| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Webseiten werden auf Werbung umgeleitetWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
21.04.2014, 14:51
| #1 |
 |  Webseiten werden auf Werbung umgeleitet Hallo, ich habe ein sehr nerviges Problem was mich langsam aber sicher zur Verzweifelung treibt. Ich surfe im Internet mit Chrome und seit ein paar Wochen tritt dort ein Werbeproblem auf was merkwürdigerweise nicht alle Webseiten betrifft, aber leider viele. Wenn ich eine neue Seite öffne wird diese ganz normal geladen, sobald ich jedoch einen Link auf der Seite anklicke öffnet sich statt des normalen Links ein neuer Tab mit nerviger Werbung ( die vorzugsweise in koreanisch ist... ) Wenn ich auf einer der betroffenen Webseiten einfach nur auf eine freie Fläche auf der Seite klicke öffnet sich ebenfalls ein neuer Tab mit Werbung. Ab und zu erscheint rechts unten auf der Seite ein weiser Balken wo nur der Balken und X zum schließen zu sehen ist. Nahezu alle diese Werbetabs haben übrigens extrem nervige Hintergrundmusik. Teilweise ist die Werbung nicht mal zu sehen und man hat nur den Sound. Stoppen kann man ihn nur wenn man die komplette Seite zumacht obwohl dort nichtmal Werbung zu sehen ist. Das passiert wie gesagt nicht bei allen Seiten ( Twitter ist zum Beispiel nicht betroffen ) aber leider doch bei vielen Seiten. Zum Beispiel auch bei diesem Board hier.  Ich hab mir die Anleitung durchgelesen und die Schritte alle ausgeführt. Hier sind die Scans. Ich hoffe wirklich das mir hier jemand helfen kann. Vielen Dank im Vorraus. Scan FRST Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2014 02
Ran by PC1 (administrator) on PC1-PC-NE on 21-04-2014 15:00:10
Running from C:\Users\PC1\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\PC1\AppData\Roaming\Spotify\spotify.exe
(Spotify Ltd) C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Gaming Mouse\Monitor.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()
HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\PC1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\MountPoints2: {b3c3e069-3042-11e3-b41d-806e6f6e6963} - D:\autorun.exe
Startup: C:\Users\PC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\PC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
==================== Internet (Whitelisted) ====================
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR StartupUrls: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (Chrome NaCl) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Google Gears 0.5.33.0) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\gears.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (ProxTube) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-02-25]
CHR Extension: (Adblock Plus) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-19]
CHR Extension: (Google Wallet) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-09]
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation )
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\PC1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (3).zip
2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 12:50 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-21 12:50 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-21 12:50 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\PC1\Downloads\Malkorok.zip
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-16 15:57 - 585078025 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-16 15:57 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\TS3Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999.zip
2014-04-09 19:03 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 19:03 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\PC1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\PC1\Downloads\adwcleaner.exe
2014-04-09 18:30 - 2014-04-21 15:00 - 00014824 _____ () C:\Users\PC1\Downloads\FRST.txt
2014-04-09 18:30 - 2014-04-21 15:00 - 00000000 ____D () C:\FRST
2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\PC1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\PC1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\PC1\Documents\Anti-Malware
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\PC1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\PC1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-04-20 21:41 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\PC1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995 (1).zip
2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995.zip
==================== One Month Modified Files and Folders =======
2014-04-21 15:00 - 2014-04-09 18:30 - 00014824 _____ () C:\Users\PC1\Downloads\FRST.txt
2014-04-21 15:00 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe
2014-04-21 14:42 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\Spotify
2014-04-21 14:20 - 2013-10-08 21:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-21 14:17 - 2013-10-08 19:57 - 01151524 _____ () C:\Windows\WindowsUpdate.log
2014-04-21 14:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\PC1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\PC1\Documents\Anti-Malware
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (3).zip
2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk
2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-21 12:50 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-21 12:49 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-21 12:49 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-21 12:42 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job
2014-04-21 12:41 - 2013-10-08 21:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-21 12:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-21 12:41 - 2009-07-14 06:51 - 00036998 _____ () C:\Windows\setupact.log
2014-04-20 23:18 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\PC1\AppData\Local\Battle.net
2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\PC1\Downloads\Malkorok.zip
2014-04-20 21:41 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\PC1\AppData\Local\Deployment
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-17 19:39 - 2010-11-21 05:47 - 00281792 _____ () C:\Windows\PFRO.log
2014-04-16 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 16:01 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\PC1\AppData\Local\Google
2014-04-16 15:59 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\PC1\AppData\Local\Spotify
2014-04-16 15:57 - 2014-04-16 15:57 - 585078025 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-16 15:57 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-21 12:50 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-21 12:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-21 12:50 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\TS3Client
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999.zip
2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\PC1\Downloads\SecurityCheck.exe
2014-04-09 18:47 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\PC1\Downloads\adwcleaner.exe
2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\PC1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\PC1\Downloads\FRST64.exe
2014-04-09 18:24 - 2013-10-08 21:41 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\PC1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-04-01 18:15 - 2013-10-08 21:40 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-01 18:15 - 2013-10-08 21:40 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-31 03:16 - 2014-04-09 19:03 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-09 19:03 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\PC1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\PC1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995 (1).zip
2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995.zip
Some content of TEMP:
====================
C:\Users\PC1\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-21 14:43
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-21 15:23:07
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 WDC_WD10EALX-009BA0 rev.15.01H15 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Username~1\AppData\Local\Temp\agecyuoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[1920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000765c1465 2 bytes [5C, 76]
.text C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[1920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000765c14bb 2 bytes [5C, 76]
.text ... * 2
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes [B5, 6F, 06]
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007fefd6b55c8 6 bytes {JMP QWORD [RIP+0xfaa68]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007fefd6cb85c 6 bytes {JMP QWORD [RIP+0xc47d4]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes CALL 9000027
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes CALL 9000027
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes [B5, 6F, 29]
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiSetInternalUI 000007fef6285cd0 6 bytes JMP 23f
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiInstallProductA 000007fef6300f20 6 bytes {JMP QWORD [RIP+0x2cf110]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiInstallProductW 000007fef630faa8 6 bytes JMP 0
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef7f67b34 6 bytes JMP 300030
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef7f703c0 6 bytes JMP 610048
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000007feff283030 6 bytes {JMP QWORD [RIP+0x2dd000]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!connect + 1 000007feff2845c1 5 bytes {JMP QWORD [RIP+0x28ba70]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!listen 000007feff288290 6 bytes {JMP QWORD [RIP+0x2b7da0]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\RASAPI32.dll!RasDialW + 1 000007fee8e296f5 5 bytes JMP 4d004d
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes [B5, 6F, 41]
