Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Webseiten werden auf Werbung umgeleitet

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 21.04.2014, 14:51   #1
Kerrigan
 
Webseiten werden auf Werbung umgeleitet - Böse

Webseiten werden auf Werbung umgeleitet



Hallo,

ich habe ein sehr nerviges Problem was mich langsam aber sicher zur Verzweifelung treibt. Ich surfe im Internet mit Chrome und seit ein paar Wochen tritt dort ein Werbeproblem auf was merkwürdigerweise nicht alle Webseiten betrifft, aber leider viele.

Wenn ich eine neue Seite öffne wird diese ganz normal geladen, sobald ich jedoch einen Link auf der Seite anklicke öffnet sich statt des normalen Links ein neuer Tab mit nerviger Werbung ( die vorzugsweise in koreanisch ist... ) Wenn ich auf einer der betroffenen Webseiten einfach nur auf eine freie Fläche auf der Seite klicke öffnet sich ebenfalls ein neuer Tab mit Werbung.
Ab und zu erscheint rechts unten auf der Seite ein weiser Balken wo nur der Balken und X zum schließen zu sehen ist. Nahezu alle diese Werbetabs haben übrigens extrem nervige Hintergrundmusik. Teilweise ist die Werbung nicht mal zu sehen und man hat nur den Sound. Stoppen kann man ihn nur wenn man die komplette Seite zumacht obwohl dort nichtmal Werbung zu sehen ist. Das passiert wie gesagt nicht bei allen Seiten ( Twitter ist zum Beispiel nicht betroffen ) aber leider doch bei vielen Seiten. Zum Beispiel auch bei diesem Board hier.

Ich hab mir die Anleitung durchgelesen und die Schritte alle ausgeführt. Hier sind die Scans. Ich hoffe wirklich das mir hier jemand helfen kann. Vielen Dank im Vorraus.

Scan FRST

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2014 02
Ran by PC1 (administrator) on PC1-PC-NE on 21-04-2014 15:00:10
Running from C:\Users\PC1\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\PC1\AppData\Roaming\Spotify\spotify.exe
(Spotify Ltd) C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Gaming Mouse\Monitor.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()
HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\PC1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\MountPoints2: {b3c3e069-3042-11e3-b41d-806e6f6e6963} - D:\autorun.exe
Startup: C:\Users\PC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\PC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)

==================== Internet (Whitelisted) ====================

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114

FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR StartupUrls: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (Chrome NaCl) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Google Gears 0.5.33.0) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\gears.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (ProxTube) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-02-25]
CHR Extension: (Adblock Plus) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-19]
CHR Extension: (Google Wallet) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-09]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\PC1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (3).zip
2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 12:50 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-21 12:50 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-21 12:50 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\PC1\Downloads\Malkorok.zip
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-16 15:57 - 585078025 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-16 15:57 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\TS3Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999.zip
2014-04-09 19:03 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 19:03 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\PC1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\PC1\Downloads\adwcleaner.exe
2014-04-09 18:30 - 2014-04-21 15:00 - 00014824 _____ () C:\Users\PC1\Downloads\FRST.txt
2014-04-09 18:30 - 2014-04-21 15:00 - 00000000 ____D () C:\FRST
2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\PC1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\PC1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\PC1\Documents\Anti-Malware
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\PC1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\PC1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-04-20 21:41 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\PC1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995 (1).zip
2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995.zip

==================== One Month Modified Files and Folders =======

2014-04-21 15:00 - 2014-04-09 18:30 - 00014824 _____ () C:\Users\PC1\Downloads\FRST.txt
2014-04-21 15:00 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe
2014-04-21 14:42 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\Spotify
2014-04-21 14:20 - 2013-10-08 21:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-21 14:17 - 2013-10-08 19:57 - 01151524 _____ () C:\Windows\WindowsUpdate.log
2014-04-21 14:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\PC1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\PC1\Documents\Anti-Malware
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (3).zip
2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk
2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-21 12:50 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-21 12:49 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-21 12:49 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-21 12:42 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job
2014-04-21 12:41 - 2013-10-08 21:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-21 12:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-21 12:41 - 2009-07-14 06:51 - 00036998 _____ () C:\Windows\setupact.log
2014-04-20 23:18 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\PC1\AppData\Local\Battle.net
2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\PC1\Downloads\Malkorok.zip
2014-04-20 21:41 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\PC1\AppData\Local\Deployment
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-17 19:39 - 2010-11-21 05:47 - 00281792 _____ () C:\Windows\PFRO.log
2014-04-16 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 16:01 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\PC1\AppData\Local\Google
2014-04-16 15:59 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\PC1\AppData\Local\Spotify
2014-04-16 15:57 - 2014-04-16 15:57 - 585078025 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-16 15:57 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-21 12:50 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-21 12:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-21 12:50 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\TS3Client
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999.zip
2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\PC1\Downloads\SecurityCheck.exe
2014-04-09 18:47 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\PC1\Downloads\adwcleaner.exe
2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\PC1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\PC1\Downloads\FRST64.exe
2014-04-09 18:24 - 2013-10-08 21:41 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\PC1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-04-01 18:15 - 2013-10-08 21:40 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-01 18:15 - 2013-10-08 21:40 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-31 03:16 - 2014-04-09 19:03 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-09 19:03 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\PC1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\PC1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995 (1).zip
2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995.zip

Some content of TEMP:
====================
C:\Users\PC1\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-21 14:43

