programm öffne(vorzugsweise nach dem Hochfahren) etc.
Also eigentlich bei Allem. :/

schrauber · 04.04.2014, 10:52

How to perform a clean boot in Windows
Mach bitte mal nen Clean Boot und teste den Rechner dann nochmal.

Solitron · 04.04.2014, 15:13

Womit soll ich den Rechner denn testen, bzw. was ist genau gemeint?

31.03.2014, 10:34	#6
schrauber /// the machine /// TB-Ausbilder	Windows 7 Professional: Geschwindigkeitsverlust nach Absturz, außerdem Virenbefall laut YouTube-Werbung Führe es einfach aus __________________ --> Windows 7 Professional: Geschwindigkeitsverlust nach Absturz, außerdem Virenbefall laut YouTube-Werbung

Windows 7 Professional: Geschwindigkeitsverlust nach Absturz, außerdem Virenbefall laut YouTube-Werbung

Log-Analyse und Auswertung: Windows 7 Professional: Geschwindigkeitsverlust nach Absturz, außerdem Virenbefall laut YouTube-Werbung