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef7f67b34 6 bytes {JMP QWORD [RIP+0x884fc]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef7f703c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes JMP 7181000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes JMP 7181000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 717b000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 717b000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 717e000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 717e000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes JMP 7187000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes JMP 7187000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes JMP 7184000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes JMP 7184000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes JMP 7178000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes JMP 7178000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 7175000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 7175000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076ef9679 6 bytes JMP 7196000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!PostMessageW 0000000076f012a5 6 bytes JMP 7190000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076f03baa 6 bytes JMP 7193000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendMessageA 0000000076f0612e 6 bytes JMP 7199000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendInput 0000000076f1ff4a 3 bytes JMP 719c000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendInput + 4 0000000076f1ff4e 2 bytes JMP 719c000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!mouse_event 0000000076f5027b 6 bytes JMP 71a2000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!keybd_event 0000000076f502bf 6 bytes JMP 719f000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000076ae70c4 6 bytes JMP 718a000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000076b03264 6 bytes JMP 718d000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW 000000007685575a 6 bytes JMP 71a5000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!connect 0000000076856bdd 6 bytes JMP 71ab000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!listen 000000007685b001 6 bytes JMP 71a8000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes JMP 718a000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes JMP 718a000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 7184000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 7184000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 7187000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 7187000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes JMP 7190000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes JMP 7190000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes JMP 718d000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes JMP 718d000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes JMP 7181000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes JMP 7181000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 717e000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 717e000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076ef9679 6 bytes JMP 719f000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!PostMessageW 0000000076f012a5 6 bytes JMP 7199000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076f03baa 6 bytes JMP 719c000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendMessageA 0000000076f0612e 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendInput 0000000076f1ff4a 3 bytes JMP 71a5000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendInput + 4 0000000076f1ff4e 2 bytes JMP 71a5000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!mouse_event 0000000076f5027b 6 bytes JMP 71ab000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!keybd_event 0000000076f502bf 6 bytes JMP 71a8000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000076ae70c4 6 bytes JMP 7193000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000076b03264 6 bytes JMP 7196000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes JMP 718a000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes JMP 718a000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 7184000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 7184000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 7187000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 7187000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes JMP 7190000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes JMP 7190000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes JMP 718d000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes JMP 718d000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes JMP 7181000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes JMP 7181000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 717e000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 717e000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076ef9679 6 bytes JMP 719f000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!PostMessageW 0000000076f012a5 6 bytes JMP 7199000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076f03baa 6 bytes JMP 719c000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendMessageA 0000000076f0612e 6 bytes JMP 71a2000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendInput 0000000076f1ff4a 3 bytes JMP 71a5000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendInput + 4 0000000076f1ff4e 2 bytes JMP 71a5000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!mouse_event 0000000076f5027b 6 bytes JMP 71ab000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!keybd_event 0000000076f502bf 6 bytes JMP 71a8000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000076ae70c4 6 bytes JMP 7193000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000076b03264 6 bytes JMP 7196000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes [89, 71]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 7184000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 7184000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 7187000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 7187000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes [8F, 71]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes [8C, 71]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes [80, 71]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 717e000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 717e000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes JMP 7184000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes JMP 7184000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 717e000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 717e000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 7181000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 7181000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes JMP 718a000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes JMP 718a000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes JMP 7187000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes JMP 7187000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes JMP 717b000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes JMP 717b000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 7178000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 7178000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076ef9679 6 bytes JMP 7199000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!PostMessageW 0000000076f012a5 6 bytes JMP 7193000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076f03baa 6 bytes JMP 7196000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendMessageA 0000000076f0612e 6 bytes JMP 719c000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendInput 0000000076f1ff4a 3 bytes JMP 719f000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendInput + 4 0000000076f1ff4e 2 bytes JMP 719f000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!mouse_event 0000000076f5027b 6 bytes JMP 71a5000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!keybd_event 0000000076f502bf 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000076ae70c4 6 bytes JMP 718d000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000076b03264 6 bytes JMP 7190000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes JMP 7184000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes JMP 7184000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 717e000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 717e000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 7181000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 7181000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes JMP 718a000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes JMP 718a000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes JMP 7187000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes JMP 7187000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes JMP 717b000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes JMP 717b000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 7178000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 7178000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076ef9679 6 bytes JMP 7199000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!PostMessageW 0000000076f012a5 6 bytes JMP 7193000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076f03baa 6 bytes JMP 7196000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendMessageA 0000000076f0612e 6 bytes JMP 719c000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendInput 0000000076f1ff4a 3 bytes JMP 719f000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendInput + 4 0000000076f1ff4e 2 bytes JMP 719f000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!mouse_event 0000000076f5027b 6 bytes JMP 71a5000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!keybd_event 0000000076f502bf 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000076ae70c4 6 bytes JMP 718d000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000076b03264 6 bytes JMP 7190000a
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes [B5, 6F, 06]
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes [B5, 6F, 06]
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes CALL 9000027
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4648] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000765c1465 2 bytes [5C, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4648] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000765c14bb 2 bytes [5C, 76]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6076] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000765c1465 2 bytes [5C, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6076] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000765c14bb 2 bytes [5C, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [5572:7688] 000007feec939688
---- EOF - GMER 2.1 ----
|
|
21.04.2014, 19:10
| #2 |
| /// the machine /// TB-Ausbilder    |  Webseiten werden auf Werbung umgeleitet hi,
__________________Scan mit Combofix
__________________ |
|
21.04.2014, 21:04
| #3 |
| | Webseiten werden auf Werbung umgeleitet Hallo,
__________________danke für die schnelle Antwort!  Hier ist der gewünschte Scan. Combofix hat gemeckert das Spybot noch an wäre obwohl ich alles deaktiviert hatte. Das Ergebnis des Scans sah so aus:Code:
ATTFilter ComboFix 14-04-20.01 - Username 21.04.2014 21:52:01.1.6 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8174.6461 [GMT 2:00]
ausgeführt von:: c:\users\Username\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-03-21 bis 2014-04-21 ))))))))))))))))))))))))))))))
.
.