==================== End Of Log ============================
         
Scan gmer

Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-21 15:23:07
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 WDC_WD10EALX-009BA0 rev.15.01H15 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Username~1\AppData\Local\Temp\agecyuoc.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[1920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                  00000000765c1465 2 bytes [5C, 76]
.text   C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[1920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                 00000000765c14bb 2 bytes [5C, 76]
.text   ...                                                                                                                                                                   * 2
.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                    0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                       00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                     0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                    00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                               00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                        0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                        000007fefd359055 3 bytes [B5, 6F, 06]
.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                                                                000007fefd6b55c8 6 bytes {JMP QWORD [RIP+0xfaa68]}
.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                                                                000007fefd6cb85c 6 bytes {JMP QWORD [RIP+0xc47d4]}
.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                     0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                        00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                      0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                     00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                  0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                         0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                         000007fefd359055 3 bytes CALL 9000027
.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                         0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                            00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                          0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                         00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                      0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                    00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                             0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                             000007fefd359055 3 bytes CALL 9000027
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                             0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                              0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                             00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                          0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                        00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                 000007fefd359055 3 bytes [B5, 6F, 29]
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiSetInternalUI                                                                                            000007fef6285cd0 6 bytes JMP 23f
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiInstallProductA                                                                                          000007fef6300f20 6 bytes {JMP QWORD [RIP+0x2cf110]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiInstallProductW                                                                                          000007fef630faa8 6 bytes JMP 0
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA                                                                                      000007fef7f67b34 6 bytes JMP 300030
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW                                                                                      000007fef7f703c0 6 bytes JMP 610048
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW                                                                                   000007feff283030 6 bytes {JMP QWORD [RIP+0x2dd000]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!connect + 1                                                                                              000007feff2845c1 5 bytes {JMP QWORD [RIP+0x28ba70]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!listen                                                                                                   000007feff288290 6 bytes {JMP QWORD [RIP+0x2b7da0]}
.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\RASAPI32.dll!RasDialW + 1                                                                                           000007fee8e296f5 5 bytes JMP 4d004d
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                    0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                       00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                     0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                    00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                               00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                        0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                        000007fefd359055 3 bytes [B5, 6F, 41]
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA                                                             000007fef7f67b34 6 bytes {JMP QWORD [RIP+0x884fc]}
.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW                                                             000007fef7f703c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                00000000773ffc20 3 bytes JMP 7181000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                            00000000773ffc24 2 bytes JMP 7181000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                   00000000773ffd64 3 bytes JMP 717b000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                               00000000773ffd68 2 bytes JMP 717b000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                 00000000774000b4 3 bytes JMP 717e000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                             00000000774000b8 2 bytes JMP 717e000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                00000000774001c4 3 bytes JMP 7187000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                            00000000774001c8 2 bytes JMP 7187000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                             0000000077400a44 3 bytes JMP 7184000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                         0000000077400a48 2 bytes JMP 7184000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                           0000000077401920 3 bytes JMP 7178000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                       0000000077401924 2 bytes JMP 7178000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                    00000000766c3bbb 3 bytes JMP 7175000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                00000000766c3bbf 2 bytes JMP 7175000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                    0000000076cf2c91 4 bytes CALL 71af0000
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendMessageW                                                0000000076ef9679 6 bytes JMP 7196000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!PostMessageW                                                0000000076f012a5 6 bytes JMP 7190000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!PostMessageA                                                0000000076f03baa 6 bytes JMP 7193000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendMessageA                                                0000000076f0612e 6 bytes JMP 7199000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendInput                                                   0000000076f1ff4a 3 bytes JMP 719c000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendInput + 4                                               0000000076f1ff4e 2 bytes JMP 719c000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!mouse_event                                                 0000000076f5027b 6 bytes JMP 71a2000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!keybd_event                                                 0000000076f502bf 6 bytes JMP 719f000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                            0000000076ae70c4 6 bytes JMP 718a000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                            0000000076b03264 6 bytes JMP 718d000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW                                      000000007685575a 6 bytes JMP 71a5000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!connect                                                     0000000076856bdd 6 bytes JMP 71ab000a
.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!listen                                                      000000007685b001 6 bytes JMP 71a8000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                  00000000773ffc20 3 bytes JMP 718a000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4              00000000773ffc24 2 bytes JMP 718a000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                     00000000773ffd64 3 bytes JMP 7184000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                 00000000773ffd68 2 bytes JMP 7184000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                   00000000774000b4 3 bytes JMP 7187000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4               00000000774000b8 2 bytes JMP 7187000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                  00000000774001c4 3 bytes JMP 7190000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4              00000000774001c8 2 bytes JMP 7190000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey               0000000077400a44 3 bytes JMP 718d000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4           0000000077400a48 2 bytes JMP 718d000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread             0000000077401920 3 bytes JMP 7181000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4         0000000077401924 2 bytes JMP 7181000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW      00000000766c3bbb 3 bytes JMP 717e000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4  00000000766c3bbf 2 bytes JMP 717e000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493      0000000076cf2c91 4 bytes CALL 71af0000
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendMessageW                  0000000076ef9679 6 bytes JMP 719f000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!PostMessageW                  0000000076f012a5 6 bytes JMP 7199000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!PostMessageA                  0000000076f03baa 6 bytes JMP 719c000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendMessageA                  0000000076f0612e 6 bytes JMP 71a2000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendInput                     0000000076f1ff4a 3 bytes JMP 71a5000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendInput + 4                 0000000076f1ff4e 2 bytes JMP 71a5000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!mouse_event                   0000000076f5027b 6 bytes JMP 71ab000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!keybd_event                   0000000076f502bf 6 bytes JMP 71a8000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW              0000000076ae70c4 6 bytes JMP 7193000a