2014-04-21 19:56 . 2014-04-21 19:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-04-21 13:02 . 2014-04-21 13:23 -------- d-----w- C:\Scans
2014-04-21 11:27 . 2013-09-20 08:49 21040 ----a-w- c:\windows\system32\sdnclean64.exe
2014-04-21 11:27 . 2014-04-21 11:32 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-04-21 11:27 . 2014-04-21 11:33 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2014-04-21 10:50 . 2014-04-14 18:13 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-18 15:55 . 2014-04-17 03:31 10651704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D3B4B546-8EB5-45BF-B854-5815069D28B0}\mpengine.dll
2014-04-16 14:03 . 2014-04-16 14:06 -------- d-----w- c:\windows\system32\appmgmt
2014-04-12 15:16 . 2014-04-13 20:07 -------- d-----w- c:\users\Username\AppData\Roaming\TS3Client
2014-04-12 15:16 . 2014-04-12 15:16 -------- d-----w- c:\program files\TeamSpeak 3 Client
2014-04-09 17:03 . 2014-03-31 01:16 23134208 ----a-w- c:\windows\system32\mshtml.dll
2014-04-09 17:03 . 2014-03-31 01:13 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-04-09 17:03 . 2014-03-31 00:13 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-04-09 16:30 . 2014-04-21 13:00 -------- d-----w- C:\FRST
2014-04-02 22:03 . 2014-04-21 15:17 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2014-03-28 00:05 . 2014-03-28 00:05 -------- d-----w- c:\program files (x86)\MSXML 4.0
2014-03-27 12:13 . 2014-04-20 19:41 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-03-27 12:13 . 2014-03-27 12:13 -------- d-----w- c:\programdata\Malwarebytes
2014-03-27 12:08 . 2014-03-27 12:08 -------- d-----w- c:\users\Username\AppData\Local\Programs
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-03 15:55 . 2013-10-14 12:04 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-03 15:55 . 2013-10-14 12:04 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-31 07:35 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-03-04 09:17 . 2014-04-09 16:59 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-03-01 05:16 . 2014-03-13 17:51 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-03-01 04:58 . 2014-03-13 17:51 2765824 ----a-w- c:\windows\system32\iertutil.dll
2014-03-01 04:52 . 2014-03-13 17:51 66048 ----a-w- c:\windows\system32\iesetup.dll
2014-03-01 04:51 . 2014-03-13 17:51 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-03-01 04:42 . 2014-03-13 17:51 53760 ----a-w- c:\windows\system32\jsproxy.dll
2014-03-01 04:40 . 2014-03-13 17:51 33792 ----a-w- c:\windows\system32\iernonce.dll
2014-03-01 04:37 . 2014-03-13 17:51 574976 ----a-w- c:\windows\system32\ieui.dll
2014-03-01 04:33 . 2014-03-13 17:51 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2014-03-01 04:33 . 2014-03-13 17:51 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-03-01 04:32 . 2014-03-13 17:51 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2014-03-01 04:23 . 2014-03-13 17:51 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-01 04:17 . 2014-03-13 17:51 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2014-03-01 04:02 . 2014-03-13 17:51 195584 ----a-w- c:\windows\system32\msrating.dll
2014-03-01 03:54 . 2014-03-13 17:51 5768704 ----a-w- c:\windows\system32\jscript9.dll
2014-03-01 03:52 . 2014-03-13 17:51 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2014-03-01 03:51 . 2014-03-13 17:51 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2014-03-01 03:42 . 2014-03-13 17:51 627200 ----a-w- c:\windows\system32\msfeeds.dll
2014-03-01 03:38 . 2014-03-13 17:51 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2014-03-01 03:37 . 2014-03-13 17:51 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2014-03-01 03:35 . 2014-03-13 17:51 2041856 ----a-w- c:\windows\system32\inetcpl.cpl
2014-03-01 03:18 . 2014-03-13 17:51 13051904 ----a-w- c:\windows\system32\ieframe.dll
2014-03-01 03:14 . 2014-03-13 17:51 4244480 ----a-w- c:\windows\SysWow64\jscript9.dll
2014-03-01 03:10 . 2014-03-13 17:51 2334208 ----a-w- c:\windows\system32\wininet.dll
2014-03-01 03:00 . 2014-03-13 17:51 1964032 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2014-03-01 02:38 . 2014-03-13 17:51 1393664 ----a-w- c:\windows\system32\urlmon.dll
2014-03-01 02:32 . 2014-03-13 17:51 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2014-03-01 02:25 . 2014-03-13 17:51 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2014-02-07 01:23 . 2014-03-13 17:51 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-02-04 02:32 . 2014-03-13 17:43 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-02-04 02:32 . 2014-03-13 17:43 624128 ----a-w- c:\windows\system32\qedit.dll
2014-02-04 02:04 . 2014-03-13 17:43 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-02-04 02:04 . 2014-03-13 17:43 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-01-29 02:32 . 2014-03-13 17:46 484864 ----a-w- c:\windows\system32\wer.dll
2014-01-29 02:06 . 2014-03-13 17:46 381440 ----a-w- c:\windows\SysWow64\wer.dll
2014-01-28 02:32 . 2014-03-13 17:47 228864 ----a-w- c:\windows\system32\wwansvc.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify"="c:\users\Username\AppData\Roaming\Spotify\Spotify.exe" [2014-04-09 6087224]
"Spotify Web Helper"="c:\users\Username\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-04-09 1171000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe" [2011-09-20 115048]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-15 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"Turbo Key"="c:\program files\ASUS\Turbo Key\TurboKey.exe" [2009-11-24 1874432]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-20 689744]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-08-30 766208]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Gaming mouse"="c:\program files (x86)\Gaming Mouse\Monitor.exe" [2013-07-17 761856]
"GamingKeyboard"="c:\program files (x86)\SHARKOON Skiller\GameMon.exe" [2012-06-07 1803264]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-07-25 5624784]
.
c:\users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2013-10-9 0]
Trillian.lnk - c:\program files (x86)\Trillian\trillian.exe [2013-6-13 2606448]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys;c:\windows\SYSNATIVE\DRIVERS\sbapifs.sys [x]
R3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 GameKB;SHARKOON Skiller;c:\windows\system32\drivers\GameKB.sys;c:\windows\SYSNATIVE\drivers\GameKB.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192cu.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192cu.sys [x]
S3 rusb3hub;Renesas Electronics USB 3.0 Hub Driver (Version 3.0);c:\windows\system32\DRIVERS\rusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\rusb3hub.sys [x]
S3 rusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver (Version 3.0);c:\windows\system32\DRIVERS\rusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\rusb3xhc.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-04-09 16:21 1077576 ----a-w- c:\program files (x86)\Google\Chrome\Application\34.0.1847.116\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-14 15:55]
.
2014-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-10-08 19:40]
.
2014-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-10-08 19:40]
.
2014-04-21 c:\windows\Tasks\RtlNICDiagVistaStart.job
- c:\program files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe [2013-10-08 10:16]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-12 7560296]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 121.157.39.117 114.114.114.114
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Notify-SDWinLogon - SDWinLogon.dll
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-04-21 21:57:56
ComboFix-quarantined-files.txt 2014-04-21 19:57
.
Vor Suchlauf: 14 Verzeichnis(se), 854.355.116.032 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 853.954.068.480 Bytes frei
.
- - End Of File - - 732D0B7875C0492AEFEC59F5EB02965C
A36C5E4F47E84449FF07ED3517B43A31
|
|
22.04.2014, 13:50
| #4 |
| /// the machine /// TB-Ausbilder | Webseiten werden auf Werbung umgeleitet Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.04.2014, 15:26
| #5 |
| | Webseiten werden auf Werbung umgeleitet Hallo Hier die gewünschten Scans. Ich habe mich genau an deine Anleitung gehalten. Problem leider noch vorhanden. Chrome konnte mein Userprofil nicht mehr herstellen, alle Seiten waren weg. Als ich das Board hier neu öffnete ging das Spiel mit der nervigen Werbung direkt von vorne los! Malwarebytes Scan Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 22.04.2014 Suchlauf-Zeit: 15:16:12 Logdatei: AMBScan.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.04.22.03 Rootkit Datenbank: v2014.03.27.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: User1 Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 253490 Verstrichene Zeit: 8 Min, 43 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.200 - Bericht erstellt am 22/04/2014 um 15:54:51
# Aktualisiert 22/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : User1 - User1-PC-NE
# Gestartet von : C:\Users\User1\Desktop\adwcleaner (1).exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updatewhilokii_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updatewhilokii_rasmancs
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
-\\ Google Chrome v34.0.1847.116
[ Datei : C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Extension] : aipfmkinhleccnodemkoofnnofpbbpac
Gelöscht [Extension] : ieadcoanfjloocmfafkebdnfefmohngj
Gelöscht [Extension] : ifohbjbgfchkkfhphahclmkpgejiplfo
Gelöscht [Extension] : igdhbblpcellaljokkpfhcjlagemhgjl
*************************
AdwCleaner[R0].txt - [11762 octets] - [10/10/2013 01:00:21]
AdwCleaner[R1].txt - [30074 octets] - [26/03/2014 01:32:39]
AdwCleaner[R2].txt - [1301 octets] - [26/03/2014 01:45:59]
AdwCleaner[R3].txt - [1181 octets] - [09/04/2014 18:46:22]
AdwCleaner[R4].txt - [1774 octets] - [22/04/2014 15:51:25]
AdwCleaner[S0].txt - [8969 octets] - [10/10/2013 01:01:06]
AdwCleaner[S1].txt - [29951 octets] - [26/03/2014 01:33:32]
AdwCleaner[S2].txt - [1318 octets] - [26/03/2014 01:49:12]
AdwCleaner[S3].txt - [1243 octets] - [09/04/2014 18:47:47]
AdwCleaner[S4].txt - [1649 octets] - [22/04/2014 15:54:51]
########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1709 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by User1 on 22.04.2014 at 15:58:44,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-196019333-3621520618-2838316431-1000\Software\sweetim
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.04.2014 at 16:03:34,02
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2014
Ran by User1 (administrator) on User1-PC-NE on 22-04-2014 16:16:25
Running from C:\Users\User1\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Gaming Mouse\Monitor.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()
HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
Chrome:
=======
CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-09]
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation )
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-22 16:16 - 2014-04-22 16:16 - 00010909 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:50 - 2014-04-22 15:50 - 00001155 _____ () C:\AMBScan.txt
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox
2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:02 - 2014-04-22 16:08 - 00000000 ____D () C:\Scans
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 12:50 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-21 12:50 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-21 12:50 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-09 19:03 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 19:03 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:30 - 2014-04-22 16:16 - 00000000 ____D () C:\FRST
2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 00:03 - 2014-04-21 17:17 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-04-22 15:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995 (1).zip
2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995.zip
==================== One Month Modified Files and Folders =======
2014-04-22 16:16 - 2014-04-22 16:16 - 00010909 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-22 16:16 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST
2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-22 16:10 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify
2014-04-22 16:10 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job
2014-04-22 16:09 - 2013-10-08 21:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-22 16:09 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-22 16:09 - 2009-07-14 06:51 - 00037278 _____ () C:\Windows\setupact.log
2014-04-22 16:08 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans
2014-04-22 16:08 - 2013-10-08 19:57 - 01222240 _____ () C:\Windows\WindowsUpdate.log
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 16:03 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-22 16:03 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:56 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify
2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner
2014-04-22 15:50 - 2014-04-22 15:50 - 00001155 _____ () C:\AMBScan.txt
2014-04-22 15:20 - 2013-10-08 21:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-22 14:54 - 2010-11-21 05:47 - 00283524 _____ () C:\Windows\PFRO.log
2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox
2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1
2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk
2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-21 12:50 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-20 23:18 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net
2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-16 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 16:01 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-21 12:50 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-21 12:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-21 12:50 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-09 18:24 - 2013-10-08 21:41 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-03 09:51 - 2014-04-22 15:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-22 15:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-22 15:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-04-01 18:15 - 2013-10-08 21:40 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-01 18:15 - 2013-10-08 21:40 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-31 03:16 - 2014-04-09 19:03 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-09 19:03 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995 (1).zip
2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995.zip
Some content of TEMP:
====================
C:\Users\User1\AppData\Local\Temp\avgnt.exe
C:\Users\User1\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-21 14:43
==================== End Of Log ============================
--- --- --- |
|
22.04.2014, 19:20
| #6 |
| /// the machine /// TB-Ausbilder | Webseiten werden auf Werbung umgeleitet Revo Uninstaller - Download - Filepony damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.google.com/chrome/answer/3296214?hl=de ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Webseiten werden auf Werbung umgeleitet |
|
23.04.2014, 20:01
| #7 |
| | Webseiten werden auf Werbung umgeleitet Hallo Hier die gewünschten Scans: ESET Scan Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1e8bdc2a473bfb4f8784f3bf236e0012
# engine=17988
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-23 02:10:42
# local_time=2014-04-23 04:10:42 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 10205 16926675 2970 0
# compatibility_mode=5893 16776573 100 94 8814 149892092 0 0
# scanned=293199
# found=0
# cleaned=0
# scan_time=8199
Code:
ATTFilter Results of screen317's Security Check version 0.99.82
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Java 7 Update 45
Java 7 Update 55
Google Chrome 34.0.1847.116
````````Process Check: objlist.exe by Laurent````````
Spybot Teatimer.exe is disabled!
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Und zum Schluss ein frischer FRST Scan FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2014
Ran by User1 (administrator) on User1-PC-NE on 23-04-2014 18:00:28
Running from C:\Users\User1\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Gaming Mouse\Monitor.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()
HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil64_12_0_0_77_ActiveX.exe [531848 2014-04-03] (Adobe Systems Incorporated)
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
Chrome:
=======
CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]
CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]
CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]
CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]
CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]
CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation )
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-23 13:49 - 2014-04-23 18:00 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-23 13:49 - 2014-04-23 14:00 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-23 13:49 - 2014-04-23 13:55 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-23 13:49 - 2014-04-23 13:55 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList
2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe
2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk
2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe
2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm
2014-04-23 00:43 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-23 00:43 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-23 00:43 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-23 00:43 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-22 16:16 - 2014-04-23 18:00 - 00011794 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox
2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:02 - 2014-04-23 18:00 - 00000000 ____D () C:\Scans
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:30 - 2014-04-23 18:00 - 00000000 ____D () C:\FRST
2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 00:03 - 2014-04-21 17:17 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-04-22 15:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
==================== One Month Modified Files and Folders =======
2014-04-23 18:00 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-23 18:00 - 2014-04-22 16:16 - 00011794 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-23 18:00 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans
2014-04-23 18:00 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST
2014-04-23 17:46 - 2013-10-08 19:57 - 01274774 _____ () C:\Windows\WindowsUpdate.log
2014-04-23 17:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-23 14:00 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-23 13:55 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-23 13:55 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-23 13:52 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-23 13:52 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google