.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA              0000000076b03264 6 bytes JMP 7196000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                        00000000773ffc20 3 bytes JMP 718a000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                    00000000773ffc24 2 bytes JMP 718a000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                           00000000773ffd64 3 bytes JMP 7184000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                       00000000773ffd68 2 bytes JMP 7184000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                         00000000774000b4 3 bytes JMP 7187000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                     00000000774000b8 2 bytes JMP 7187000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                        00000000774001c4 3 bytes JMP 7190000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                    00000000774001c8 2 bytes JMP 7190000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                     0000000077400a44 3 bytes JMP 718d000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                 0000000077400a48 2 bytes JMP 718d000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                   0000000077401920 3 bytes JMP 7181000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                               0000000077401924 2 bytes JMP 7181000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                            00000000766c3bbb 3 bytes JMP 717e000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                        00000000766c3bbf 2 bytes JMP 717e000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                            0000000076cf2c91 4 bytes CALL 71af0000
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                        0000000076ef9679 6 bytes JMP 719f000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                        0000000076f012a5 6 bytes JMP 7199000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                        0000000076f03baa 6 bytes JMP 719c000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                        0000000076f0612e 6 bytes JMP 71a2000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendInput                                                                           0000000076f1ff4a 3 bytes JMP 71a5000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                       0000000076f1ff4e 2 bytes JMP 71a5000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!mouse_event                                                                         0000000076f5027b 6 bytes JMP 71ab000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!keybd_event                                                                         0000000076f502bf 6 bytes JMP 71a8000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                    0000000076ae70c4 6 bytes JMP 7193000a
.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                    0000000076b03264 6 bytes JMP 7196000a
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                              00000000773ffc20 3 bytes [FF, 25, 1E]
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                          00000000773ffc24 2 bytes [89, 71]
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                 00000000773ffd64 3 bytes JMP 7184000a
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                             00000000773ffd68 2 bytes JMP 7184000a
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                               00000000774000b4 3 bytes JMP 7187000a
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                           00000000774000b8 2 bytes JMP 7187000a
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                              00000000774001c4 3 bytes [FF, 25, 1E]
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                          00000000774001c8 2 bytes [8F, 71]
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                           0000000077400a44 3 bytes [FF, 25, 1E]
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                       0000000077400a48 2 bytes [8C, 71]
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                         0000000077401920 3 bytes [FF, 25, 1E]
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                     0000000077401924 2 bytes [80, 71]
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                  00000000766c3bbb 3 bytes JMP 717e000a
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                              00000000766c3bbf 2 bytes JMP 717e000a
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                  0000000076cf2c91 4 bytes CALL 71af0000
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                     00000000773ffc20 3 bytes JMP 7184000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                 00000000773ffc24 2 bytes JMP 7184000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                        00000000773ffd64 3 bytes JMP 717e000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                    00000000773ffd68 2 bytes JMP 717e000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                      00000000774000b4 3 bytes JMP 7181000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                  00000000774000b8 2 bytes JMP 7181000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                     00000000774001c4 3 bytes JMP 718a000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                 00000000774001c8 2 bytes JMP 718a000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                  0000000077400a44 3 bytes JMP 7187000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                              0000000077400a48 2 bytes JMP 7187000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                0000000077401920 3 bytes JMP 717b000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                            0000000077401924 2 bytes JMP 717b000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                         00000000766c3bbb 3 bytes JMP 7178000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                     00000000766c3bbf 2 bytes JMP 7178000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                         0000000076cf2c91 4 bytes CALL 71af0000
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                     0000000076ef9679 6 bytes JMP 7199000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                     0000000076f012a5 6 bytes JMP 7193000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                     0000000076f03baa 6 bytes JMP 7196000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                     0000000076f0612e 6 bytes JMP 719c000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendInput                                                                        0000000076f1ff4a 3 bytes JMP 719f000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                    0000000076f1ff4e 2 bytes JMP 719f000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!mouse_event                                                                      0000000076f5027b 6 bytes JMP 71a5000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!keybd_event                                                                      0000000076f502bf 6 bytes JMP 71a2000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                 0000000076ae70c4 6 bytes JMP 718d000a
.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                 0000000076b03264 6 bytes JMP 7190000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                 00000000773ffc20 3 bytes JMP 7184000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                             00000000773ffc24 2 bytes JMP 7184000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                    00000000773ffd64 3 bytes JMP 717e000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                00000000773ffd68 2 bytes JMP 717e000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                  00000000774000b4 3 bytes JMP 7181000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                              00000000774000b8 2 bytes JMP 7181000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                 00000000774001c4 3 bytes JMP 718a000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                             00000000774001c8 2 bytes JMP 718a000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                              0000000077400a44 3 bytes JMP 7187000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                          0000000077400a48 2 bytes JMP 7187000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                            0000000077401920 3 bytes JMP 717b000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                        0000000077401924 2 bytes JMP 717b000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                     00000000766c3bbb 3 bytes JMP 7178000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                 00000000766c3bbf 2 bytes JMP 7178000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                     0000000076cf2c91 4 bytes CALL 71af0000
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                 0000000076ef9679 6 bytes JMP 7199000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                 0000000076f012a5 6 bytes JMP 7193000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                 0000000076f03baa 6 bytes JMP 7196000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                 0000000076f0612e 6 bytes JMP 719c000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendInput                                                                    0000000076f1ff4a 3 bytes JMP 719f000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                0000000076f1ff4e 2 bytes JMP 719f000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!mouse_event                                                                  0000000076f5027b 6 bytes JMP 71a5000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!keybd_event                                                                  0000000076f502bf 6 bytes JMP 71a2000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                             0000000076ae70c4 6 bytes JMP 718d000a
.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                             0000000076b03264 6 bytes JMP 7190000a
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                    00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                  0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                              0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                     000007fefd359055 3 bytes [B5, 6F, 06]
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                    00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                  0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                              0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                     000007fefd359055 3 bytes [B5, 6F, 06]
.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                     0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                        00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                      0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                     00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                  0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                         0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                         000007fefd359055 3 bytes CALL 9000027
.text   C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4648] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                           00000000765c1465 2 bytes [5C, 76]
.text   C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4648] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                          00000000765c14bb 2 bytes [5C, 76]
.text   ...                                                                                                                                                                   * 2
.text   C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6076] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                          00000000765c1465 2 bytes [5C, 76]
.text   C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6076] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                         00000000765c14bb 2 bytes [5C, 76]
.text   ...                                                                                                                                                                   * 2