2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-23 13:45 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify
2014-04-23 13:45 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job
2014-04-23 13:44 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-23 13:44 - 2009-07-14 06:51 - 00037390 _____ () C:\Windows\setupact.log
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList
2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe
2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk
2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe
2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm
2014-04-23 13:19 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify
2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-23 00:41 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net
2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner
2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-22 14:54 - 2010-11-21 05:47 - 00283524 _____ () C:\Windows\PFRO.log
2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox
2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1
2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk
2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-03 09:51 - 2014-04-22 15:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-22 15:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-22 15:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
Some content of TEMP:
====================
C:\Users\User1\AppData\Local\Temp\avgnt.exe
C:\Users\User1\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-21 14:43
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Bisher sind keinerlei Probleme mehr zu sehen in meinem Chrome! Ich kann endlich wieder Links anklicken ohne Gedudel und Koreanische Werbung! EIN TRAUM! Vielen vielen Dank dafür.   Hast du eventuell noch ein paar Tips wie ich in Zukunft verhindern kann mir so einen Mist nochmal einzufangen? Vielen Dank und viele Grüße Kerrigan Hallo, sorry das ich einen neuen Beitrag erstelle. Ich konnte den anderen nicht mehr editieren. Leider ist das Problem wieder da! Es ging als ich den Browser neu gemacht hatte ohne Probleme das Board hier aufzurufen. Dann rief ich die Seite Base.de auf um mir dort ein Handy anzuschauen und beim Klicken auf Handys kam die Koreanische Werbung samt Sound in einem extra Tab wieder.  Und seit dem geht es auch hier im Board wieder los das ich keinen Link ohne nervige extra Werbung klicken kann. *verzweifel* |
|
24.04.2014, 12:01
| #8 |
| /// the machine /// TB-Ausbilder | Webseiten werden auf Werbung umgeleitet Öffne mal bitte FRST, setz nen Haken bei Additional und scanne, poste bitte beide Logfiles.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.04.2014, 17:03
| #9 |
| | Webseiten werden auf Werbung umgeleitet Huhu, hier sind die gewünschten Scans! Scan1 FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014
Ran by User1 (administrator) on User1-PC-NE on 24-04-2014 17:58:11
Running from C:\Users\User1\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(AMD) C:\Windows\system32\atieclxx.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files (x86)\Gaming Mouse\Monitor.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()
HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
Chrome:
=======
CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]
CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]
CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]
CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]
CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]
CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation )
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-24 17:58 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion
2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe
2014-04-23 13:49 - 2014-04-24 17:55 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-23 13:49 - 2014-04-24 00:00 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-23 13:49 - 2014-04-23 13:55 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-23 13:49 - 2014-04-23 13:55 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList
2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe
2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk
2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe
2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm
2014-04-23 00:43 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-23 00:43 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-23 00:43 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-23 00:43 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-22 16:16 - 2014-04-24 17:58 - 00011646 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-22 16:15 - 2014-04-24 17:58 - 02061824 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox
2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:02 - 2014-04-23 18:04 - 00000000 ____D () C:\Scans
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:30 - 2014-04-24 17:58 - 00000000 ____D () C:\FRST
2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 00:03 - 2014-04-21 17:17 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-04-22 15:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
==================== One Month Modified Files and Folders =======
2014-04-24 17:58 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion
2014-04-24 17:58 - 2014-04-22 16:16 - 00011646 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-24 17:58 - 2014-04-22 16:15 - 02061824 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-24 17:58 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST
2014-04-24 17:58 - 2013-10-08 19:57 - 01289582 _____ () C:\Windows\WindowsUpdate.log
2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe
2014-04-24 17:57 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-24 17:57 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-24 17:56 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify
2014-04-24 17:55 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-24 17:55 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job
2014-04-24 17:53 - 2010-11-21 05:47 - 00284572 _____ () C:\Windows\PFRO.log
2014-04-24 17:53 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-24 17:53 - 2009-07-14 06:51 - 00037446 _____ () C:\Windows\setupact.log
2014-04-24 00:00 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-23 23:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-23 18:04 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans
2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-23 13:55 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-23 13:55 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google
2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList
2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe
2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk
2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe
2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm
2014-04-23 13:19 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify
2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-23 00:41 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner
2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox
2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1
2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 13:06 - 2013-10-09 17:30 - 00001110 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk
2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk
2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-03 09:51 - 2014-04-22 15:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-22 15:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-22 15:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
Some content of TEMP:
====================
C:\Users\User1\AppData\Local\Temp\avgnt.exe
C:\Users\User1\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-21 14:43
==================== End Of Log ============================
--- --- --- Scan 2 Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-04-2014
Ran by User1 at 2014-04-24 17:59:23
Running from C:\Users\User1\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader X MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)
AI Suite (HKLM-x32\...\{310BC5E2-31AF-49BB-904D-E71EB93645DC}) (Version: 1.06.22 - )
AMD Accelerated Video Transcoding (Version: 13.15.100.30830 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{1E9871B6-7C44-9A3A-A1C0-F9729663C7F5}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.80830.1925 - Advanced Micro Devices, Inc.) Hidden
ASUSUpdate (HKLM-x32\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 7.18.03 - ASUSTeK Computer Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.792 - Curse)
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.02.01 - )
Gaming mouse Driver (HKLM-x32\...\{F1A273BD-6A9E-41D8-A111-5E56ACD286F8}) (Version: 1.0 - Togran)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2 (HKLM-x32\...\Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2) (Version: - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045F0}) (Version: 7.0.450 - Oracle)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PC Probe II (HKLM-x32\...\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}) (Version: 1.04.92 - ASUSTeK Computer Inc.)
RAIDXpert (HKLM-x32\...\InstallShield_{8B76B8E9-F773-4B75-A08C-120079EB765E}) (Version: 3.2.1540.10 - AMD)
RAIDXpert (x32 Version: 3.2.1540.10 - AMD) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.52.203.2012 - Realtek)
Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SHARKOON Skiller (HKLM-x32\...\{91C25547-9534-41A5-823A-1E54BA16EA3F}) (Version: 1.00.0000 - )
Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
StarCraft (HKLM-x32\...\StarCraft) (Version: - Blizzard Entertainment)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer)
Trillian (HKLM-x32\...\Trillian) (Version: - Cerulean Studios, LLC)
Turbo Key (HKLM-x32\...\{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}) (Version: 1.01.03 - )
WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)
==================== Restore Points =========================
21-04-2014 10:49:10 Installed Java 7 Update 55
22-04-2014 13:00:33 Windows Update
22-04-2014 22:42:43 Windows Update
23-04-2014 11:38:19 Revo Uninstaller's restore point - Google Chrome
23-04-2014 11:47:22 Installed Java 7 Update 45
==================== Hosts content: ==========================
2009-07-14 04:34 - 2014-03-27 13:55 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {17AE2781-DC90-409D-844F-7505972C986D} - System32\Tasks\{B5B1AE0E-3C4C-4AD9-8669-91E4FF7D9AE7} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {1A00D3E0-B7C3-4A4D-82F2-E64CFE95E5CA} - System32\Tasks\ASUS\ASUS Update Checker => C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-28] (ASUSTeK Computer Inc.)
Task: {2B36B741-9E17-40FC-80DC-12A4CE3735F6} - \UpdaterEX No Task File <==== ATTENTION
Task: {2B85E513-10C2-4F23-B5C0-02C37189F04F} - \BonanzaDealsLiveUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {2FE213FF-1F17-4CBA-AD8E-8FF6E5743111} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-03] (Adobe Systems Incorporated)
Task: {33F91DDD-7080-4E4E-A262-923E41365D8C} - System32\Tasks\RtlNICDiagVistaStart => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe [2011-11-16] (Realtek Semiconductor Corporation.)
Task: {398A692E-F869-4D02-9049-FDC6274CFE5F} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)
Task: {4ABAA26D-889D-4B96-97AA-46AEB8C145C2} - System32\Tasks\{415876D4-2516-46E8-9E35-A397A136CFD5} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {4C3E5020-47BB-437B-BADF-F49A8531515E} - System32\Tasks\{2078D8B4-E896-44F1-8BBC-6CCB8A701A19} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {5C78006B-CFF9-440F-B2B2-314755DE0BC5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)
Task: {7BF2CEF6-25DB-497A-AFD6-7FB0C7BD3997} - System32\Tasks\{2DA44194-053F-4631-A9F3-3DA0216DDF84} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {83815CB9-F200-43DD-982F-8DC23A2B38CB} - \BitGuard No Task File <==== ATTENTION
Task: {8F5A1D53-5645-4D99-86B7-47A0CB71057D} - \BonanzaDealsUpdate No Task File <==== ATTENTION
Task: {AAEB89A6-F600-4874-A562-7EC045EAC8D5} - \EPUpdater No Task File <==== ATTENTION
Task: {ADF24FC4-A0B7-45D3-93BA-9DAC484C82C6} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {AE4D9D36-14FC-494D-BA95-37E50E0B340E} - \BonanzaDealsLiveUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {B38E72B5-EF1C-4D7E-9E27-515874A16FD7} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.12\AsLoader.exe [2010-01-14] (ASUSTeK Computer Inc.)
Task: {C1E9ADA0-5DCA-4968-A3A7-684D26A19C9A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)
Task: {CCB68486-F473-4770-A71D-50EEA4558A31} - System32\Tasks\ASUS\Cpu Level Up Hook Lanunch => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHookLaunch.exe [2009-12-28] ()
Task: {CDA3F082-82A9-46B4-B38C-6B963E504691} - System32\Tasks\{43EA236D-C510-4A42-9726-86138A33EA20} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {DBB33BD9-114C-4DD4-82D7-DE1AF5F88CC4} - System32\Tasks\{98B32694-0566-4AC3-9644-A7CD534B12BD} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {EC05ADE8-4BA1-45A3-97CA-8DC8A51F72CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {EFCB4FEE-9CF2-4B10-9C33-347CAD02CE64} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\RtlNICDiagVistaStart.job => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe
==================== Loaded Modules (whitelisted) =============
2013-08-30 19:47 - 2013-08-30 19:47 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2012-10-22 14:41 - 2012-10-22 14:41 - 00749056 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2012-10-22 14:42 - 2012-10-22 14:42 - 03645952 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2013-08-30 19:47 - 2013-08-30 19:47 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2009-12-15 17:40 - 2009-12-15 17:40 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
2009-12-15 17:40 - 2009-12-15 17:40 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe
2009-12-15 17:41 - 2009-12-15 17:41 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe
2013-12-13 14:46 - 2013-07-17 15:02 - 00761856 _____ () C:\Program Files (x86)\Gaming Mouse\Monitor.exe
2013-08-30 19:47 - 2013-08-30 19:47 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-10-09 18:22 - 2013-10-09 18:20 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2009-12-15 23:44 - 2009-12-15 23:44 - 00516096 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\libxml2.dll
2014-04-21 13:27 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-04-21 13:27 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-04-21 13:27 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-04-21 13:27 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-04-21 13:27 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-10-08 21:42 - 2009-03-19 22:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll
2013-10-08 21:42 - 2009-03-19 22:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll
2013-10-08 21:42 - 2009-01-15 14:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
2013-10-08 21:42 - 2009-03-25 16:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
2013-10-08 22:23 - 2009-04-29 14:24 - 00253952 _____ () C:\Program Files\ASUS\Turbo Key\pngio.dll
2013-10-08 22:23 - 2009-04-29 14:24 - 00208896 _____ () C:\Program Files\ASUS\Turbo Key\AiNap.dll
2013-10-08 22:23 - 2009-04-29 14:24 - 00008704 _____ () C:\Program Files\ASUS\Turbo Key\vvc.dll
2013-12-13 14:46 - 2013-05-21 11:40 - 00057344 _____ () C:\Program Files (x86)\Gaming Mouse\lan.dll
2013-12-13 14:46 - 2013-01-17 11:04 - 00061440 _____ () C:\Program Files (x86)\Gaming Mouse\hiddriver.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/24/2014 05:53:37 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/23/2014 05:53:01 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/23/2014 04:41:43 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/23/2014 01:50:38 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/23/2014 01:50:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/23/2014 01:50:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/23/2014 01:44:49 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/23/2014 01:37:13 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/23/2014 01:15:24 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/22/2014 04:09:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (04/24/2014 05:53:29 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/24/2014 05:53:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/24/2014 00:12:08 AM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (04/23/2014 01:44:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/23/2014 01:44:40 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/23/2014 01:15:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/23/2014 01:15:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/23/2014 00:42:36 AM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (04/22/2014 04:09:40 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/22/2014 04:09:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
Error: (04/24/2014 05:53:37 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/23/2014 05:53:01 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (04/23/2014 04:41:43 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
Error: (04/23/2014 01:50:38 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe
Error: (04/23/2014 01:50:35 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe
Error: (04/23/2014 01:50:35 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe
Error: (04/23/2014 01:44:49 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/23/2014 01:37:13 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe
Error: (04/23/2014 01:15:24 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/22/2014 04:09:45 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 25%
Total physical RAM: 8174.12 MB
Available physical RAM: 6048.97 MB
Total Pagefile: 16346.41 MB
Available Pagefile: 14089.61 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB
==================== Drives ================================
Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:797.26 GB) NTFS
Drive d: (Englisch12) (CDROM) (Total:0.32 GB) (Free:0 GB) CDFS
Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: DB55773B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
25.04.2014, 09:40
| #10 | |
| /// the machine /// TB-Ausbilder | Webseiten werden auf Werbung umgeleitetZitat:
Verbindest Du Chrome mit einem Google Konto?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.04.2014, 12:34
| #11 |
| | Webseiten werden auf Werbung umgeleitet Hallo, ich habe beide Dateien scannen lassen. Bei beiden wurden 0 / 51 gefunden. Ich verbinde Chrome nicht mit einem Google Konto. Könnte das ein Problem sein? |
|
21.05.2014, 23:56
| #12 |
| | Webseiten werden auf Werbung umgeleitet Hallo, hier die Scans. Problem leider immer noch da. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2014 01 (ATTENTION: ====> FRST version is 11 days old and could be outdated)
Ran by User1 (administrator) on User1-PC-NE on 22-05-2014 00:35:46
Running from C:\Users\User1\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\spotify.exe
(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Gaming Mouse\Monitor.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Program Files (x86)\Trillian\plugins\skypekit.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()
HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6170168 2014-05-14] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-14] (Spotify Ltd)
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
Chrome:
=======
CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-15]
CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-15]
CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-15]
CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-15]
CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-15]
CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-15]
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation )
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-22 00:21 - 2014-05-22 00:21 - 00000963 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_002154.txt
2014-05-22 00:20 - 2014-05-22 00:20 - 00001916 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_002056.txt
2014-05-22 00:18 - 2014-05-22 00:18 - 00001880 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_001801.txt
2014-05-22 00:18 - 2014-05-22 00:18 - 00000930 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_001829.txt