---- Threads - GMER 2.1 ----

Thread  C:\Windows\System32\svchost.exe [5572:7688]                                                                                                                           000007feec939688

---- EOF - GMER 2.1 ----
         

Alt 21.04.2014, 19:10   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



hi,

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________

__________________

Alt 21.04.2014, 21:04   #3
Kerrigan
 
Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Hallo,

danke für die schnelle Antwort! Hier ist der gewünschte Scan. Combofix hat gemeckert das Spybot noch an wäre obwohl ich alles deaktiviert hatte. Das Ergebnis des Scans sah so aus:

Code:
ATTFilter
ComboFix 14-04-20.01 - Username 21.04.2014  21:52:01.1.6 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8174.6461 [GMT 2:00]
ausgeführt von:: c:\users\Username\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-03-21 bis 2014-04-21  ))))))))))))))))))))))))))))))
.
.
2014-04-21 19:56 . 2014-04-21 19:56	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-04-21 13:02 . 2014-04-21 13:23	--------	d-----w-	C:\Scans
2014-04-21 11:27 . 2013-09-20 08:49	21040	----a-w-	c:\windows\system32\sdnclean64.exe
2014-04-21 11:27 . 2014-04-21 11:32	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2014-04-21 11:27 . 2014-04-21 11:33	--------	d-----w-	c:\program files (x86)\Spybot - Search & Destroy 2
2014-04-21 10:50 . 2014-04-14 18:13	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-18 15:55 . 2014-04-17 03:31	10651704	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D3B4B546-8EB5-45BF-B854-5815069D28B0}\mpengine.dll
2014-04-16 14:03 . 2014-04-16 14:06	--------	d-----w-	c:\windows\system32\appmgmt
2014-04-12 15:16 . 2014-04-13 20:07	--------	d-----w-	c:\users\Username\AppData\Roaming\TS3Client
2014-04-12 15:16 . 2014-04-12 15:16	--------	d-----w-	c:\program files\TeamSpeak 3 Client
2014-04-09 17:03 . 2014-03-31 01:16	23134208	----a-w-	c:\windows\system32\mshtml.dll
2014-04-09 17:03 . 2014-03-31 01:13	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-04-09 17:03 . 2014-03-31 00:13	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2014-04-09 16:30 . 2014-04-21 13:00	--------	d-----w-	C:\FRST
2014-04-02 22:03 . 2014-04-21 15:17	--------	d-----w-	c:\program files (x86)\Emsisoft Anti-Malware
2014-03-28 00:05 . 2014-03-28 00:05	--------	d-----w-	c:\program files (x86)\MSXML 4.0
2014-03-27 12:13 . 2014-04-20 19:41	119512	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-03-27 12:13 . 2014-03-27 12:13	--------	d-----w-	c:\programdata\Malwarebytes
2014-03-27 12:08 . 2014-03-27 12:08	--------	d-----w-	c:\users\Username\AppData\Local\Programs
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-03 15:55 . 2013-10-14 12:04	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-03 15:55 . 2013-10-14 12:04	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-31 07:35 . 2010-11-21 03:27	270496	------w-	c:\windows\system32\MpSigStub.exe
2014-03-04 09:17 . 2014-04-09 16:59	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2014-03-01 05:16 . 2014-03-13 17:51	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-03-01 04:58 . 2014-03-13 17:51	2765824	----a-w-	c:\windows\system32\iertutil.dll
2014-03-01 04:52 . 2014-03-13 17:51	66048	----a-w-	c:\windows\system32\iesetup.dll
2014-03-01 04:51 . 2014-03-13 17:51	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2014-03-01 04:42 . 2014-03-13 17:51	53760	----a-w-	c:\windows\system32\jsproxy.dll
2014-03-01 04:40 . 2014-03-13 17:51	33792	----a-w-	c:\windows\system32\iernonce.dll
2014-03-01 04:37 . 2014-03-13 17:51	574976	----a-w-	c:\windows\system32\ieui.dll
2014-03-01 04:33 . 2014-03-13 17:51	139264	----a-w-	c:\windows\system32\ieUnatt.exe
2014-03-01 04:33 . 2014-03-13 17:51	111616	----a-w-	c:\windows\system32\ieetwcollector.exe
2014-03-01 04:32 . 2014-03-13 17:51	708608	----a-w-	c:\windows\system32\jscript9diag.dll
2014-03-01 04:23 . 2014-03-13 17:51	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-01 04:17 . 2014-03-13 17:51	218624	----a-w-	c:\windows\system32\ie4uinit.exe
2014-03-01 04:02 . 2014-03-13 17:51	195584	----a-w-	c:\windows\system32\msrating.dll
2014-03-01 03:54 . 2014-03-13 17:51	5768704	----a-w-	c:\windows\system32\jscript9.dll
2014-03-01 03:52 . 2014-03-13 17:51	61952	----a-w-	c:\windows\SysWow64\iesetup.dll
2014-03-01 03:51 . 2014-03-13 17:51	51200	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2014-03-01 03:42 . 2014-03-13 17:51	627200	----a-w-	c:\windows\system32\msfeeds.dll
2014-03-01 03:38 . 2014-03-13 17:51	112128	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2014-03-01 03:37 . 2014-03-13 17:51	553472	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2014-03-01 03:35 . 2014-03-13 17:51	2041856	----a-w-	c:\windows\system32\inetcpl.cpl
2014-03-01 03:18 . 2014-03-13 17:51	13051904	----a-w-	c:\windows\system32\ieframe.dll
2014-03-01 03:14 . 2014-03-13 17:51	4244480	----a-w-	c:\windows\SysWow64\jscript9.dll
2014-03-01 03:10 . 2014-03-13 17:51	2334208	----a-w-	c:\windows\system32\wininet.dll
2014-03-01 03:00 . 2014-03-13 17:51	1964032	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2014-03-01 02:38 . 2014-03-13 17:51	1393664	----a-w-	c:\windows\system32\urlmon.dll
2014-03-01 02:32 . 2014-03-13 17:51	1820160	----a-w-	c:\windows\SysWow64\wininet.dll
2014-03-01 02:25 . 2014-03-13 17:51	817664	----a-w-	c:\windows\system32\ieapfltr.dll
2014-02-07 01:23 . 2014-03-13 17:51	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-02-04 02:32 . 2014-03-13 17:43	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-02-04 02:32 . 2014-03-13 17:43	624128	----a-w-	c:\windows\system32\qedit.dll
2014-02-04 02:04 . 2014-03-13 17:43	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-02-04 02:04 . 2014-03-13 17:43	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2014-01-29 02:32 . 2014-03-13 17:46	484864	----a-w-	c:\windows\system32\wer.dll
2014-01-29 02:06 . 2014-03-13 17:46	381440	----a-w-	c:\windows\SysWow64\wer.dll
2014-01-28 02:32 . 2014-03-13 17:47	228864	----a-w-	c:\windows\system32\wwansvc.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify"="c:\users\Username\AppData\Roaming\Spotify\Spotify.exe" [2014-04-09 6087224]
"Spotify Web Helper"="c:\users\Username\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-04-09 1171000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe" [2011-09-20 115048]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-15 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"Turbo Key"="c:\program files\ASUS\Turbo Key\TurboKey.exe" [2009-11-24 1874432]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-20 689744]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-08-30 766208]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Gaming mouse"="c:\program files (x86)\Gaming Mouse\Monitor.exe" [2013-07-17 761856]
"GamingKeyboard"="c:\program files (x86)\SHARKOON Skiller\GameMon.exe" [2012-06-07 1803264]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-07-25 5624784]
.
c:\users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2013-10-9 0]
Trillian.lnk - c:\program files (x86)\Trillian\trillian.exe [2013-6-13 2606448]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys;c:\windows\SYSNATIVE\DRIVERS\sbapifs.sys [x]
R3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 GameKB;SHARKOON Skiller;c:\windows\system32\drivers\GameKB.sys;c:\windows\SYSNATIVE\drivers\GameKB.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192cu.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192cu.sys [x]
S3 rusb3hub;Renesas Electronics USB 3.0 Hub Driver (Version 3.0);c:\windows\system32\DRIVERS\rusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\rusb3hub.sys [x]
S3 rusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver (Version 3.0);c:\windows\system32\DRIVERS\rusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\rusb3xhc.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-04-09 16:21	1077576	----a-w-	c:\program files (x86)\Google\Chrome\Application\34.0.1847.116\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-14 15:55]
.
2014-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-10-08 19:40]
.
2014-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-10-08 19:40]
.
2014-04-21 c:\windows\Tasks\RtlNICDiagVistaStart.job
- c:\program files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe [2013-10-08 10:16]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-12 7560296]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 121.157.39.117 114.114.114.114
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Notify-SDWinLogon - SDWinLogon.dll
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-04-21  21:57:56
ComboFix-quarantined-files.txt  2014-04-21 19:57
.
Vor Suchlauf: 14 Verzeichnis(se), 854.355.116.032 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 853.954.068.480 Bytes frei
.
- - End Of File - - 732D0B7875C0492AEFEC59F5EB02965C
A36C5E4F47E84449FF07ED3517B43A31
         
__________________

Alt 22.04.2014, 13:50   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 22.04.2014, 15:26   #5
Kerrigan
 
Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Hallo

Hier die gewünschten Scans. Ich habe mich genau an deine Anleitung gehalten. Problem leider noch vorhanden. Chrome konnte mein Userprofil nicht mehr herstellen, alle Seiten waren weg. Als ich das Board hier neu öffnete ging das Spiel mit der nervigen Werbung direkt von vorne los!

Malwarebytes Scan

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 22.04.2014
Suchlauf-Zeit: 15:16:12
Logdatei: AMBScan.txt
Administrator: Ja

Version: 2.00.1.1004
Malware Datenbank: v2014.04.22.03
Rootkit Datenbank: v2014.03.27.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: User1

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 253490
Verstrichene Zeit: 8 Min, 43 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
         
AdwCleaner Scan

Code:
ATTFilter
# AdwCleaner v3.200 - Bericht erstellt am 22/04/2014 um 15:54:51
# Aktualisiert 22/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : User1 - User1-PC-NE
# Gestartet von : C:\Users\User1\Desktop\adwcleaner (1).exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updatewhilokii_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updatewhilokii_rasmancs
Schlüssel Gelöscht : HKCU\Software\OCS

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16521


-\\ Google Chrome v34.0.1847.116

[ Datei : C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Extension] : aipfmkinhleccnodemkoofnnofpbbpac
Gelöscht [Extension] : ieadcoanfjloocmfafkebdnfefmohngj
Gelöscht [Extension] : ifohbjbgfchkkfhphahclmkpgejiplfo
Gelöscht [Extension] : igdhbblpcellaljokkpfhcjlagemhgjl

*************************

AdwCleaner[R0].txt - [11762 octets] - [10/10/2013 01:00:21]
AdwCleaner[R1].txt - [30074 octets] - [26/03/2014 01:32:39]
AdwCleaner[R2].txt - [1301 octets] - [26/03/2014 01:45:59]
AdwCleaner[R3].txt - [1181 octets] - [09/04/2014 18:46:22]
AdwCleaner[R4].txt - [1774 octets] - [22/04/2014 15:51:25]
AdwCleaner[S0].txt - [8969 octets] - [10/10/2013 01:01:06]
AdwCleaner[S1].txt - [29951 octets] - [26/03/2014 01:33:32]
AdwCleaner[S2].txt - [1318 octets] - [26/03/2014 01:49:12]
AdwCleaner[S3].txt - [1243 octets] - [09/04/2014 18:47:47]
AdwCleaner[S4].txt - [1649 octets] - [22/04/2014 15:54:51]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1709 octets] ##########
         
Junkware Removal Tool Scan

Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by User1 on 22.04.2014 at 15:58:44,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-196019333-3621520618-2838316431-1000\Software\sweetim



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.04.2014 at 16:03:34,02
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
Und zu guter letzt ein frischer FRST Scan


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2014
Ran by User1 (administrator) on User1-PC-NE on 22-04-2014 16:16:25
Running from C:\Users\User1\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Gaming Mouse\Monitor.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()
HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114

FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

Chrome: 
=======
CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-09]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-22 16:16 - 2014-04-22 16:16 - 00010909 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:50 - 2014-04-22 15:50 - 00001155 _____ () C:\AMBScan.txt
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox
2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:02 - 2014-04-22 16:08 - 00000000 ____D () C:\Scans
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 12:50 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-21 12:50 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-21 12:50 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-09 19:03 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 19:03 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:30 - 2014-04-22 16:16 - 00000000 ____D () C:\FRST
2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 00:03 - 2014-04-21 17:17 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-04-22 15:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995 (1).zip
2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995.zip

==================== One Month Modified Files and Folders =======

2014-04-22 16:16 - 2014-04-22 16:16 - 00010909 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-22 16:16 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST
2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-22 16:10 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify
2014-04-22 16:10 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job
2014-04-22 16:09 - 2013-10-08 21:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-22 16:09 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-22 16:09 - 2009-07-14 06:51 - 00037278 _____ () C:\Windows\setupact.log
2014-04-22 16:08 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans
2014-04-22 16:08 - 2013-10-08 19:57 - 01222240 _____ () C:\Windows\WindowsUpdate.log
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 16:03 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-22 16:03 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:56 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify
2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner
2014-04-22 15:50 - 2014-04-22 15:50 - 00001155 _____ () C:\AMBScan.txt
2014-04-22 15:20 - 2013-10-08 21:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-22 14:54 - 2010-11-21 05:47 - 00283524 _____ () C:\Windows\PFRO.log
2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox
2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1
2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk
2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-21 12:50 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-20 23:18 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net
2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-16 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 16:01 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-21 12:50 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-21 12:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-21 12:50 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-09 18:24 - 2013-10-08 21:41 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-03 09:51 - 2014-04-22 15:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-22 15:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-22 15:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-04-01 18:15 - 2013-10-08 21:40 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-01 18:15 - 2013-10-08 21:40 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-31 03:16 - 2014-04-09 19:03 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-09 19:03 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995 (1).zip
2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995.zip

Some content of TEMP:
====================
C:\Users\User1\AppData\Local\Temp\avgnt.exe
C:\Users\User1\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-21 14:43

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Alt 22.04.2014, 19:20   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de





ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
--> Webseiten werden auf Werbung umgeleitet

Alt 23.04.2014, 20:01   #7
Kerrigan
 
Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Hallo

Hier die gewünschten Scans:

ESET Scan

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1e8bdc2a473bfb4f8784f3bf236e0012
# engine=17988
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-23 02:10:42
# local_time=2014-04-23 04:10:42 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 10205 16926675 2970 0
# compatibility_mode=5893 16776573 100 94 8814 149892092 0 0
# scanned=293199
# found=0
# cleaned=0
# scan_time=8199
         