2014-05-17 01:19 - 2014-05-06 07:14 - 19274752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-17 01:19 - 2014-05-06 07:14 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-17 01:19 - 2014-05-06 05:48 - 14367232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-17 01:19 - 2014-05-06 05:48 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-17 01:19 - 2014-05-06 05:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-17 01:19 - 2014-05-06 05:26 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-17 01:19 - 2013-12-21 11:39 - 00600064 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-17 01:19 - 2013-12-21 09:56 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 02238976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 02049536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-15 19:51 - 2014-05-15 19:51 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-05-15 19:51 - 2014-05-15 19:51 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-05-15 19:51 - 2014-05-15 19:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-05-15 19:51 - 2014-05-15 19:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-05-15 19:51 - 2014-05-15 19:51 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-05-15 19:51 - 2014-05-15 19:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-05-15 19:48 - 2014-05-15 19:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 19:48 - 2014-05-04 17:12 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 19:47 - 2014-05-15 19:47 - 00002027 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-05-15 00:43 - 2014-05-15 00:43 - 00001846 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05152014_004326.txt
2014-05-15 00:38 - 2014-05-15 00:38 - 00000000 ____D () C:\Users\User1\AppData\Local\Adobe
2014-05-15 00:22 - 2014-05-22 00:35 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-15 00:22 - 2014-05-22 00:32 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-15 00:22 - 2014-05-15 00:27 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-15 00:22 - 2014-05-15 00:27 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-15 00:22 - 2014-05-15 00:22 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-15 00:22 - 2014-05-15 00:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-14 23:36 - 2014-05-15 00:09 - 38410232 _____ (Google Inc.) C:\Users\User1\Downloads\ChromeStandaloneSetup_34.0.1847.137.exe
2014-05-14 23:28 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-05-14 23:08 - 2014-05-14 23:21 - 00041697 _____ () C:\Users\User1\Desktop\Shortcut.txt
2014-05-14 17:49 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 17:49 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 17:49 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 17:49 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 17:49 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 17:49 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 17:49 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 17:49 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 17:49 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 17:49 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-14 17:49 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-14 17:49 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 17:49 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 17:49 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 17:49 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 17:49 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 17:49 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 17:49 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 17:49 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 17:49 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 17:49 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 17:49 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 17:49 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 17:49 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 17:49 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 17:49 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 17:49 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 17:49 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 17:49 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-14 17:49 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-14 17:49 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-14 17:49 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-14 17:49 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-14 17:49 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-13 17:41 - 2014-05-13 17:41 - 00002445 _____ () C:\Users\User1\Desktop\RKreport[0]_D_05132014_174137.txt
2014-05-13 17:41 - 2014-05-13 17:41 - 00000860 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05132014_174143.txt
2014-05-13 17:39 - 2014-05-13 17:39 - 00002346 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05132014_173940.txt
2014-05-12 14:37 - 2014-05-12 14:44 - 00017189 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143749.txt
2014-05-12 14:35 - 2014-05-12 14:35 - 00017160 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143525.txt
2014-05-12 14:33 - 2014-05-12 14:33 - 04527616 _____ () C:\Users\User1\Desktop\RogueKillerX64 (1).exe
2014-05-12 14:32 - 2014-05-12 14:32 - 04527616 _____ () C:\Users\User1\Downloads\RogueKillerX64.exe
2014-05-12 14:31 - 2014-05-13 17:41 - 00000000 ____D () C:\Users\User1\Desktop\RK_Quarantine
2014-05-12 14:31 - 2014-03-26 13:57 - 04493824 _____ () C:\Users\User1\Desktop\RogueKillerX64.exe
2014-05-12 14:31 - 2014-03-26 13:57 - 03945472 _____ () C:\Users\User1\Desktop\RogueKiller.exe
2014-05-12 14:30 - 2014-05-12 14:30 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14 (1).zip
2014-05-12 14:29 - 2014-05-12 14:29 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14.zip
2014-05-01 00:03 - 2014-05-15 19:37 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip
2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip
2014-04-29 21:45 - 2014-04-29 21:46 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip
2014-04-24 18:00 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2014-04-24 18:00 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-04-24 17:59 - 2014-05-14 23:21 - 00025318 _____ () C:\Users\User1\Desktop\Addition.txt
2014-04-24 17:58 - 2014-05-13 17:49 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion
2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList
2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe
2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk
2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe
2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm
2014-04-22 16:16 - 2014-05-22 00:35 - 00012260 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-22 16:15 - 2014-05-13 17:49 - 02066944 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
==================== One Month Modified Files and Folders =======
2014-05-22 00:36 - 2014-04-22 16:16 - 00012260 _____ () C:\Users\User1\Desktop\FRST.txt
2014-05-22 00:35 - 2014-05-15 00:22 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-22 00:35 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify
2014-05-22 00:35 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job
2014-05-22 00:32 - 2014-05-15 00:22 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-22 00:31 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-22 00:31 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-22 00:23 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-22 00:23 - 2009-07-14 06:51 - 00039014 _____ () C:\Windows\setupact.log
2014-05-22 00:22 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST
2014-05-22 00:22 - 2013-10-08 19:57 - 01307340 _____ () C:\Windows\WindowsUpdate.log
2014-05-22 00:21 - 2014-05-22 00:21 - 00000963 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_002154.txt
2014-05-22 00:20 - 2014-05-22 00:20 - 00001916 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_002056.txt
2014-05-22 00:18 - 2014-05-22 00:18 - 00001880 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_001801.txt
2014-05-22 00:18 - 2014-05-22 00:18 - 00000930 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_001829.txt
2014-05-22 00:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-21 17:42 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify
2014-05-17 00:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-15 20:00 - 2013-10-08 20:20 - 00001417 _____ () C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-15 19:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-15 19:56 - 2013-10-14 15:35 - 00020687 _____ () C:\Windows\IE10_main.log