SecurityCheck Scan

Code:
ATTFilter
 Results of screen317's Security Check version 0.99.82  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Spybot - Search & Destroy 
 Java 7 Update 45  
 Java 7 Update 55  
 Google Chrome 34.0.1847.116  
````````Process Check: objlist.exe by Laurent````````  
 Spybot Teatimer.exe is disabled! 
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

Und zum Schluss ein frischer FRST Scan


FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2014
Ran by User1 (administrator) on User1-PC-NE on 23-04-2014 18:00:28
Running from C:\Users\User1\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Gaming Mouse\Monitor.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()
HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil64_12_0_0_77_ActiveX.exe [531848 2014-04-03] (Adobe Systems Incorporated)
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114

FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]
CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]
CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]
CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]
CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]
CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-23 13:49 - 2014-04-23 18:00 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-23 13:49 - 2014-04-23 14:00 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-23 13:49 - 2014-04-23 13:55 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-23 13:49 - 2014-04-23 13:55 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList
2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe
2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk
2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe
2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm
2014-04-23 00:43 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-23 00:43 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-23 00:43 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-23 00:43 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-22 16:16 - 2014-04-23 18:00 - 00011794 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox
2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:02 - 2014-04-23 18:00 - 00000000 ____D () C:\Scans
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:30 - 2014-04-23 18:00 - 00000000 ____D () C:\FRST
2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 00:03 - 2014-04-21 17:17 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-04-22 15:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe

==================== One Month Modified Files and Folders =======

2014-04-23 18:00 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-23 18:00 - 2014-04-22 16:16 - 00011794 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-23 18:00 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans
2014-04-23 18:00 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST
2014-04-23 17:46 - 2013-10-08 19:57 - 01274774 _____ () C:\Windows\WindowsUpdate.log
2014-04-23 17:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-23 14:00 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-23 13:55 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-23 13:55 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-23 13:52 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-23 13:52 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google
2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-23 13:45 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify
2014-04-23 13:45 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job
2014-04-23 13:44 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-23 13:44 - 2009-07-14 06:51 - 00037390 _____ () C:\Windows\setupact.log
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList
2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe
2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk
2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe
2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm
2014-04-23 13:19 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify
2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-23 00:41 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net
2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner
2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-22 14:54 - 2010-11-21 05:47 - 00283524 _____ () C:\Windows\PFRO.log
2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox
2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1
2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk
2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-03 09:51 - 2014-04-22 15:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-22 15:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-22 15:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe

Some content of TEMP:
====================
C:\Users\User1\AppData\Local\Temp\avgnt.exe
C:\Users\User1\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-21 14:43

==================== End Of Log ============================
         
--- --- ---

--- --- ---

--- --- ---

--- --- ---


Bisher sind keinerlei Probleme mehr zu sehen in meinem Chrome! Ich kann endlich wieder Links anklicken ohne Gedudel und Koreanische Werbung! EIN TRAUM! Vielen vielen Dank dafür.

Hast du eventuell noch ein paar Tips wie ich in Zukunft verhindern kann mir so einen Mist nochmal einzufangen?

Vielen Dank und viele Grüße

Kerrigan

Hallo,

sorry das ich einen neuen Beitrag erstelle. Ich konnte den anderen nicht mehr editieren. Leider ist das Problem wieder da! Es ging als ich den Browser neu gemacht hatte ohne Probleme das Board hier aufzurufen. Dann rief ich die Seite Base.de auf um mir dort ein Handy anzuschauen und beim Klicken auf Handys kam die Koreanische Werbung samt Sound in einem extra Tab wieder. Und seit dem geht es auch hier im Board wieder los das ich keinen Link ohne nervige extra Werbung klicken kann. *verzweifel*

Alt 24.04.2014, 12:01   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Öffne mal bitte FRST, setz nen Haken bei Additional und scanne, poste bitte beide Logfiles.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 24.04.2014, 17:03   #9
Kerrigan
 
Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Huhu,

hier sind die gewünschten Scans!

Scan1


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014
Ran by User1 (administrator) on User1-PC-NE on 24-04-2014 17:58:11
Running from C:\Users\User1\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(AMD) C:\Windows\system32\atieclxx.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files (x86)\Gaming Mouse\Monitor.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()
HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114

FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]
CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]
CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]
CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]
CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]
CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]

==================== Drivers (Whitelisted) ====================

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-24 17:58 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion
2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe
2014-04-23 13:49 - 2014-04-24 17:55 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-23 13:49 - 2014-04-24 00:00 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-23 13:49 - 2014-04-23 13:55 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-23 13:49 - 2014-04-23 13:55 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList
2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe
2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk
2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe
2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm
2014-04-23 00:43 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-23 00:43 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-23 00:43 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-23 00:43 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-22 16:16 - 2014-04-24 17:58 - 00011646 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-22 16:15 - 2014-04-24 17:58 - 02061824 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox
2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:02 - 2014-04-23 18:04 - 00000000 ____D () C:\Scans
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:30 - 2014-04-24 17:58 - 00000000 ____D () C:\FRST
2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 00:03 - 2014-04-21 17:17 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-04-22 15:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe

==================== One Month Modified Files and Folders =======

2014-04-24 17:58 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion
2014-04-24 17:58 - 2014-04-22 16:16 - 00011646 _____ () C:\Users\User1\Desktop\FRST.txt
2014-04-24 17:58 - 2014-04-22 16:15 - 02061824 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe
2014-04-24 17:58 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST
2014-04-24 17:58 - 2013-10-08 19:57 - 01289582 _____ () C:\Windows\WindowsUpdate.log
2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe
2014-04-24 17:57 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-24 17:57 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-24 17:56 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify
2014-04-24 17:55 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-24 17:55 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job
2014-04-24 17:53 - 2010-11-21 05:47 - 00284572 _____ () C:\Windows\PFRO.log
2014-04-24 17:53 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-24 17:53 - 2009-07-14 06:51 - 00037446 _____ () C:\Windows\setupact.log
2014-04-24 00:00 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-23 23:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-23 18:04 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans
2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-23 13:55 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-23 13:55 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google
2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList
2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList
2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe
2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk
2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe
2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe
2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm
2014-04-23 13:19 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify
2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-23 00:41 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net
2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm
2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt
2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner
2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe
2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0
2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt
2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox
2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt
2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk
2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe
2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp
2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP
2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk
2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe
2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log
2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable
2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1
2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe
2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip
2014-04-21 13:06 - 2013-10-09 17:30 - 00001110 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk
2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk
2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip
2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe
2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-03 09:51 - 2014-04-22 15:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-22 15:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-22 15:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe

Some content of TEMP:
====================
C:\Users\User1\AppData\Local\Temp\avgnt.exe
C:\Users\User1\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-21 14:43

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Scan 2

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-04-2014
Ran by User1 at 2014-04-24 17:59:23
Running from C:\Users\User1\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader X MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)
AI Suite (HKLM-x32\...\{310BC5E2-31AF-49BB-904D-E71EB93645DC}) (Version: 1.06.22 - )
AMD Accelerated Video Transcoding (Version: 13.15.100.30830 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{1E9871B6-7C44-9A3A-A1C0-F9729663C7F5}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.80830.1925 - Advanced Micro Devices, Inc.) Hidden
ASUSUpdate (HKLM-x32\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 7.18.03 - ASUSTeK Computer Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden
Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.792 - Curse)
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.02.01 - )
Gaming mouse Driver (HKLM-x32\...\{F1A273BD-6A9E-41D8-A111-5E56ACD286F8}) (Version: 1.0 - Togran)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2 (HKLM-x32\...\Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2) (Version:  - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045F0}) (Version: 7.0.450 - Oracle)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PC Probe II (HKLM-x32\...\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}) (Version: 1.04.92 - ASUSTeK Computer Inc.)
RAIDXpert (HKLM-x32\...\InstallShield_{8B76B8E9-F773-4B75-A08C-120079EB765E}) (Version: 3.2.1540.10 - AMD)
RAIDXpert (x32 Version: 3.2.1540.10 - AMD) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.52.203.2012 - Realtek)
Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SHARKOON Skiller (HKLM-x32\...\{91C25547-9534-41A5-823A-1E54BA16EA3F}) (Version: 1.00.0000 - )
Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
StarCraft (HKLM-x32\...\StarCraft) (Version:  - Blizzard Entertainment)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer)
Trillian (HKLM-x32\...\Trillian) (Version:  - Cerulean Studios, LLC)
Turbo Key (HKLM-x32\...\{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}) (Version: 1.01.03 - )
WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)

==================== Restore Points  =========================

21-04-2014 10:49:10 Installed Java 7 Update 55
22-04-2014 13:00:33 Windows Update
22-04-2014 22:42:43 Windows Update
23-04-2014 11:38:19 Revo Uninstaller's restore point - Google Chrome
23-04-2014 11:47:22 Installed Java 7 Update 45

==================== Hosts content: ==========================

2009-07-14 04:34 - 2014-03-27 13:55 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {17AE2781-DC90-409D-844F-7505972C986D} - System32\Tasks\{B5B1AE0E-3C4C-4AD9-8669-91E4FF7D9AE7} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {1A00D3E0-B7C3-4A4D-82F2-E64CFE95E5CA} - System32\Tasks\ASUS\ASUS Update Checker => C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-28] (ASUSTeK Computer Inc.)
Task: {2B36B741-9E17-40FC-80DC-12A4CE3735F6} - \UpdaterEX No Task File <==== ATTENTION
Task: {2B85E513-10C2-4F23-B5C0-02C37189F04F} - \BonanzaDealsLiveUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {2FE213FF-1F17-4CBA-AD8E-8FF6E5743111} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-03] (Adobe Systems Incorporated)
Task: {33F91DDD-7080-4E4E-A262-923E41365D8C} - System32\Tasks\RtlNICDiagVistaStart => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe [2011-11-16] (Realtek Semiconductor Corporation.)
Task: {398A692E-F869-4D02-9049-FDC6274CFE5F} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)
Task: {4ABAA26D-889D-4B96-97AA-46AEB8C145C2} - System32\Tasks\{415876D4-2516-46E8-9E35-A397A136CFD5} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {4C3E5020-47BB-437B-BADF-F49A8531515E} - System32\Tasks\{2078D8B4-E896-44F1-8BBC-6CCB8A701A19} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {5C78006B-CFF9-440F-B2B2-314755DE0BC5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)
Task: {7BF2CEF6-25DB-497A-AFD6-7FB0C7BD3997} - System32\Tasks\{2DA44194-053F-4631-A9F3-3DA0216DDF84} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {83815CB9-F200-43DD-982F-8DC23A2B38CB} - \BitGuard No Task File <==== ATTENTION
Task: {8F5A1D53-5645-4D99-86B7-47A0CB71057D} - \BonanzaDealsUpdate No Task File <==== ATTENTION
Task: {AAEB89A6-F600-4874-A562-7EC045EAC8D5} - \EPUpdater No Task File <==== ATTENTION
Task: {ADF24FC4-A0B7-45D3-93BA-9DAC484C82C6} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {AE4D9D36-14FC-494D-BA95-37E50E0B340E} - \BonanzaDealsLiveUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {B38E72B5-EF1C-4D7E-9E27-515874A16FD7} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.12\AsLoader.exe [2010-01-14] (ASUSTeK Computer Inc.)
Task: {C1E9ADA0-5DCA-4968-A3A7-684D26A19C9A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)
Task: {CCB68486-F473-4770-A71D-50EEA4558A31} - System32\Tasks\ASUS\Cpu Level Up Hook Lanunch => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHookLaunch.exe [2009-12-28] ()
Task: {CDA3F082-82A9-46B4-B38C-6B963E504691} - System32\Tasks\{43EA236D-C510-4A42-9726-86138A33EA20} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {DBB33BD9-114C-4DD4-82D7-DE1AF5F88CC4} - System32\Tasks\{98B32694-0566-4AC3-9644-A7CD534B12BD} => C:\StarCraft1\StarCraft\StarCraft.exe
Task: {EC05ADE8-4BA1-45A3-97CA-8DC8A51F72CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {EFCB4FEE-9CF2-4B10-9C33-347CAD02CE64} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\RtlNICDiagVistaStart.job => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe

==================== Loaded Modules (whitelisted) =============

2013-08-30 19:47 - 2013-08-30 19:47 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2012-10-22 14:41 - 2012-10-22 14:41 - 00749056 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2012-10-22 14:42 - 2012-10-22 14:42 - 03645952 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2013-08-30 19:47 - 2013-08-30 19:47 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2009-12-15 17:40 - 2009-12-15 17:40 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
2009-12-15 17:40 - 2009-12-15 17:40 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe
2009-12-15 17:41 - 2009-12-15 17:41 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe
2013-12-13 14:46 - 2013-07-17 15:02 - 00761856 _____ () C:\Program Files (x86)\Gaming Mouse\Monitor.exe
2013-08-30 19:47 - 2013-08-30 19:47 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-10-09 18:22 - 2013-10-09 18:20 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2009-12-15 23:44 - 2009-12-15 23:44 - 00516096 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\libxml2.dll
2014-04-21 13:27 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-04-21 13:27 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-04-21 13:27 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-04-21 13:27 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-04-21 13:27 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-10-08 21:42 - 2009-03-19 22:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll
2013-10-08 21:42 - 2009-03-19 22:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll
2013-10-08 21:42 - 2009-01-15 14:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
2013-10-08 21:42 - 2009-03-25 16:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
2013-10-08 22:23 - 2009-04-29 14:24 - 00253952 _____ () C:\Program Files\ASUS\Turbo Key\pngio.dll
2013-10-08 22:23 - 2009-04-29 14:24 - 00208896 _____ () C:\Program Files\ASUS\Turbo Key\AiNap.dll
2013-10-08 22:23 - 2009-04-29 14:24 - 00008704 _____ () C:\Program Files\ASUS\Turbo Key\vvc.dll
2013-12-13 14:46 - 2013-05-21 11:40 - 00057344 _____ () C:\Program Files (x86)\Gaming Mouse\lan.dll
2013-12-13 14:46 - 2013-01-17 11:04 - 00061440 _____ () C:\Program Files (x86)\Gaming Mouse\hiddriver.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/24/2014 05:53:37 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/23/2014 05:53:01 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/23/2014 04:41:43 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/23/2014 01:50:38 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/23/2014 01:50:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/23/2014 01:50:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/23/2014 01:44:49 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/23/2014 01:37:13 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/23/2014 01:15:24 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/22/2014 04:09:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (04/24/2014 05:53:29 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/24/2014 05:53:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/24/2014 00:12:08 AM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (04/23/2014 01:44:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/23/2014 01:44:40 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/23/2014 01:15:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/23/2014 01:15:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/23/2014 00:42:36 AM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (04/22/2014 04:09:40 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/22/2014 04:09:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (04/24/2014 05:53:37 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/23/2014 05:53:01 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (04/23/2014 04:41:43 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe

Error: (04/23/2014 01:50:38 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe

Error: (04/23/2014 01:50:35 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe

Error: (04/23/2014 01:50:35 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe

Error: (04/23/2014 01:44:49 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/23/2014 01:37:13 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe

Error: (04/23/2014 01:15:24 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/22/2014 04:09:45 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 25%
Total physical RAM: 8174.12 MB
Available physical RAM: 6048.97 MB
Total Pagefile: 16346.41 MB
Available Pagefile: 14089.61 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:797.26 GB) NTFS
Drive d: (Englisch12) (CDROM) (Total:0.32 GB) (Free:0 GB) CDFS
Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: DB55773B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Alt 25.04.2014, 09:40   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Zitat:
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
Die beiden Dateien bitte mal bei www.virustotal.com scannen lassen, Link zum Ergebnis hier posten, ebenso Info wieviele der 51 scanner was gefunden haben.

Verbindest Du Chrome mit einem Google Konto?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 25.04.2014, 12:34   #11
Kerrigan
 
Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Hallo,

ich habe beide Dateien scannen lassen. Bei beiden wurden 0 / 51 gefunden.

Ich verbinde Chrome nicht mit einem Google Konto. Könnte das ein Problem sein?

Alt 26.04.2014, 08:12   #12
schrauber
/// the machine
/// TB-Ausbilder
 

Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Wenn du verbinden würdest dann ja. Nutzt Du einen Adblocker als Addon in Chrome?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 26.04.2014, 15:03   #13
Kerrigan
 
Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Hallo,

ich habe vor der Neuinstallation von Chrome Addblock installiert gehabt. Habe es aber seit dem nicht neu runtergeladen. Eigentlich sollte keine Erweiterung installiert sein. Beim Blick in die Einstellung eben sah ich eine aktive Erweiterung namens Google Docs 0,5. Ich habe keine Ahnung was das ist. Ich habe es nicht wissentlich installiert.

Mir ist eben was aufgefallen. Bei allen Seiten auf denen das Problem auftritt liegt wie ein unsichtbares Fenster über der Webseite. Diese verlinkt egal welche Seite es ist auf einen Link der beginnt mit hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9775&AUTH=83C558160C usw. Dann kommt noch eine ellenlange Zahl. Hinten dran steht dann noch refer und dahinter kommt die eigentliche Seiten URL auf der ich tatsächlich bin. Eventuell hilft dir das bei der Lokalisierung der Plagegeister.

Alt 26.04.2014, 18:43   #14
schrauber
/// the machine
/// TB-Ausbilder
 

Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Und das ist nur in Chrome, nicht in andern Browsern so?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 26.04.2014, 21:50   #15
Kerrigan
 
Webseiten werden auf Werbung umgeleitet - Standard

Webseiten werden auf Werbung umgeleitet



Ich nutze nur Chrome zum surfen und habe auch nur Chrome und den IE installiert. Im IE ist alles ok. Keine Werbung, keine komischen Links.

Hallo,

nachdem vorhin nichts im IE zu sehen war genau wie beim letzten Test in Chrome dachte ich mir das ich ihn mal eine Weile offen lasse und dann noch mal nachschaue. Mittlerweile gehen da zwar keine Werbetabs auf aber diese doofe kleine weise Fenster was in Chrome ab und zu auf den Webseiten unten ist mit dem X Balken und einem Koreanischem Schriftzeichen daneben taucht nun auch im IE auf

Antwort

Themen zu Webseiten werden auf Werbung umgeleitet
adobe, antivir, auf werbung umgeleitet, avira, browser, chrome, cpu, desktop, explorer, flash player, google, homepage, internet, langsam, links, minidump, neue seite, problem, realtek, registry, safer networking, services.exe, spotify web helper, svchost.exe, system, teamspeak, temp, usb, werbung, winlogon.exe, wuauclt.exe, öffnet



Ähnliche Themen: Webseiten werden auf Werbung umgeleitet


  1. Windows 7 Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 07.09.2015 (10)
  2. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 15.07.2015 (19)
  3. Windows 7: Webseiten werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 08.05.2015 (16)
  4. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 24.04.2015 (31)
  5. Windows 7: Webseiten werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 23.01.2015 (17)
  6. Windows 8.1: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 13.01.2015 (8)
  7. Windows 7: Webseiten werden auf Werbung umgeleitet.
    Plagegeister aller Art und deren Bekämpfung - 25.11.2014 (9)
  8. Windows 7: WEBSEITEN werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 03.10.2014 (5)
  9. Windows 8: Webseiten werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 01.08.2014 (5)
  10. Windows 7: Internet Explorer startet automatisch Werbung/ Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 27.07.2014 (7)
  11. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 19.05.2014 (15)
  12. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 17.05.2014 (7)
  13. Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 13.04.2014 (5)
  14. Windows 7: Webseiten werden auf Werbung umgeleitet
    Plagegeister aller Art und deren Bekämpfung - 16.02.2014 (9)
  15. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 07.01.2014 (6)
  16. Windows 7: Webseiten werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 30.11.2013 (12)
  17. Windows 7: Webseiten werden auf werbung umgeleitet
    Log-Analyse und Auswertung - 27.10.2013 (9)

Zum Thema Webseiten werden auf Werbung umgeleitet - Hallo, ich habe ein sehr nerviges Problem was mich langsam aber sicher zur Verzweifelung treibt. Ich surfe im Internet mit Chrome und seit ein paar Wochen tritt dort ein Werbeproblem - Webseiten werden auf Werbung umgeleitet...
Archiv
Du betrachtest: Webseiten werden auf Werbung umgeleitet auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.