2014-05-15 19:51 - 2014-05-15 19:51 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 02238976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 02049536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-15 19:51 - 2014-05-15 19:51 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-05-15 19:51 - 2014-05-15 19:51 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-05-15 19:51 - 2014-05-15 19:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-05-15 19:51 - 2014-05-15 19:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-05-15 19:51 - 2014-05-15 19:51 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-05-15 19:51 - 2014-05-15 19:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-05-15 19:51 - 2014-05-15 19:51 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-05-15 19:51 - 2014-05-15 19:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-05-15 19:49 - 2014-05-15 19:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 19:47 - 2014-05-15 19:47 - 00002027 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-05-15 19:47 - 2013-10-08 22:23 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-15 19:42 - 2013-10-08 22:23 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-15 19:42 - 2013-10-08 20:20 - 00000000 ___RD () C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-15 19:42 - 2013-10-08 20:20 - 00000000 ___RD () C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 19:37 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 19:37 - 2010-11-21 05:47 - 00285442 _____ () C:\Windows\PFRO.log
2014-05-15 00:43 - 2014-05-15 00:43 - 00001846 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05152014_004326.txt
2014-05-15 00:38 - 2014-05-15 00:38 - 00000000 ____D () C:\Users\User1\AppData\Local\Adobe
2014-05-15 00:38 - 2013-10-09 13:36 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Adobe
2014-05-15 00:27 - 2014-05-15 00:22 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-15 00:27 - 2014-05-15 00:22 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-15 00:22 - 2014-05-15 00:22 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-15 00:22 - 2014-05-15 00:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-15 00:22 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google
2014-05-15 00:22 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-15 00:09 - 2014-05-14 23:36 - 38410232 _____ (Google Inc.) C:\Users\User1\Downloads\ChromeStandaloneSetup_34.0.1847.137.exe
2014-05-14 23:27 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java
2014-05-14 23:21 - 2014-05-14 23:08 - 00041697 _____ () C:\Users\User1\Desktop\Shortcut.txt
2014-05-14 23:21 - 2014-04-24 17:59 - 00025318 _____ () C:\Users\User1\Desktop\Addition.txt
2014-05-14 19:15 - 2013-10-14 14:04 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 19:15 - 2013-10-14 14:04 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 19:15 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 00:11 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-05-14 00:11 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net
2014-05-13 22:47 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft
2014-05-13 17:49 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion
2014-05-13 17:49 - 2014-04-22 16:15 - 02066944 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-05-13 17:42 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans
2014-05-13 17:41 - 2014-05-13 17:41 - 00002445 _____ () C:\Users\User1\Desktop\RKreport[0]_D_05132014_174137.txt
2014-05-13 17:41 - 2014-05-13 17:41 - 00000860 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05132014_174143.txt
2014-05-13 17:41 - 2014-05-12 14:31 - 00000000 ____D () C:\Users\User1\Desktop\RK_Quarantine
2014-05-13 17:39 - 2014-05-13 17:39 - 00002346 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05132014_173940.txt
2014-05-12 14:44 - 2014-05-12 14:37 - 00017189 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143749.txt
2014-05-12 14:35 - 2014-05-12 14:35 - 00017160 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143525.txt
2014-05-12 14:33 - 2014-05-12 14:33 - 04527616 _____ () C:\Users\User1\Desktop\RogueKillerX64 (1).exe
2014-05-12 14:32 - 2014-05-12 14:32 - 04527616 _____ () C:\Users\User1\Downloads\RogueKillerX64.exe
2014-05-12 14:30 - 2014-05-12 14:30 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14 (1).zip
2014-05-12 14:29 - 2014-05-12 14:29 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14.zip
2014-05-09 08:14 - 2014-05-14 17:49 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-14 17:49 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 18:20 - 2013-10-22 18:07 - 00000000 ____D () C:\Users\User1\Documents\StarCraft II
2014-05-06 07:14 - 2014-05-17 01:19 - 19274752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 07:14 - 2014-05-17 01:19 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 05:48 - 2014-05-17 01:19 - 14367232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:48 - 2014-05-17 01:19 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-06 05:37 - 2014-05-17 01:19 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:26 - 2014-05-17 01:19 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-04 17:12 - 2014-05-15 19:48 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-02 20:59 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip
2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip
2014-04-29 21:46 - 2014-04-29 21:45 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip
2014-04-29 21:45 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList
2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe
2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk
2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe
2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner
2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
Some content of TEMP:
====================
C:\Users\User1\AppData\Local\Temp\avgnt.exe
C:\Users\User1\AppData\Local\Temp\ntdll_dump.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe
[2014-05-14 17:49] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-14 21:11
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-05-2014 01
Ran by User1 at 2014-05-22 00:15:10 Run:4
Running from C:\Users\User1\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\Software\Classes\exefile: <===== ATTENTION!
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
*****************
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\Software\Classes\exefile => Key deleted successfully.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer => Value deleted successfully.
==== End of Fixlog ====
Code:
ATTFilter RogueKiller V8.8.14 _x64_ [Mar 26 2014] durch Adlice Software
mail : hxxp://www.adlice.com/contact/
Kommentare : hxxp://forum.adlice.com
Webseite : hxxp://www.adlice.com/softwares/roguekiller/
Blog : hxxp://www.adlice.com
Betriebssystem : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Gestartet in : Normaler Modus
Benutzer : User1 [Admin Rechte]
Funktion : Scannen -- Datum : 05/22/2014 00:20:56
| ARK || FAK || MBR |
¤¤¤ Böswillige Prozesse : 0 ¤¤¤
¤¤¤ Registry-Einträge : 0 ¤¤¤
¤¤¤ Geplante Tasks : 0 ¤¤¤
¤¤¤ Autostart-Einträge : 0 ¤¤¤
¤¤¤ Web-Browsern : 0 ¤¤¤
¤¤¤ Browser Addons : 0 ¤¤¤
¤¤¤ Bestimmte Dateien / Ordner: ¤¤¤
¤¤¤ Treiber : [NICHT GELADEN 0x0] ¤¤¤
¤¤¤ Externe Hives: ¤¤¤
¤¤¤ Infektion : ¤¤¤
¤¤¤ Hosts-Datei: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
¤¤¤ MBR überprüfen: ¤¤¤
+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD10EALX-009BA0 ATA Device +++++
--- User ---
[MBR] 4e08872e192e8c6e0c1d0fedfaeda45f
[BSP] 3b932c3ea17df325cd0025b065592a32 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MB
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) Multi Flash Reader USB Device +++++
Error reading User MBR! ([0x15] Das Gerät ist nicht bereit. )
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] Die Anforderung wird nicht unterstützt. )
Abgeschlossen : << RKreport[0]_S_05222014_002056.txt >>
RKreport[0]_D_05132014_174137.txt;RKreport[0]_S_05122014_143525.txt;RKreport[0]_S_05122014_143749.txt
RKreport[0]_S_05132014_173940.txt;RKreport[0]_S_05152014_004326.txt;RKreport[0]_S_05222014_001801.txt
|
|
26.04.2014, 08:12
| #13 |
| /// the machine /// TB-Ausbilder | Webseiten werden auf Werbung umgeleitet Wenn du verbinden würdest dann ja. Nutzt Du einen Adblocker als Addon in Chrome?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.04.2014, 15:03
| #14 |
| | Webseiten werden auf Werbung umgeleitet Hallo, ich habe vor der Neuinstallation von Chrome Addblock installiert gehabt. Habe es aber seit dem nicht neu runtergeladen. Eigentlich sollte keine Erweiterung installiert sein. Beim Blick in die Einstellung eben sah ich eine aktive Erweiterung namens Google Docs 0,5. Ich habe keine Ahnung was das ist. Ich habe es nicht wissentlich installiert. Mir ist eben was aufgefallen. Bei allen Seiten auf denen das Problem auftritt liegt wie ein unsichtbares Fenster über der Webseite. Diese verlinkt egal welche Seite es ist auf einen Link der beginnt mit hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9775&AUTH=83C558160C usw. Dann kommt noch eine ellenlange Zahl. Hinten dran steht dann noch refer und dahinter kommt die eigentliche Seiten URL auf der ich tatsächlich bin. Eventuell hilft dir das bei der Lokalisierung der Plagegeister. |
|
26.04.2014, 18:43
| #15 |
| /// the machine /// TB-Ausbilder | Webseiten werden auf Werbung umgeleitet Und das ist nur in Chrome, nicht in andern Browsern so?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Webseiten werden auf Werbung umgeleitet |
| adobe, antivir, auf werbung umgeleitet, avira, browser, chrome, cpu, desktop, explorer, flash player, google, homepage, internet, langsam, links, minidump, neue seite, problem, realtek, registry, safer networking, services.exe, spotify web helper, svchost.exe, system, teamspeak, temp, usb, werbung, winlogon.exe, wuauclt.exe, öffnet |
WARNUNG an die MITLESER: 
Hybrid-Darstellung
